The Heatwave Blocklist Just Killed Fake Email Warming Networks

Validity announced the Heatwave blocklist on September 3, 2026. It targets synthetic domain warming: automated systems that generate fake messages, opens, clicks and replies between controlled mailboxes to make a young domain appear trustworthy before cold outreach begins.

The blocklist had listed more than 1 million domains by the September 3 announcement, drawn from millions of data points in the Validity Intelligence Network. It is published at lookup.validity.tools and is being used or evaluated by Comcast, Proofpoint, Spamhaus and SURBL.

Tom Bartel, Senior Vice President of Data at Validity and board chair of M3AAWG, said in the press release: "When reputation is manufactured instead of earned, it's just plain cheating, and the whole ecosystem suffers. Senders who play by the rules lose out, and mailbox providers end up tightening the screws on everyone."

What is synthetic domain warming

Synthetic warming services connect to a customer's email tenant, register domains that resemble the customer's own, and generate automated engagement signals between networks of fake accounts. These false signals feed into the systems Gmail, Outlook and other mailbox providers use to decide whether a sender is legitimate.

The warming stage comes first. Once the domain appears trustworthy, live cold outreach campaigns begin. Heatwave lists domains based on the warming behavior. When a warmed domain is later seen sending live campaigns, the listing is updated to show active outreach.

Campaigns often run through subcontracted vendors or partner providers several layers removed from the sender's team. Warming activity can happen under a brand's name without anyone at the company knowing. Searching a primary domain at lookup.validity.tools can surface related lookalike domains tied to warming that a sender never knew existed.

How the Heatwave listing works

Heatwave lists sending domains, not IP addresses. Listing is automatic once a score built from domain age, infrastructure and message characteristics passes a threshold. Analysts review listings on request.

The public page at lookup.validity.tools shows live counts and three rolling tables: pre-listed domains, new warming listings with scores, and domains updated to active outreach. The score is a relative band from 1 to 100, recomputed hourly. It does not drive the listing decision.

As of September 10, 2026, the counter showed 1,052,595 domains listed, 6,981 added in the previous 24 hours, and 14.7 million trap signals analyzed. The counter refreshes every five minutes.

Who is using the Heatwave signal

Validity named Comcast, Proofpoint, Spamhaus and SURBL as using or evaluating the signal in the September 3 press release. The signal is mirrored into Validity's existing DNS reputation zones, giving mailbox and message security partners already using Validity reputation data access without needing to consume it separately.

Alex Brotman, Senior Engineer at Comcast, said: "We utilize Validity reputation data signals. This particular signal is interesting because reputation relies on senders intentionally behaving ethically and doing the right thing. Nobody likes shortcuts, and nobody likes deception."

Carel Bitter, CEO at Spamhaus, said: "Our work with Validity on Heatwave gives us an additional signal we can use to correlate domains and better understand the infrastructure behind this activity. That added context helps us identify patterns earlier and respond more precisely."

Raymond Dijkxhoorn, CEO at SURBL, said Heatwave adds a complementary signal built from a different data set. SURBL has been listing deceptive cold email infrastructure for some time and typically finds 15 to 20 times as many domains for the same actors as Validity does, according to Email Expert.

What this means for legitimate outreach

The Heatwave blocklist does not target cold outreach itself. A domain sending cold email with no warming history is outside the scoring. The trigger is synthetic engagement: automated signals designed to fake trust.

Mariska Calabrese, VP of Security at beehiiv, said in the press release: "Synthetic domain warming is a direct violation of beehiiv's Acceptable Use Policy. Manufacturing fake engagement to trick an inbox into trusting a sender isn't legitimate, it's deception. The senders on our platform earn their reputation the real way, through subscribers who actually want their content."

Legitimate outreach builds familiarity through real activity. On LinkedIn, that means showing up in the buyer's feed through daily comments on their posts before the connection request lands. The request arrives warm because the name is already familiar. No automated engagement, no fake signals, no deception.

Validity's guidance is to filter at your discretion, consider the signal at onboarding, and treat it as Validity's measured opinion. A "not currently listed" result is no certification, and lookups are exact-match only.

How to check if your domains are listed

Go to lookup.validity.tools and enter your primary domain. The page will show whether the domain is listed and surface any related lookalike domains tied to warming. These related domains are often registered by vendors when they connect to a customer's tenant.

If your domain is listed, Validity recommends checking the related domains and asking sales, marketing and outside vendors what is running in the company's name before assuming an error. Warming campaigns can run through subcontracted vendors several layers down a partnership chain.

Removal follows a review finding the original determination wrong: misattribution, impersonation, compromise or confusion between domains. Reviews take two to five business days. Stopping the warming behavior does not clear a listing. The listing does not expire.