Warmup on Workspace and Microsoft 365

The limits belong to the provider, not to the tool

Every warmup tool sends and files mail through your mailbox, which means the warming traffic sits inside the same published quotas as everything else you send. These are the numbers your admin can quote at you, so it is worth knowing them before the conversation rather than during it.

Sources: Google Workspace Admin, Gmail sending limits and Microsoft Learn, Exchange Online limits, both checked 23 September.

For most warmup setups the daily figures are not the binding constraint, because warming volumes are small. The one to watch is the per minute rate on Microsoft 365 when a tool bursts, and the per message recipient limit for relay users on Workspace.

Before the tool: the authentication your provider expects

No warmup tool publishes your DNS records for you, and no amount of warming substitutes for them. Google's own sender guidelines set the floor: all senders must set up SPF or DKIM for their sending domains, and senders of more than 5,000 messages a day to Gmail accounts must set up SPF and DKIM plus DMARC, support one-click unsubscribe on marketing and subscribed messages, and keep spam rates reported in Postmaster Tools below 0.3%, with a recommended target below 0.10% (Google, Email sender guidelines, checked 23 September).

1. Publish SPF and DKIM for every sending domain and subdomain, including the ones you only use for cold outreach. A subdomain does not inherit its parent's DKIM signing.
2. Publish DMARC, starting at p=none and collecting the reports, so you can see what is actually being sent under your name before enforcing anything.
3. Record the state before you connect any tool. Observed, per domain, with the date. This is the single most useful line in a later report, because it is a configuration fact rather than a prediction.
4. Only then connect the warmup tool. If authentication is broken, warming is being asked to compensate for a problem it does not touch.

If you are not yet sure whether authentication, warming, testing or list quality is your actual problem, run the diagnosis first. It is free, and it is the step that stops people paying for the wrong one of the four.

Google Workspace: what your admin controls

On Workspace, the blocker is almost always the connection method rather than the tool. Two paths exist, and one of them is closed to a large share of business accounts.

Source: Google Account Help, sign in with app passwords and Google Account Help, third party access, checked 23 September.

None of the vendors we track publishes its Workspace connection method on its pricing page, which is why this question has to be asked rather than looked up. Our product notes on MailReach, Warmup Inbox and Instantly record what each one documents publicly, and mark the rest as unknown rather than filling it in.

The consequence for anyone evaluating tools: ask which method the tool uses before the trial. A vendor whose only integration is an app password cannot connect a standard Workspace business mailbox, and you will discover that after the card has been charged rather than before.

Microsoft 365: Authenticated SMTP, and why it is usually off

On Microsoft 365 the equivalent switch is Authenticated SMTP, and the default posture is restrictive by design. Microsoft's own recommendation is to disable SMTP AUTH in your Exchange Online organization, and enable it only for the accounts (mailboxes) that still require it. There are two settings: an organization-wide one, and a per mailbox one that overrides it.

• Organization wide: the Turn off SMTP AUTH protocol for your organization toggle in the Exchange admin center's mail flow settings, or Set-TransportConfig -SmtpClientAuthenticationDisabled $true.
• Per mailbox: the Authenticated SMTP checkbox under Users, Active users, the user, Mail, Manage email apps, or Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false to enable it for one mailbox. The value $null returns that mailbox to the organization setting.
• Security defaults: Microsoft notes that if security defaults is enabled in your organization, SMTP AUTH is already disabled, and that you would need to disable security defaults to use it.
• Authentication policy: if your policy disables basic authentication for SMTP, clients cannot use SMTP AUTH even if the settings above are enabled. SMTP AUTH supports modern authentication through OAuth as well as basic authentication.

Source: Microsoft Learn, Enable or disable SMTP AUTH in Exchange Online, checked 23 September.

Where a tool supports OAuth rather than basic authentication for Microsoft 365, prefer it, for the same reason as on Workspace: the grant is visible, attributable and revocable without changing a password that other things depend on.

Permissions, revocation and exports, written down

Whichever platform you are on, treat mailbox access as something you grant deliberately and remove deliberately. The ledger below is the one we keep, and it is fictional and written for this guide.

Three habits make this ledger worth keeping. Verify every revocation by re-reading the app passwords list, the third party access list or the Authenticated SMTP value, and record that you did. Name the account owner, because a client's mailbox is the client's to revoke and the record proves you asked. And keep the refusals: a mailbox your admin would not connect is a fact about your stack, not a gap in your notes.

On exports, decide what you need out of the tool before you need it. The list, and the order of operations when you leave a vendor, are in switching warmup tools. What goes into the client file, and the sentences that get you into trouble, are in the client reporting template.

What this does not settle

The figures on this page are published limits and documented settings. They tell you what the platform permits. They do not tell you where your mail lands, and nothing here should be read as a placement claim.

• Limits are not deliverability. Staying under 2,000 messages a day on Workspace says nothing about which folder they arrive in.
• Authentication passing is not placement. SPF, DKIM and DMARC are a floor that lets you be identified, not a predictor of the inbox.
• Seed tests measure seeds. A placement test tells you where a message landed for the tester's addresses, and your recipients are not those addresses. Read one properly in our guide to placement tests.
• Limits change. Both providers revise these pages, and tenant type and licence count change what applies to you. Re-read the two official sources above before quoting a number to a client.
• No tool, and no configuration, guarantees inbox placement. Anyone offering that is selling, not describing.

If the arithmetic of mailboxes, sender profiles and test credits is the part you are stuck on, the cost calculator does it per month and per unit, with the unknowns left visible rather than filled in.