No cold email from a mailbox that isn't ready.
PEMAX warms your mailboxes against each other, checks SPF, DKIM and DMARC before one cold email leaves a domain, and pauses a mailbox the moment its bounces or inbox rate say so. One room tells you what needs you, worst first.
Warmup runs between your own mailboxes. No warmup vendor, no pool of strangers' inboxes.
Warmup ramp
3 to 24 a day over 21 days, then a floor of 8. About a third get a reply in the same thread.
Below 80% cold cap halves
Below 60% cold sending pauses
Hard bounces > 5% mailbox pauses
How it works
Three layers between your list and the spam folder.
Reputation is built slowly and lost in an afternoon. PEMAX builds it with warmup, protects it with a DNS gate, and defends it with guards that act on the numbers before a provider does.
01 · Warmup
Your mailboxes warm each other up.
Each mailbox on internal warmup exchanges ordinary, non-promotional mail with your other mailboxes and with partner inboxes you add, at random moments inside business hours. About one in three gets a reply in the same thread. When a warmup mail lands in Gmail spam, the receiving mailbox moves it to the inbox, which is the signal providers learn from.
- A ramp from 3 to 24 a day over 21 days, then a floor of 8 while the mailbox sends cold
- Other domains preferred as partners; same-domain pairs only as a flagged fallback
- Warmup mail never shows up as a reply in your inbox, and a partner inbox can never send cold mail
- The 7-day inbox rate drives the cold cap: below 80% it halves, below 60% cold sending pauses
Inbox rate of its warmup mail, 7-day
89%
cap halves60%
cold pauses
Today, between your own mailboxes
- 08:12sanne@brightwater.examplewarmup@brightwater-mail.exampleInbox
- 08:47sales@brightwater-group.examplejoost@brightwater.exampleSpam, moved to inbox
- 09:05warmup@brightwater-mail.examplesanne@brightwater.exampleReply in thread
- 09:38inge@brightwater.examplesales@brightwater-group.exampleInbox
02 · The DNS gate
No passing DNS, no cold mail from that domain.
Every mailbox registers its domain the moment it is connected. PEMAX checks for a healthy SPF record, a DKIM key at one of the domain's selectors and a DMARC record with a policy of none or stricter. Until all three pass, nothing cold leaves that domain. The check is never faked: an unchecked domain counts as blocked.
- Your own DKIM selectors per domain; the most specific list wins
- The exact records to publish for Google Workspace, Microsoft 365 and other hosts
- Re-check now after a fix; saving selectors asks for a new check too
- Rotation skips a blocked mailbox and re-picks one the rep may use
- SPFv=spf1 include:_spf.google.com ~allpass
- DKIMgoogle._domainkey.brightwater.examplekey found
- DMARCv=DMARC1; p=quarantine; rua=mailto:dmarc@brightwater.examplep=quarantine
- SPFv=spf1 include:_spf.google.com ~allpass
- DKIMs1._domainkey.try-brightwater.exampleno key at s1 or mail2024
- DMARC_dmarc.try-brightwater.exampleno record
03 · The guards
A mailbox in trouble stops before it does damage.
Bounces are read from the delivery reports themselves, not guessed from a subject line. A hard bounce suppresses the address that failed. When a mailbox's rate crosses a line, PEMAX acts on that mailbox, opens one alert and records it, and nobody has to be watching at the time.
- Hard bounces above 5% over 48 hours pause the mailbox
- Soft bounces above 15% halve today's cap
- A person's resume puts the mailbox on probation with a fresh bounce window
- Recovery needs the line plus 5 points, held for six hours, so a mailbox does not flap
Mon 09:10Hard bounces 6 of 96 sends in 48 hours (6.3%)
Mailbox paused, alert opened. Its queued sends wait or move to another mailbox the rep may use.
Mon 11:32Joost resumed it after cleaning the list
On probation. The bounce window starts again from this moment.
Tue 14:02Soft bounces 17% in 48 hours
Today's cap halved. Checked again every hour.
Wed 08:00Warmup inbox rate 78% over 7 days
Cold cap halved while warmup keeps running.
Thu 15:20Back above 85% for six hours
Full cap again.
Fri 10:41Google access revoked
“Reconnect your mailbox” for Joost. 12 queued sends paused, none moved to a colleague.
In detail
Every signal, in one room.
The deliverability room opens with a verdict, then lists mailboxes and domains worst first with the reason. Behind it sit these sources.
A verdict first, worst first
One line says whether anything needs you. Paused mailboxes, critical checks and closed domain gates come first, each with the reason, so the fix is obvious.Heat Score per mailbox
A 0 to 100 score from bounce rate, spam complaints, warmup progress, seed placement and authentication. A mailbox that is still warming is marked warming, not punished.DKIM selectors per domain
Type the selectors your domain uses, or paste a record name. The check probes the domain's own list before market and provider defaults, so a stale default never passes a domain.DMARC aggregate reports
With a report mailbox set up for the domain, PEMAX reads the aggregate reports Google, Microsoft and Yahoo send, works out the DMARC pass rate over three days and alerts under 95%.MX, MTA-STS and TLS reports
Each domain check also looks at MX, MTA-STS and TLS-RPT records. With a report mailbox set up, any failed TLS session in the reports raises at least a warning.Google Postmaster Tools
Connect Postmaster per domain with Google sign-in. Domain reputation, user-reported spam rate and authentication success arrive daily, with alerts at 0.1% and 0.3% spam.Bounce Shield before the send
Broken addresses and reserved domains are never sent. Disposable addresses are blocked by default, role addresses such as info@ are flagged, and you decide whether to block them.Seed placement tests
With a seed pool configured, PEMAX sends a tagged probe to inboxes at several providers and records inbox or spam and the authentication results per provider.- Coming soon
Outlook spam rescue
Gmail rescue works today. Moving warmup mail out of an Outlook junk folder needs a mailbox permission the connect flow does not ask for yet.
The details that matter
Checked again on the way out.
A sequence can be perfectly set up on Monday and wrong by Thursday. So every queued email is judged again at the moment it would leave, against these checks. Each outcome is recorded with its reason.
| The check | If it fails |
|---|---|
| The workspace is within its spend capWaitsChecked again every hour. | WaitsChecked again every hour. |
| The mailbox is connected, active and allowed to send cold mailRe-routesMoves to another mailbox the rep may use, or waits for one. | Re-routesMoves to another mailbox the rep may use, or waits for one. |
| The sequence is still runningWaitsArchived: cancelled. Paused: waits. | WaitsArchived: cancelled. Paused: waits. |
| It is inside the market's sending windowWaitsMoves to the next opening, in the market's time zone. | WaitsMoves to the next opening, in the market's time zone. |
| The address is not suppressed, bounced or unsubscribedStopsCancelled. | StopsCancelled. |
| A lawful basis, an allowed country, a full footer and the noticeStopsFails with the reason, visible in the inbox queue, plus an alert. | StopsFails with the reason, visible in the inbox queue, plus an alert. |
| The mailbox domain passes the DNS gateRe-routesRe-picked onto a mailbox that passes, or waits 15 minutes. | Re-routesRe-picked onto a mailbox that passes, or waits 15 minutes. |
| No other sequence mailed this address in 30 daysStopsCancelled. | StopsCancelled. |
| The mailbox has room under today's capRe-routesAnother mailbox with room, else the next local day. | Re-routesAnother mailbox with room, else the next local day. |
| The mailbox's own pacing slot has comeWaitsWaits for its slot, two to six minutes after the last send. | WaitsWaits for its slot, two to six minutes after the last send. |
| Hard bounces at or under 5% over 48 hoursRe-routesThe mailbox pauses and an alert opens. The email moves to a mailbox the rep may use. | Re-routesThe mailbox pauses and an alert opens. The email moves to a mailbox the rep may use. |
| Soft bounces at or under 15% over 48 hoursWaitsToday's cap halves, re-checked hourly. | WaitsToday's cap halves, re-checked hourly. |
| The mailbox's Google access still worksWaitsRevoked: the mailbox asks to be reconnected, and its emails wait for that. | WaitsRevoked: the mailbox asks to be reconnected, and its emails wait for that. |
| The one-click unsubscribe link can be madeWaitsNothing leaves without it. The email waits and an alert opens. | WaitsNothing leaves without it. The email waits and an alert opens. |
The DNS gate, in full
- The domain is registered and resolves
- SPF is published and healthy
- A DKIM key is found at one of the domain's selectors
- DMARC is published with p=none or stricter
- It is a domain you control, not gmail.com or outlook.com
A failing domain makes its emails wait and re-check every 15 minutes, so a DNS fix or a resolver hiccup never costs a sequence step.
Health lines
- Warmup inbox rate under 80%
- Cold cap halves
- Warmup inbox rate under 60%
- Cold sending pauses
- Recovery
- Line + 5 points, held 6 hours
- Hard bounces over 5%, 48 hours
- Mailbox pauses
- Soft bounces over 15%, 48 hours
- Cap halves
Defaults. Each line is a workspace setting.
FAQ
Questions about deliverability
Do I still need a warmup tool?
No. Warmup runs between your own mailboxes and any partner inboxes you connect, with no outside vendor and no shared pool. Each mailbox has a strategy switch (internal, external or off). The external setting is a seam for a warmup provider; no provider is connected to it today, and even then PEMAX would use the lower of the provider's cap and its own ramp.
What do my DNS records need to say?
A passing SPF record, a DKIM key at a selector the domain uses, and a DMARC record with p=none or stricter. Settings shows the exact records for Google Workspace, Microsoft 365 and other hosts, and what the last check found. Fix a record, press Re-check now, and the gate opens within a minute.
What happens when a mailbox gets into trouble?
It is paused or throttled on its own, an alert opens for that mailbox, and the change is recorded. A rep's sends wait or move to another mailbox that rep may use; they never jump to a colleague's. Once the cause is fixed, a person resumes it and it starts on probation with a fresh window.
Does PEMAX rescue mail from Outlook junk folders?
Not yet: Outlook spam rescue is coming soon. Gmail rescue works today. For mailboxes connected over plain IMAP, PEMAX records where warmup mail landed but cannot move it.
Will warmup mail clutter my reps' inbox?
No. Warmup mail carries its own header and token, and PEMAX only treats a message as warmup when it matches a warmup mail it sent, so a real reply is never hidden. The text of warmup mail is deleted after 30 days by default; the landing and rescue statistics stay.
Do you guarantee inbox placement?
No, and nobody honestly can. What PEMAX does guarantee is that it refuses to send when the signals it can see are bad, and tells you which signal it was.
One workspace
Works with the rest of PEMAX
See PEMAX on your own pipeline.
Thirty minutes with the people who build it. We show the product on a real workspace, answer the hard questions about deliverability and compliance, and tell you honestly whether it fits.
Invite-only workspaces · Hosted in the EU · Bring your own keys