IP Warmup for a New VPS Mail Server: Avoid the Spam Folder

You just spun up a fresh VPS, configured Postfix and Dovecot, got SPF, DKIM, and DMARC all passing, and sent your first real campaign — and it landed in spam. Everything looks technically correct, yet Gmail and Outlook still shove your mail into the junk folder. The missing piece isn't a DNS record. It's reputation, and a brand-new IP simply doesn't have any.

Symptom: perfect DNS, mail still in spam

This shows up a few different ways once a new mail-sending IP goes live:

• Gmail delivers to spam with no bounce and no error — the message just doesn't show up in the inbox.
• Outlook/Microsoft 365 recipients report mail going to Junk, or it never arrives and there's no NDR to explain why.
• A few messages get through fine, then delivery quietly drops off after you send a larger batch.
• Google Postmaster Tools shows your domain or IP reputation as "Low" or "Bad" a day or two after you start sending.

The frustrating part is that mail-tester.com or a manual header check often scores 9/10 or 10/10. SPF, DKIM, and DMARC alignment aren't the problem — inbox providers just don't trust an IP with zero sending history yet, so they route it to spam by default until it proves itself.

Cause: reputation is earned, not configured

Gmail, Outlook, and Yahoo build a reputation score for every sending IP and every sending domain based on history: volume sent, how consistent that volume is day to day, how many recipients open or reply, and — critically — how many mark it as spam or how many messages bounce. A new IP has none of that history, so it starts at a neutral-to-suspicious baseline. Send a large volume from it immediately and you look exactly like a spammer that just rented a fresh IP to dodge a blocklist, because that's a real and common pattern providers actively defend against.

Three things make it worse:

Fix: warm the IP up on a ramp-up schedule

Before sending a single marketing or bulk email, confirm the fundamentals are actually in place — warmup won't fix a broken authentication setup, it only fixes reputation.

1. SPF includes your VPS IP: v=spf1 ip4:YOUR.VPS.IP.HERE -all (or ~all while you're still testing).
2. DKIM is signing outbound mail — check headers with opendkim-testkey or a tool like mail-tester.com.
3. DMARC exists, even a soft p=none policy, so you get aggregate reports back.
4. Reverse DNS (PTR) on the IP resolves to your mail server's hostname, and that hostname resolves back to the IP (forward-confirmed rDNS).
5. The IP isn't already on a blocklist — check it at mxtoolbox.com/blacklists before you start.

Once those are solid, ramp volume up gradually instead of sending everything at once. There's no single official number from any provider, but this schedule works reliably in practice for a new dedicated IP:

A few rules make this actually work:

• Send consistently, not in bursts. A steady daily pattern builds trust faster than one huge day followed by silence.
• Start with your best recipients. People who've emailed you before, opened your last few messages, or are internal test accounts across Gmail/Outlook/Yahoo. Their engagement is a strong positive signal early on.
• Watch bounce and complaint rates daily during the ramp, not weekly. A spike on day 3 is easy to fix; the same spike discovered on day 20 has already done damage.
• Never mix warmup with a purchased or scraped list. That combination is close to guaranteed to burn the IP before it's even warm.

If you're relaying through a transactional provider (SendGrid, Mailgun, Amazon SES) instead of sending directly from the VPS, most of them offer a built-in IP warmup feature on dedicated IPs — use it rather than hand-rolling the schedule, since they already tune it against real inbox provider behaviour.

Prevention: keep the reputation you built

• Set up Google Postmaster Tools before you start warming up, so you can see reputation and spam-rate trends from day one instead of guessing.
• Keep your list clean — remove hard bounces immediately and suppress repeat soft-bounce addresses after a few attempts.
• Make unsubscribing genuinely easy. A complaint costs far more reputation than an unsubscribe does, and a hidden or broken unsubscribe link pushes people toward hitting "Report spam" instead.
• If volume needs are ongoing and serious, use a dedicated sending IP per use case (transactional vs marketing) so one bad campaign doesn't tank delivery for password resets and order confirmations too.
• Re-warm after a long gap. An IP that's been idle for a month or more has partially decayed reputation — treat a return to sending like a smaller version of the original ramp-up.

None of this replaces getting SPF, DKIM, and DMARC right first — warmup is what happens after authentication is already solid, not instead of it. If a fully-warmed IP suddenly starts landing in spam, that's a different problem: check for a fresh blocklist listing rather than assuming the reputation reset itself.