Research9 min read

How provider ML fingerprints warmup pools

Warmup pools are coordinated domain networks. Every major provider runs coordination-detection on inbound mail. Here are the signals that make a pool visible from the provider side.

If you were Google and wanted to find coordinated warmup pools in the Gmail firehose, you wouldn't need exotic ML. The signals are obvious once you know what to look for, and they borrow directly from techniques the Search team uses to find link farms and the YouTube team uses to find view-bot rings.

TL;DR

Warmup pools leak six fingerprint classes: graph closure, thread template uniformity, reply latency uniformity, diurnal mismatch, engagement co-occurrence, and domain age correlation. Each is detectable with simple classifiers. Stacked, they are nearly impossible to hide at pool scale.

1. Graph closure

Pool members mail each other at near-100% rate. Draw the directed graph of who-mails-whom over 30 days. Pool domains form a dense clique that almost never touches the rest of the internet. Real sender domains send to a long tail of recipient domains and receive from a different long tail.

Detection: compute the ratio of in-pool / out-of-pool mail per domain. Pool members sit at 0.6–0.9. Organic senders sit at 0.001–0.05.

2. Thread template uniformity

Warmup services generate threads from a template bank. Even with AI-rewriting, the structural skeleton repeats: subject patterns, greeting, one-paragraph body, sign-off. N-gram fingerprinting against the pool's own traffic lights up clusters of “fraternally similar” messages.

3. Reply latency uniformity

Humans reply to email on a log-normal distribution — a few fast replies, a long tail of hours-to-days. Bots in warmup pools reply on a tight Gaussian around whatever the tool's default is (usually 2–15 minutes). Fit a log-normal to the reply latencies of a domain's inbound engagement; a tight centred peak is a pool.

4. Diurnal mismatch

A US-based SaaS domain with even reply distribution across all 24 UTC hours isn't real. Real recipients cluster in their local business hours. Pools with members across timezones flatten the distribution; pools that hit every timezone hour uniformly are the distribution.

5. Engagement co-occurrence

“Mark as important”, “add to contacts”, and “move to inbox” are rare actions in organic mail — a few percent of messages. In warmup pools they're triggered on nearly every pool message because that's what generates reputation signal. The co-occurrence matrix of (domain A sent, domain B marked-important) is orders of magnitude denser within the pool than outside it.

6. Domain age and registrar correlation

Warmup pools skew toward new sending domains on cold-email stacks. Cluster domains by age, registrar, MX provider, and ASN. Real business domains scatter; pool members cluster tightly.

Why stacking them is lethal

A pool might defeat any one signal with enough effort. Defeating all six simultaneously at the scale of thousands of participating domains is a different order of problem. Each signal you scramble costs the vendor money; past some point it's cheaper to shut the pool down and tell customers to “focus on authentication”.

Measure reputation from the outside

If you want the view Google has of your domain, the closest proxy you can get is an independent placement test from seed mailboxes outside any pool. Anything from within the pool grades itself.

FAQ

Do all six signals apply to small private pools?

Less so. A 10-domain private pool among your own team is too small to trip most classifiers — but it's also too small to generate meaningful reputation lift. The value proposition only exists at scale, and scale is exactly what gets detected.

Can AI-rewritten pool content escape detection?

Not structurally. AI rewriting changes surface tokens but preserves thread shape, latency, and graph patterns. Three of the six fingerprints are independent of content.

Is there any warmup that avoids all six?

Ramping real volume to real opt-in recipients — which isn't a pool at all, it's just sending mail. That's the honest warmup.
Related reading

Check your deliverability across 20+ providers

Gmail, Outlook, Yahoo, Mail.ru, Yandex, GMX, ProtonMail and more. Real inbox screenshots, SPF/DKIM/DMARC, spam engine verdicts. Free, no signup.

Run Free Test →

Unlimited tests · 20+ seed mailboxes · Live results · No account required