Gmail Account Locked While Sending: Recovery and Safer Warm-Up

A Gmail account locked while sending warm-up email usually means Google saw a risky sign-in, bursty sending, or unsafe app access before the mailbox had enough normal history. If you keep retrying SMTP or launch cold email anyway, the lock can last longer. This guide shows how to recover, restart warm-up, and prevent a repeat.

Treat the lock as a stop sign, not a deliverability score. Restore account access first. Then check security, app access, authentication records, and your sending ramp.

Keep the Gmail warm-up guide open while you work through the steps. If the domain is new, follow the slower plan in the new-domain warm-up guide instead of pushing more volume through one mailbox.

Why is Gmail account locked sending?

Google does not publish one public score that explains every Gmail lock. Most locks are security or abuse-prevention responses.

During warm-up, the usual triggers are predictable.

A new mailbox has little sending history. If it signs in from a new app, enables IMAP or SMTP, and sends several messages on day one, the pattern can look automated.

A new domain adds risk. Gmail has not seen enough normal mail from that domain. Missing SPF, DKIM, or DMARC makes the starting point weaker.

Repeated login failures also matter. Wrong app passwords, disabled IMAP, blocked third-party access, disabled 2-Step Verification, or changing credentials during warm-up can create a chain of failed attempts.

Location changes can add friction. If the account is created in one country, connected from a server elsewhere, then opened in a browser from another place, Google may challenge it.

Content can contribute too. Identical messages, link-heavy mail, shortened URLs, large attachments, and sudden cold outreach are patterns Gmail filters can scrutinise.

That is why a lock often appears after warm-up starts, even when warm-up is not the only cause. The mailbox, domain, DNS, access method, and sending pace all combine.

Use primary sources when you change settings: Google’s email sender guidelines, Google’s suspicious account activity help, and Google’s app password help.

What should you stop first?

Stop all automated sending before you retry anything.

Do not keep pressing reconnect. Do not switch tools and try again. Do not start a campaign from another mailbox on the same new domain while the first account is locked.

Repeated authentication attempts make the incident harder to read. They also hide the original cause. You want one clean recovery attempt, not a long trail of failed IMAP and SMTP logins.

Use this checklist before reconnecting warm-up.

If Google displays a wait time, follow it. If the account belongs to Google Workspace, involve the admin before changing security settings.

For Workspace, the admin should also review user status and app access in the Admin console. If the organisation blocks IMAP, third-party access, or app passwords, no warm-up tool can bypass that safely.

How do you recover safely?

Start with the browser, not SMTP.

Open Gmail in a familiar browser profile. Complete any phone, backup email, passkey, or recovery prompt Google shows. If Google says the account is temporarily unavailable, wait instead of looping retries.

Then review security activity.

Go to Google Account → Security. Check Recent security activity and Your devices. Remove sessions you do not recognise. If you see activity you did not initiate, change the password before reconnecting any tool.

Next, confirm 2-Step Verification.

For Gmail app passwords, Google requires 2-Step Verification. After it is active, create a fresh app password for the mail connection. Store it once in your warm-up tool. Do not test it repeatedly across several tools.

Now check Gmail settings.

If your connection uses IMAP, make sure IMAP is enabled. In Gmail, go to Settings → See all settings → Forwarding and POP/IMAP → IMAP access.

For Google Workspace, the admin may need to allow IMAP and app passwords. The exact policy depends on the Workspace security setup. If the admin uses context-aware access or blocks less common clients, ask before reconnecting.

BobWork Email Warm-up supports Gmail and Google Workspace. The recommended route is IMAP with an app password. One-click Google sign-in also exists, but Google caps unverified apps at 100 users and shows an unverified-app notice because the CASA audit has not been completed. A Workspace admin can mark the app as trusted in the Admin console.

Once browser access works, send one normal manual email to a colleague or your own separate inbox. Use a real subject and plain body. Do not include links. Wait for delivery and, if possible, a normal reply.

Only then reconnect warm-up.

What Gmail ramp is safer?

A safe Gmail ramp is slow, spaced, and boring. That is the point.

The goal is normal traffic before cold outreach: stable sign-ins, low-risk content, replies, and consistent inbox placement. You do not want a graph that jumps from zero to campaign volume.

BobWork’s engine starts at 3 emails per day, adds 2 per day, and caps at 30 per day by default. Weekends run at 30%. Sends are spread from 09:00 to 18:00 in the mailbox’s own time zone, with random checks every 15 minutes. A pair never writes to each other twice within three hours.

The free shared warm-up network handles that spacing automatically. You can also switch to a private pool per account if you prefer. In private mode, only your own mailboxes warm each other, and you need at least two mailboxes.

After a lock, use a lower restart schedule than a normal ramp.

For a brand-new domain, use 3–4 weeks before normal outreach. For an existing domain with good history, 14 days is a typical minimum.

Do not treat the cap as a target. A Gmail mailbox sending 12 warm-up emails daily, receiving replies, and avoiding locks is healthier than one forced to 80 per day for no reason.

In BobWork, ready for outbound means 14 or more days warming, a seven-day spam rate of 10% or lower, and at least 30 warm-up emails received. If a mailbox’s spam rate rises above 5%, pause it for a few days.

For a day-by-day plan, use the email warm-up schedule. To compare hand-written warm-up with software handling, read manual warm-up versus automation.

Which DNS checks matter?

A Gmail lock is not always caused by DNS. Bad DNS still makes every recovery weaker.

At minimum, your sending domain needs SPF, DKIM, and DMARC. For cold email, alignment matters. The visible From domain should align with the authenticated domain used by SPF or DKIM.

Google’s bulk sender guidance says spam complaint rates should stay under 0.1% and should never reach 0.3%. Even if you send below bulk volumes, those thresholds are useful guardrails. They describe the sender behaviour Gmail wants to see.

Check the records before restarting warm-up.

SPF should include the systems allowed to send for your domain. Avoid multiple SPF records. Use one TXT record for the domain.

DKIM should be enabled in Google Workspace if you use Workspace. For other SMTP routes, enable the provider’s DKIM record and wait for DNS propagation.

DMARC can start at p=none while you monitor. The record should exist and use the same organisational domain as your From address.

BobWork checks SPF, DKIM, and DMARC daily per domain. It looks for common DKIM selectors including google, zmail, default, selector1, selector2, k1, s1, mail, dkim, lark, feishu, and zoho. You can also run separate checks with the SPF checker, DKIM checker, and DMARC checker.

Do not ignore content. During recovery, use plain text. Avoid links, images, attachments, tracking pixels, and repeated templates. Warm-up mail should look like short office conversation, not marketing.

BobWork warm-up content uses plain text, first-name greetings, no links, and no images. About 40% of received warm-up mail gets a reply, and threads end after three messages. The engine only touches warm-up mail carrying its own hidden header, so real mail is not read, moved, or answered.

Is it a lock or spam?

A lock and spam placement need different fixes.

A lock means Gmail restricted access or sending. Recover the account, verify security, and restart slowly.

Spam placement means Gmail accepted the message but placed it in Spam. Check DNS, reputation, content, list quality, and recipient engagement.

Do not declare warm-up failed just because Gmail locked the account. First ask when the lock happened.

If the lock happened at connection time, the likely cause is app access, app password, admin policy, or suspicious sign-in.

If it happened after a sudden sending increase, the likely cause is volume or automation pattern.

If it happened after cold outreach began, inspect the campaign. High bounce risk, poor targeting, link-heavy copy, missing unsubscribe handling, or repeated templates can hurt the mailbox quickly.

For spam placement, measure actual landings where possible. BobWork measures the share of a sender’s warm-up mail that receiving mailboxes found in Spam over seven days. It does not use third-party seed lists. Warm-up mail found in Spam is moved to Inbox, marked read, labelled Warm-up, and archived after 24 hours.

For Gmail-specific spam causes, use the Gmail spam troubleshooting guide. For the broader list, read why emails go to spam.

Use this decision rule:

• If the account is locked, stop all automation.
• If the account is open but spam rate is rising, lower volume and fix signals.
• If both happen, treat the lock first. Then restart with a smaller ramp.

How low should outreach stay?

Warm-up does not make unlimited cold email safe.

Once the mailbox is stable, keep real outreach conservative. A typical cautious range is 30–50 cold emails per day per mailbox. New domains should start below that. Add mailboxes instead of forcing one mailbox to carry the campaign.

During campaigns, keep warm-up running at 10–15 emails per day. The goal is steady background activity, not inflated warm-up volume.

Send during working hours. Avoid bursts. Leave several minutes between cold sends from the same mailbox. Do not send 40 emails at 09:00 because the day just started.

Use one-click unsubscribe for campaign mail. Honour unsubscribes quickly. Google and Yahoo expect clear unsubscribe handling for bulk senders. Yahoo’s sender guidance also requires SPF and DKIM, DMARC at least p=none and passing, aligned From domains, and spam rates under 0.3%.

Clean your list before sending. High bounces can damage a mailbox faster than a slow warm-up can repair. If bounce rate rises, stop and fix the source list.

Keep the mailbox human too. Read replies. Archive normal mail. Send occasional manual emails. A mailbox that only sends automated sequences is easier to distrust.

If you use BobWork Outbound beta, only mailboxes that pass the ready gate can send. The first week after ready is capped at 30 cold emails per day per mailbox, then 50 per day after. Warm-up keeps running on the same mailboxes while they send.

How should you restart?

Restart one thing at a time.

First, restore browser access. Second, fix account security. Third, verify DNS. Fourth, reconnect warm-up at a low cap. Fifth, wait for stable warm-up signals. Sixth, add cold outreach only if the mailbox stays calm.

Do not change the domain, app password, sending tool, campaign copy, and daily volume on the same day. If the lock returns, you will not know which change caused it.

For a new Gmail account, one mailbox is enough to start in BobWork’s shared warm-up network. It will exchange warm-up messages with other active mailboxes in the network. Two or more mailboxes on different domains or providers still help create broader sending patterns. If you prefer not to use the shared network, switch to a private pool in the dashboard under Mailbox pool → Pool mode.

BobWork Email Warm-up is free at emailwarmup.bobwork.ai for up to 10 mailboxes, with no credit card and no time limit. Use it to restart slowly, watch the seven-day spam rate, and check SPF, DKIM, and DMARC before sending real campaigns again.

Frequently asked questions