Google Workspace Email Warm-Up for Cold Email: App Password or Google Sign-In

To warm up a new Google Workspace mailbox for cold email, publish SPF, DKIM and DMARC, connect the mailbox to a warm-up tool with an app password over IMAP (or one-click Google sign-in), and let it ramp from 3 to 30 warm-up emails a day. Start real outreach only after 7 clean days with a spam rate under 10%. Skip the connection details and the tool either fails to log in or never gets permission to rescue mail from Spam.

Most Google Workspace guides stop at DNS. This one covers the part that usually breaks first: getting the mailbox connected when a Workspace admin, 2-Step Verification or Google's unverified-app screen is in the way. For the DNS side in depth, keep the Google Workspace warm-up guide open in another tab.

Which connection route should you use?

A warm-up tool needs two things from a Google Workspace mailbox. It must send mail as the user, and it must read and move its own warm-up messages, so it can pull them out of Spam and reply to some. Google offers two ways to grant that.

Route 1: app password over IMAP. The user creates a 16-character app password in their Google Account and pastes it into the warm-up tool, together with the mail server settings. The tool then logs in like a desktop mail client.

Route 2: one-click Google sign-in. The user clicks "Sign in with Google", picks the account and approves the requested permission. No password is copied anywhere.

In BobWork Email Warm-up, the app password is the recommended route. Here is why, side by side:

The warm-up itself does not change with the route. The same ramp, replies and spam rescue run either way.

Why the Google sign-in route is limited

Google requires apps that ask for broad Gmail access to pass a paid security review called CASA. BobWork has not done that audit. Until an app is verified, Google limits it to 100 users in total and shows an "unverified app" notice during sign-in.

That is a Google rule, not a quality signal about the app, but it is a real constraint. Spots are limited, and the notice can look alarming to a non-technical user. The app password route avoids both.

How do you set up the app password route?

This is the route to plan around. It takes a few minutes per mailbox.

Step 1: check that IMAP is allowed

Your Workspace admin controls IMAP for the whole organisation. In the Admin console, go to Apps → Google Workspace → Gmail → End User Access and check that IMAP access is enabled for the organisational unit your sending users sit in.

Then open Gmail as the user, go to Settings → See all settings → Forwarding and POP/IMAP and confirm IMAP is on. If the admin setting is off, the user cannot turn it on.

Step 2: turn on 2-Step Verification

App passwords only exist on accounts with 2-Step Verification. The user turns it on at myaccount.google.com → Security → 2-Step Verification.

If the option is greyed out, the admin has not allowed users to enroll. The admin setting is under Security → Authentication → 2-step verification in the Admin console. Google's help page on signing in with app passwords lists the other cases where app passwords are unavailable, such as Advanced Protection.

Step 3: create the app password

With 2-Step Verification on, the user opens the app passwords page in their Google Account (search "App passwords" in the account settings), gives it a name such as "warm-up" and copies the 16-character code. Google shows it once.

Do not use the normal account password. Google no longer accepts it for IMAP sign-in from third-party tools.

Step 4: connect the mailbox

In BobWork Email Warm-up, go to Connect mailbox → Gmail → App password, enter the address and paste the code. The preset fills in imap.gmail.com on port 993 and smtp.gmail.com on port 465, so you do not type server settings.

If the login fails, the cause is almost always one of three things: IMAP is off, the code was copied with a space, or the user changed their main password (which revokes app passwords). Fix the cause and connect once. Repeated failed logins can look like account trouble to Google.

What if your admin blocks unverified apps?

Many Workspace organisations restrict third-party apps. With that policy on, a user who tries one-click sign-in sees a message that the app is blocked by their administrator.

You have two options:

1. Use the app password route. It signs in over IMAP and does not pass through Google's third-party app screen. This is the faster fix and needs no admin change, as long as IMAP and 2-Step Verification are allowed.
2. Ask the admin to trust the app. In the Admin console, under Security → Access and data control → API controls → Manage Third-Party App Access, the admin can add the app and mark it as trusted. Google documents this in control which third-party apps access Workspace data. When a Workspace admin trusts the app, the Google user cap no longer applies to that organisation.

If you are the admin, the first option keeps your third-party app policy unchanged. That is usually the cleaner choice for a security-minded team.

How should a new Workspace mailbox ramp?

Connection is the first day. The next 7 to 21 days decide whether the mailbox is ready for cold email.

BobWork's engine starts each mailbox at 3 warm-up emails a day and adds 2 a day until it reaches 30. Weekends run at 30% of the weekday volume. Sends spread across 09:00 to 18:00 in the mailbox's own time zone, so set the user's time zone correctly in Google Workspace before you connect.

About 40% of received warm-up mail gets a reply, and threads end after three messages. The content is short plain-text office talk with no links or images. You never write it, so nobody can push promotional copy through the network.

On a domain with clean history, 7 days is often enough. On a brand-new domain, plan 2 to 3 weeks. The ready check tells you when the evidence supports starting, but a new domain benefits from the extra week either way. The warm-up schedule generator prints a day-by-day plan for your start date.

One mailbox or several?

By default, a mailbox joins a shared warm-up network and exchanges mail with every other active mailbox on the service. One Google Workspace mailbox is enough to start. Peers on a different domain or provider are picked twice as often, so your mailbox does not just talk to its own colleagues.

If you would rather keep warm-up inside your own organisation, switch the account to a private pool (Mailbox pool → Pool mode). Then only your own mailboxes write to each other, and you need at least two.

When is the mailbox ready for cold email?

BobWork marks a mailbox "ready for outbound" when three conditions hold at once:

• it has been warming for 7 days or more;
• its 7-day spam rate is 3% or lower;
• it has received at least 30 warm-up emails.

The spam rate is measured directly in the receiving mailboxes: the share of this sender's warm-up mail that recipients found in Spam over the last 7 days. No third-party seed list is involved.

Ready is a floor, not a finish line. After it, keep real outreach modest, typically 30 to 50 cold emails per mailbox per day, and keep warm-up running at 10 to 15 a day alongside. If you need more volume, add mailboxes rather than pushing one user harder. Our guide to how many cold emails to send per day explains the arithmetic.

Google's own numbers still apply on top. Its email sender guidelines ask senders to keep the spam complaint rate below 0.1% and never reach 0.3%. Warm-up does not change that ceiling. A poor list will break it on day one.

Fix these common Workspace problems

Most Google Workspace warm-up issues are access issues, not reputation issues. A mailbox marked "Blocked" in the dashboard means the login or permission failed. Treat it as a settings problem first.

Check DNS with the free SPF checker, DKIM checker and DMARC checker. For Google Workspace, the DKIM selector is usually google, and the SPF record includes _spf.google.com. If mail already lands in spam, work through Google Workspace emails going to spam before you add volume.

Do this now

The only part of this you repeat per mailbox is steps 3 to 5. Once IMAP and 2-Step Verification are allowed for the right organisational unit, adding the tenth mailbox takes about as long as the first.

BobWork Email Warm-up runs the ramp, replies and spam rescue for Google Workspace mailboxes for free, up to 10 per account, with no card and no time limit. Above 10, each mailbox is $5 a month, less at higher counts; the pricing page shows the steps. Outlook and Microsoft 365 are not supported yet.

Frequently asked questions