Client mailbox warm-up handoff checklist between agency and client IT
Warm-up fails less often from bad copy and more often from a messy ownership handoff. Client IT owns DNS and admin. The agency owns ramp, caps, and list quality. When those two groups talk past each other, a new sending domain gets half-configured SPF, a revoked OAuth token mid-week, or a sudden volume spike the warm-up never earned.
GTM runs outbound inside client-isolated workspaces with connected email domains, send windows, and a compliance gate. The handoff packet below is the ops layer that sits next to that workspace so IT and agency ops share one source of truth.
What the handoff is for
This is not the full "how to warm a domain" playbook. It is the transfer document that says who can change what, what was verified, and what happens if someone leaves mid-ramp.
Use it at three moments:
- Before the first DNS change
- Before cold volume leaves warm-up-only mode
- At offboarding or when IT rotates admins
Roles before anyone touches DNS
Name people, not teams.
- Client owner: registrar, Google Workspace or Microsoft 365 admin, DNS change approval, billing
- Agency deliverability lead: architecture, ramp plan, incident pause authority
- Agency ops: inbox creation guidance, platform connection, daily health checks
- Reply owner: who answers humans in the shared inbox and under what SLA
Prefer delegated admin roles and OAuth over shared passwords. If someone pastes a root password into Slack, stop and fix access before you warm anything.
Packet section 1: domain and mailbox inventory
Write it down once:
- Primary corporate domain (business mail only; no cold outbound)
- Sending domain(s) reserved for outbound
- Inbox list with display names and providers
- Whether each inbox is new or recycled
- Warm-up start date and target steady-state daily max per mailbox
Agency SOPs that survive contact with real IT teams keep cold mail off the primary domain so billing and support stay insulated if outbound takes a bruise.
Packet section 2: DNS proof, not DNS hope
For each sending domain, capture:
- One SPF TXT record, under the 10-lookup limit, with every authorized include merged
- DKIM selector published and enabled in the provider
- DMARC present (often start with
p=noneplus rua while you learn, then tighten) - Optional tracking CNAME if you use branded link tracking
- Screenshots or export timestamps of the live records
Do not launch on "IT said they added it." Verify pass/fail from an external checker and paste the result into the packet.
Packet section 3: connection and credential boundary
Record:
- Connection method (OAuth preferred; app password only if forced)
- Which platform identities are authorized
- Where secrets live (password manager), never chat logs
- Revocation owner on the client side
LinkedIn and email identities in GTM stay inside the client workspace. The same isolation rule applies to IT access: agency staff should not keep lasting root on the client's Workspace tenant.
Packet section 4: ramp contract
Agree in writing:
- Warm-up-only window (commonly at least 14 days for new inboxes; longer for brand-new domains)
- Daily cold max by mailbox and by domain for week 1 and week 2
- Pause triggers (hard bounce spike, complaint climb, provider lock)
- Who can raise caps without a second approval
Google's sender guidelines push gradual volume and low spam rates in Postmaster Tools. The handoff should say which person watches those signals for this client domain.
Packet section 5: list and suppression readiness
Before cold volume:
- Suppression import loaded for this client workspace only
- Verified list segment tagged with verification date
- Unsubscribe URL and physical postal address owned by the brand being promoted
- Reply routing documented so warm-up replies and campaign replies do not orphan
Packet section 6: offboarding and mid-ramp admin change
When IT rotates people or the engagement ends:
- Pause campaigns first
- Export suppression and campaign settings to the client
- Revoke OAuth and rotate any app passwords
- Remove agency users from Workspace/M365 roles
- Leave DNS records that still serve active domains; remove stale tracking hosts only after confirmation
A clean exit is part of warm-up health. Orphan tokens and forgotten includes are how last quarter's agency becomes this quarter's SPF failure.
One-page acceptance
End the packet with signatures (or ticket IDs):
- DNS verified on date X by Y
- OAuth connected by Z
- Ramp caps locked
- Monitoring owner named
- Pause authority named
If that block is empty, you do not have a handoff. You have a hope.
Where GTM fits
GTM keeps find -> qualify -> write -> send/reply/book inside an isolated client workspace so one client's mailbox story cannot rewrite another's. The IT handoff checklist is how your agency and their IT stay aligned around that workspace without improvising DNS in a fire drill.
Ready to run outbound with client isolation and a compliance gate that stays on: join the GTM waitlist.