Validity announced Heatwave on 3 September. It is a domain blocklist drawn from the Validity Intelligence Network, published at lookup.validity.tools. The release describes it as identifying unethical cold email practices, including artificial domain warming. The listing policy is more specific.
What gets listed
Heatwave lists sending domains, not IPs. The trigger is synthetic reputation warming: automated messages, opens, clicks and replies exchanged between controlled mailboxes to make a young domain look trustworthy before outreach starts.
Cold outreach is a second stage. When a warmed domain is later seen sending live campaigns, the record is updated to active outreach. That flag can be reverted if the outreach stops. The warming observation stays. A domain sending cold email with no warming history is outside the scoring, whatever the “Cold Email Domain Blocklist” label in the footer says.
Listing is automatic once a score built from domain age, infrastructure and message characteristics passes a threshold. Analysts review on request.
The numbers
On 10 September the counter showed 1,052,595 domains listed, 6,981 added in the previous 24 hours and 14.7 million trap signals analysed. It refreshes every five minutes.
That is a modest count beside established domain blocklists. SURBL has been listing deceptive cold email infrastructure for some time and has led the anti-abuse response to it. Validity does not claim completeness. A “not currently listed” result is no certification, and lookups are exact-match.
“We see the same actors across hundreds of domains. Heatwave is one more independent view of that infrastructure, and each one makes it harder for operators to move. For the same actors we typically find 15 to 20 times as many domains as Validity does, so overlap matters more than count.” said Raymond Dijkxhoorn, co-founder at SURBL.
What is different
Most reputation data stays behind partner agreements. Validity has put Heatwave’s workings in public view.
Anyone can query a domain. The page shows live counts and three rolling tables: pre-listed domains, new warming listings with scores, and domains updated to active outreach. The policy explains the stages, the review process and the score, a relative band from 1 to 100 recomputed hourly that does not drive the listing decision.
Two features stand out.
Related-domain discovery. Searching a primary domain surfaces lookalike domains tied to warming. Vendors register these when they connect to a customer’s tenant, often several layers down a subcontracting chain. Validity’s advice to a listed sender is to check the related domains and ask sales, marketing and outside vendors what is running in the company’s name before assuming an error.
Pre-listing. When Validity identifies a family of domains run together for warming, other registered domains in the family can be listed before they send anything. These are marked advisory, drop off automatically if removed from the family, and appear on the public page with registration dates.
Delisting
Warming listings do not expire. Stopping the behaviour does not clear one. Removal follows a review finding the original determination wrong: misattribution, impersonation, compromise or confusion between domains. Reviews take two to five business days.
Who is using it
Validity names Comcast, Proofpoint, Spamhaus and SURBL as using or evaluating the signal, and says it is mirrored into its existing DNS reputation zones. The release carries quotes from Tom Bartel (Validity, M3AAWG board chair), Alex Brotman (Comcast), Carel Bitter (Spamhaus), Raymond Dijkxhoorn (SURBL) and Mariska Calabrese (beehiiv).
Validity’s guidance is restrained: filter at your discretion, consider it at onboarding, treat it as Validity’s measured opinion.
