Why you should not send from your root domain

The default is to send everything from yourcompany.com. It works until one stream has a bad month, at which point everything shares the consequences — including the password resets.

What a subdomain buys

Separate reputation. Mailbox providers track reputation at the domain level, and a subdomain is a domain. A newsletter that collects complaints on news.yourcompany.com does not drag down send.yourcompany.com.

A separate SPF budget. The ten-lookup limit applies per record. Three sending subdomains means three records, each with its own budget, and the pressure that pushes people toward flattening disappears.

Blast radius. If a subdomain ends up on a blocklist, the rest of your mail keeps moving while you deal with it.

The root domain stays clean. Your corporate mail — the mail people write by hand — is the mail you can least afford to have filtered. Keeping bulk sending off that domain protects it.

A workable split

• yourcompany.com — human correspondence only. No automated sending at all.
• send.yourcompany.com — transactional: receipts, password resets, alerts. Highest engagement, lowest complaint rate, most important to deliver.
• news.yourcompany.com — marketing and newsletters. Where complaints will land, isolated from everything else.
• notify.yourcompany.com — high-volume automated notification, if you have enough of it to be worth separating.

Do not over-split. Each subdomain needs its own reputation, and reputation is built by consistent volume. A subdomain sending forty messages a week never establishes one. Two or three is usually right.

What each needs

Every sending subdomain needs its own SPF record, its own DKIM selector, and — importantly — it inherits the DMARC policy of the parent unless you publish one for it.

That inheritance is controlled by sp on the parent record. A parent at p=none; sp=reject means subdomains are rejected on failure, which is usually what you want: an unused subdomain has no legitimate mail to break.

Alignment still applies

Relaxed alignment, the default, matches on the organisational domain — so a From of news.yourcompany.com aligns with authentication for yourcompany.com and vice versa. Strict would not. This is another reason to leave alignment relaxed.

Migrating an existing sender

Moving a stream to a subdomain means starting its reputation from nothing. Do it the way you would warm a new IP: a small share of volume at first, weighted toward the most engaged recipients, increasing over days rather than hours.

Do not move everything on one evening. A domain that has never sent and then sends a hundred thousand messages is indistinguishable from a compromised account, and will be treated as one. The warmup guide covers the shape of the ramp.