In this guide 6 sections
Mailbox providers judge reputation by sending domain. If newsletters and OTPs share one, a few spam complaints from a campaign can push invoices and login codes into junk. Give each stream its own subdomain with its own SPF, DKIM and DMARC records, so a campaign gone wrong cannot damage the mail your customers are waiting for.
Why one shared domain is a risk
Gmail, Outlook and Yahoo score the domain in your From address and the domain in your DKIM signature, then attach each complaint and bounce to those names. Low engagement counts too.
A blast reaches people who never asked. Some press the spam button. Those complaints raise the score against the whole domain, including the OTP that a customer is staring at their phone to receive, so the code lands in junk.
Transactional mail is the mail someone is waiting for, from a login code to a receipt or a booking pass, and it must reach the inbox within seconds. Protect it first.
Choose the subdomains and the From names
Pick names that a reader and a mail filter can both understand, such as mail.example.com for receipts, invoices and codes and news.example.com for campaigns. Keep your main domain for staff mailboxes.
Match the From address to the stream, using orders@mail.example.com for receipts and hello@news.example.com for offers, so the name matches the signature. Never send from the root domain.
Write the plan on one page before touching DNS. Changing names later resets the reputation you built. Tell the marketing team too. They often hold the newsletter tool login, and a campaign sent from the wrong name undoes weeks of careful warm-up in an afternoon.
- Transactional: invoices, OTPs, password resets, shipping notices
- Marketing: newsletters, offers, event invitations
- Root domain: staff mail only
- Separate reply-to mailbox for each stream
Add the DNS records for each one
Each subdomain needs its own authentication. Publish an SPF record that lists only the sender used for that stream, and nothing inherited from the root domain or an old newsletter tool. Add the DKIM keys your sending service gives you, then a DMARC policy that starts in monitoring mode and sends aggregate reports to a mailbox someone actually reads.
Add a custom return-path or bounce domain on the same subdomain, if your provider supports it, so bounces return to a name you control. This aligns the bounce address with the From domain, which filters like to see, and keeps a bounce flood on one stream from spilling onto the other.
Check the records with a lookup tool, then send test messages to a few mailbox providers and read the raw headers for the Authentication-Results line. You want SPF, DKIM and DMARC all passing. Store the final records safely. The next developer who touches DNS should find every record, selector and provider note in your documentation, not rebuild them from memory.
Keep the streams apart in the application
The split must be real in code too. Use one sending account, API key or dedicated IP pool for transactional mail and a different one for campaigns, so each stream has its own limits. If both streams share a key, your provider cannot protect one from the other, and a single abuse flag can pause password resets along with promotions.
Never put a promotion inside a receipt without thought. A small discount banner is harmless for most, but a full campaign inside an invoice email blurs the line between the two streams and invites complaints.
Ask whether the customer requested each message type by acting, such as pressing reset or placing an order, because that earns a place in the transactional stream. A password reset is. A seasonal offer is not. Build suppression per stream, so a customer who unsubscribes from the newsletter still receives a password reset, a receipt or a shipping notice for an order.
Warm up and watch the numbers
A new subdomain has no history. Start with a small volume of real transactional mail, then grow it over a few weeks while you watch the first complaint and bounce reports from each provider. Do not rush the campaign list.
Watch bounce rate, complaint rate and delivery time for each stream every week, using the provider dashboard and the postmaster tools side by side. Set an alert when OTP delivery slows, since that is the first sign of trouble and the first complaint your support desk will hear.
Log the seconds between pressing send and the OTP arriving in a test inbox, on a schedule, from at least two mailbox providers. A creeping delay warns you before customers complain. Add a monthly task to your calendar: open Google Postmaster Tools and the Microsoft sender dashboards, note any warnings and paste them into the worksheet.
Sending subdomain setup worksheet
Worksheet of one page with a row per stream. Columns: subdomain name, From address, sending key, SPF include, DKIM selector, DMARC policy, bounce domain, reply-to mailbox, warm-up start date, suppression list and owner. A final block lists the weekly checks, the postmaster dashboards to open and the person who reviews each result and signs off the month.
Open a blank worksheet to printQuestions owners ask
Do I need a separate subdomain for a small business?
If you send both invoices and newsletters, yes. The setup costs an hour of DNS work, while a damaged domain can take weeks to recover and slow every receipt in the meantime.
Can I use a different domain instead of a subdomain?
You can, but a subdomain keeps brand recognition, shares the registration and renewal of the parent and is simpler to manage than a second domain name. Providers still track reputation per subdomain, so the protection is similar, though a wholly separate domain isolates the main brand even further from mistakes.
What DMARC policy should I start with?
Start with monitoring only, collect the reports, fix any legitimate sender that fails, then tighten the policy step by step toward quarantine and later reject.
Will moving to subdomains hurt delivery at first?
A little, since the new name has no history. Warm it up gradually and keep the old setup running for transactional mail until the new one proves stable in test inboxes and postmaster reports.