Send bulk and marketing email from a subdomain, news.yourdomain.com, mail.yourdomain.com, and keep your root domain for human correspondence and critical transactional mail. Mailbox providers track reputation per subdomain, so a marketing campaign that goes wrong junks the subdomain's mail, not your CEO's emails or your invoices. The subdomain costs nothing, needs three DNS records, and is the single cheapest piece of risk isolation in email infrastructure.
How reputation tracking actually works
Gmail, Microsoft, and Yahoo score senders on several axes at once:
| Reputation unit | Tracked by | Scope |
|---|---|---|
| IP address | All providers | The sending server |
| Exact domain/subdomain | Gmail (Postmaster shows it), Microsoft, Yahoo | The DKIM/From domain |
| Organizational domain | All, as a secondary signal | yourdomain.com and everything under it |
The middle row is why subdomains work: news.yourdomain.com accumulates its own history, its own spam-rate stats, its own standing. The bottom row is why they are not magic: providers also keep an organizational-domain view, so a subdomain running outright abuse eventually stains the whole domain.
Gmail's own lines show what is at stake per stream: its sender guidelines ask senders to keep the spam rate in Postmaster Tools below 0.1% and never let it reach 0.3%. A subdomain lets a marketing stream that drifts toward 0.3% do so without dragging your invoices with it.
Practical translation: subdomains isolate normal failure (a bad campaign, a stale list, a complaint spike) extremely well. They do not launder abuse.
What goes where
| Mail stream | Send from | Why |
|---|---|---|
| Person-to-person (sales, support) | Root domain | Trust, recognition |
| Critical transactional (invoices, resets) | Root or tx. subdomain | Must always inbox |
| Newsletter / marketing | news. or mail. subdomain | Highest complaint risk in normal ops |
| Notifications / product email | notify. or m. subdomain | High volume, separate cadence |
| Cold outreach | Separate domains entirely | Risk too high even for a subdomain |
That last row matters: a subdomain still shares organizational reputation with your root. Cold email belongs on lookalike secondary domains, full setup in our cold email multiple domains guide.
DNS setup for a sending subdomain
Three records, published before the first send:
# SPF on the subdomain itself
news.yourdomain.com. TXT "v=spf1 ip4:203.0.113.10 -all"
# DKIM key for the subdomain
s1._domainkey.news.yourdomain.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."
# Explicit DMARC for the bulk stream (otherwise root policy applies)
_dmarc.news.yourdomain.com. TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
Verify:
dig TXT news.yourdomain.com +short
dig TXT _dmarc.news.yourdomain.com +short
Use a 2048-bit DKIM key for the subdomain if your DNS host accepts the longer record; Gmail requires at least 1024 bits. Since February 2024, Gmail has required SPF, DKIM and DMARC from anyone sending 5,000 or more messages a day, so a bulk subdomain needs all three before its first campaign.
Two details people miss:
- DMARC inheritance. Without a subdomain
_dmarcrecord, the root's policy (and itssp=tag, if set) governs the subdomain. Publishing an explicit record lets you runp=rejecton the bulk stream while the root is still atp=quarantine. - rDNS/HELO alignment. If the subdomain sends from your own dedicated IP, set the PTR to a matching hostname (
mail.yourdomain.com).
Warm-up: a new subdomain starts cold
A fresh subdomain is an unknown sender even if your root domain has years of history, providers transfer some organizational trust, but not much. Ramp it like a new sender: engaged recipients first, volume increasing over 2-4 weeks. If it ships with a new dedicated IP too, follow the full IP warm-up schedule, which is the slower of the two clocks.
Register the new subdomain in Google Postmaster Tools on day one so you can watch its reputation build separately from the root. Once it is warm, keep its daily volume steady. A quiet subdomain that suddenly sends ten times its usual volume looks like a compromised account to receivers, and gets throttled like one.
Keep the whole stream on the subdomain
Moving the From address is only half the job. Every hostname a message touches feeds the reputation that stream builds, so line them up under the sending subdomain:
| Piece | Example | Why it matters |
|---|---|---|
From and DKIM d= | news.yourdomain.com | The identity Gmail scores and Postmaster Tools reports |
| Return-Path (bounces) | bounce.news.yourdomain.com | Keeps SPF aligned with the From domain, so DMARC can pass on SPF as well as DKIM |
| Click tracking | click.news.yourdomain.com | A shared tracking domain carries other senders' history into your links |
| Reply-To | a monitored inbox | Replies are a positive engagement signal; no-reply@ throws them away |
Two slips catch people out. First, SPF does not inherit: a record on yourdomain.com does nothing for news.yourdomain.com, which is why the subdomain gets its own v=spf1 record in the DNS section above, and so does any bounce host that sends. DMARC is the opposite. It does inherit, through the root record's sp= tag, unless the subdomain publishes its own _dmarc record.
Second, keep the stream consistent. If newsletters go out from news. one month and from the root the next, neither identity builds a clean history, and Postmaster Tools splits your data across both.
Limits of subdomain isolation
- Organizational bleed-through. Sustained spam from
promo.yourdomain.comwill eventually hurtyourdomain.com. Isolation buys you containment and time, not impunity. - Recipient-visible. The subdomain appears in the From address.
news.brand.comis fine;xj7.brand.cominvites suspicion. - Shared IP still couples you. If root and subdomain mail leave from the same IP, an IP-level listing hits both. Pair domain separation with IP separation, see dedicated IP vs shared IP for when each stream deserves its own address.
How BulkEmailSetup helps
We architect the full stream separation, subdomains, DNS, dedicated IPs per stream, and warm-up, so one bad campaign can never take your business email down with it. See our pricing for managed sending infrastructure.
Frequently asked questions
Should I send marketing email from a subdomain or my root domain?
Use a subdomain (e.g. news.yourdomain.com) for marketing and bulk mail, and keep the root domain for person-to-person and critical transactional mail. Subdomains carry largely separate reputation, so a bad campaign doesn't junk your invoices.
Does a subdomain really have separate email reputation?
Mostly. Gmail, Microsoft, and Yahoo track reputation per subdomain, so isolation works day to day. But severe abuse on a subdomain can still drag down the organizational domain, so it is isolation, not immunity.
What should I name my sending subdomain?
Something honest and boring: mail., news., send., m., or notify. Avoid spammy-looking strings and excessive nesting, one level deep is the norm.
Do subdomains need their own SPF, DKIM, and DMARC?
SPF and DKIM yes, each sending subdomain publishes its own records. DMARC is inherited from the root domain policy unless you publish a separate _dmarc record on the subdomain, which you should for bulk streams.
Does sending from a subdomain hurt open rates?
No measurable effect. Recipients see your display name and the domain after the @, and a recognizable subdomain like news.brand.com reads as legitimate. Deliverability gains usually improve opens.
