Should you use an email subdomain for marketing?

Why senders put marketing email on a subdomain#

A marketing subdomain is a name under your own domain, such as news.example.com, that only campaigns are sent from. The case it is for: a sale-day campaign draws spam reports, the next morning password resets start arriving late or in spam, and your dashboards cannot say which mail caused it. Mailbox providers ask for mail to be split by kind. M3AAWG, an industry anti-abuse working group, says receivers “request (and may require) that different types of email traffic be separated”, and “it is strongly recommended that senders assign a separate subdomain of the main domain name for each distinct sending purpose.”^[1] This guide calls example.com the parent (standards call it the organizational domain).

How much volume makes a subdomain worth it?#

No mailbox provider publishes a cut-off. M3AAWG says distinct subdomains are best practice for bulk sending, that “for smaller volumes of email, it is acceptable to use different local parts of the sender address” (the part before the @), and that each segment needs “sufficient and relatively consistent traffic volume” to build a reputation at all.^[1] The line in this table is ours. A separate address such as news@example.com separates nothing in domain reputation; it only helps readers and their filters tell campaigns apart.

The 1,000 marks where the separate view starts to pay off. It is not the volume at which a subdomain’s reputation stands on its own; nobody publishes that. Google’s Postmaster Tools API guide says “Only domains that send mail to at least 50 users per day receive statistics.”^[14] Sent weekly, 1,000 a month is about 230 per send, so each send day reaches that floor once about 22% of your list uses Gmail. Check your own share: on a list that is half Gmail, about 450 a month sent weekly is enough. Below the floor, the subdomain’s dashboards stay mostly empty.

Two worked cases. A store with 6,000 subscribers that mails every week sends about 26,000 campaign emails a month: give campaigns a subdomain. A consultant who mails 400 clients once a month: use news@example.com, make sure replies to it reach someone, and stop reading here. If you are close to the line and growing, start the subdomain now, because moving later means warming up a new name with a bigger list.

Where receipts and password resets go#

At small scale they can stay on the main domain. Once campaigns move to news.example.com, a common layout gives app mail its own name too, such as mail.example.com, and leaves example.com to people’s own mailboxes; M3AAWG’s example uses info.mybrand.com for transactional mail.^[1] Moving receipts to a new name is a new sending name too, so warm it up the same way. We sort store automations by what they do: abandoned-cart, welcome and back-in-stock emails promote, so they go with campaigns; order confirmations and shipping notices go with receipts. Transactional vs marketing email draws the line in detail.

What a subdomain separates, and what it still shares#

Reputation is the record a mailbox provider keeps about a domain or IP address; Google describes it as “determined by the sending behavior of a domain or IP address”.^[5] Nobody publishes how much of it crosses between a subdomain and its parent: no percentage, no rule. Here is what is documented.

What is separate#

• Gmail’s data about it. Postmaster Tools, Gmail’s free dashboard for senders, shows a subdomain’s dashboards “independently from the primary domain” once you add it.^[4] That gives the subdomain its own spam rate, authentication and delivery-error figures. Google is replacing its old reputation charts,^[15] so those figures are what you watch; the Postmaster Tools guide covers them.
• Its SPF record. SPF, the DNS list of servers allowed to send for a domain, is checked against the return path (the hidden bounce address),^[7] so a return path under the subdomain gets an SPF record of its own and leaves the main domain’s record alone.
• Its DKIM key, for revoking. DKIM signs each message with a key published in DNS; one domain can publish several keys under different names, called selectors.^[8] That lets you revoke one tool’s key without touching the others. It does not stop a leaked key passing DMARC as the parent; see alignment.

What is still shared#

• Gmail’s bulk-sender count. Mail from the subdomain counts toward the parent’s total.^[6] What that total triggers is in Gmail and Yahoo sender requirements.
• Gmail’s compliance status. Postmaster Tools “uses data from subdomains to determine compliance, but provides status for primary domains only.”^[5]
• The parent’s DMARC policy, unless the subdomain publishes its own.^[9]
• IP reputation, if the IP addresses are the same. Google says the activity of every sender on a shared IP address “affects the reputation of all senders for that shared IP address”.^[3] A subdomain changes the domain, not the address the mail leaves from.
• The parent’s name in your links, if they use it. A tracked link or image hosted on example.com puts the parent’s name in every campaign. On Rasket, tracked links use a hostname under the domain you send from, links.news.example.com by default, once its record is published.^[24]
• Some of the parent’s history. Does a good record carry over? Partly, in M3AAWG’s view: proper use of subdomains helps a programme “benefit from the organizational domain’s existing reputation”,^[1] yet “when sending from a new subdomain, to be safe, domain warming is recommended even if the organizational level domain already has an established reputation.”^[2] Google’s sender guidelines and Postmaster Tools help do not say how much carries over.

At Microsoft and Yahoo#

Yahoo scores the name that signs the mail: “Each IP and DKIM domain has a reputation”.^[13] Its complaint feedback loop is keyed the same way: “your DKIM domain(s) (d= part of the DKIM signature) must be enrolled”, so campaigns signed as news.example.com report their complaints separately once that name is enrolled.^[22] How Yahoo weighs a subdomain against the parent, it does not say. Microsoft’s requirements post for high-volume senders to Outlook.com says nothing about subdomains,^[20] and its sender dashboard, SNDS, gives “detailed data about individual IPs”, so on shared IP addresses a subdomain gets no separate view there.^[21] How each of the three counts a bulk sender is in who counts as a bulk sender.

Set up a marketing subdomain, step by step#

1. 1

   Pick a descriptive subdomain of your real domain

   Choose a name such as news.example.com or offers.example.com that says what the mail is, under the domain your readers already know. Check that no other service already uses that exact name.

2. 2

   Give the name a web page and somewhere for replies

   Point the name at a real page with an A record or a redirect, not a CNAME, since a CNAME at the name rules out an MX there. Decide where replies and abuse reports to its addresses go, and publish an MX record for them if they should arrive on the subdomain.

3. 3

   Add it as a sending domain and publish its records

   Give the subdomain a DKIM key under a selector of its own and a return path under the subdomain, so SPF and DKIM both pass for it and align with a From address on it.

4. 4

   Let the parent's DMARC record cover it

   Publish nothing at _dmarc on the subdomain; the parent's record covers it, with sp= there if subdomains need a different policy.

5. 5

   Add it to Postmaster Tools

   Add the subdomain in Google Postmaster Tools after the parent domain. If the parent is already verified, the subdomain needs no verification of its own, and its dashboards show its data separately.

6. 6

   Move campaigns across on a warm-up schedule

   Do not switch the whole list in one send. Grow the subdomain's share over several weeks while its bounces, unsubscribes and complaints stay level with the old address's, then move the rest.

7. 7

   Keep every other stream off it

   Send receipts, password resets and people's own mail from other names, and only marketing from the subdomain, so its figures reflect one kind of mail.

If you already mail the list from the main domain, Google says that after a significant change to your sending setup you should “increase the modified segment of traffic separately”.^[3] For the 6,000-subscriber store above, using the step sizes from the warm-up guide’s schedule for a few thousand contacts (our example, one weekly issue per step):

• Week 1: the 400 most engaged subscribers get the issue from news.example.com; the other 5,600 get it from the old address as before.
• Weeks 2 to 6: the subdomain’s share grows by about half each week, through 600, 900, 1,400, 2,000 and 3,000, while its bounces, unsubscribes and complaints stay level with the old address’s. If they rise, repeat the week; if they keep rising, send from the old address again while you find the cause.
• Weeks 7 and 8: 4,000, then all 6,000. Campaigns stop going from the old address; if the old tool no longer sends anything, remove its SPF include and DKIM key from example.com, or it can still send as the parent.

Tell subscribers in the first split issue. Mail filters and contact entries that match the old From address will not match the new one, so say which address the newsletter now comes from, and keep the display name, such as “Example News”, the same.

In the first weeks Gmail’s figures for the subdomain are thin or missing on many days, and Google’s 0.1% spam-rate target^[3] is less than one complaint per send. So judge the early weeks on what you can see: bounces, unsubscribes, complaints from Yahoo’s feedback loop once the subdomain is enrolled at Yahoo’s Sender Hub, and the pass rate for news.example.com in your DMARC aggregate reports. Gmail’s spam rate becomes the check once Postmaster Tools shows data; the spam complaint rate guide says how to read it. The rest of this page is for whoever manages your DNS or code.

For DNS admins and developers: the records on Rasket#

On Rasket, a domain such as news.example.com needs one DKIM TXT record at rasket._domainkey carrying a 2048-bit key, and one CNAME at the return-path label, rasket by default.^[16] Domains set up with Rasket’s older record form carry an MX and an SPF TXT at that label instead; the form is fixed when the domain is added, and the domain page shows which one yours uses, with the values to copy:

; DKIM: one TXT record carrying a 2048-bit key; mail is signed d=news.example.com
rasket._domainkey.news.example.com.   TXT    (copy the value from the domain page)
; Return path: bounces come back here, and SPF passes for this name
rasket.news.example.com.              CNAME  (copy the target from the domain page)
; Optional, for tracked links: without it, links use Rasket's own tracking host
links.news.example.com.                CNAME  (copy the target from the domain page)
; No DMARC record here: the one at _dmarc.example.com covers the subdomain

• No SPF record at news.example.com itself. SPF is checked on the return path.^[7]
• The DKIM key is two strings. A 2048-bit key is longer than one DNS text string can hold, so it is published as two, and receivers must join TXT strings “with no intervening whitespace”.^[8] Most DNS panels split a pasted value for you; paste it exactly as the domain page shows it.
• The receiving MX goes on the name you add. If you turn on receiving, Rasket puts its MX at the domain you add, unless you choose a subdomain for it. On example.com it would route mail for every address there away from your existing mailboxes, one reason the docs recommend sending from a subdomain.^[16]

A sending key pinned to one domain#

A sending_access key created with a domain_id refuses any request whose from is on another domain with a 403 validation_error; the token field of the response is returned once.^[17] Pin your app’s key to mail.example.com and a leaked app key cannot send as your newsletter. Creating keys needs a full_access key:

curl -X POST "https://api.rasket.com/api-keys" \
  -H "Authorization: Bearer $RASKET_API_KEY" \
  -H "User-Agent: example-app/1.0" \
  -H "Content-Type: application/json" \
  -d '{"name": "app mail", "permission": "sending_access", "domain_id": "d91a7b60-1a5f-4a2e-9d1b-0d9f2c7a1e34"}'

Shared IP addresses#

On Rasket, campaigns go through the same pipeline as the rest of your mail and are measured apart from your transactional mail.^[18] They leave from the same IP addresses, so the subdomain is what separates their domain reputations. A dedicated IP, an add-on from the Scale plan,^[19] does not split them either: it carries all of a project’s mail in its region, campaigns and receipts together.

Mailbox providers disagree on whether that matters. Google says “Ideally, send all messages from the same IP address”, and that a sender who must use several should use a different one for each message type.^[3] Yahoo’s heading asks senders to “Segregate Email types by IP or DKIM domain”, and its detail goes further: “Don’t send bulk/marketing email from the same IPs you use to send user mail, transactional mail, alerts, etc.”^[13] A subdomain that signs as itself meets the heading. If you want campaigns and receipts on different IP addresses as well, Rasket is not the right tool.

For DNS admins: alignment, and the leaked-key risk#

The check that matters: campaigns must be signed as the subdomain itself. DMARC passes when SPF or DKIM passes for a domain that aligns with the From domain, and the domain owner’s published policy says what receivers should do with mail that fails. In relaxed mode, the default, two names align when they have the same organizational domain (the parent, here); in strict mode (set with adkim=s or aspf=s) they must be identical.^[9]

In the first row, strict SPF fails because rasket.news.example.com is not identical to news.example.com; DKIM alone is enough. The second row is the catch: campaigns signed as example.com pass DMARC, but the signature belongs to the parent, so the subdomain separates nothing. M3AAWG’s “subdomain consistency” layout signs as the subdomain with the return path under it.^[1] To check a live campaign, open a test message’s headers and read its Authentication-Results field:^[23]

dkim=pass header.d=news.example.com
spf=pass smtp.mailfrom=rasket.news.example.com
dmarc=pass header.from=news.example.com

Relaxed alignment also works the other way. A signature with d=news.example.com aligns with a From of example.com or mail.example.com, so whoever holds the marketing tool’s DKIM key can send mail that passes DMARC as your receipts. Setting adkim=s on the parent’s record closes the gap, at a cost Google spells out: strict alignment “can result in messages from associated subdomains to be rejected or sent to spam”, while relaxed “typically provides sufficient spoofing protection”.^[10] DKIM, SPF and DMARC explained covers the three checks from the start.

For DNS admins: DMARC and BIMI for a subdomain#

A subdomain needs no DMARC record of its own. Without one, receivers use the parent’s record: its sp= tag (the policy for subdomains) if present, otherwise its p=.^[9] That also means a change to the parent’s policy moves every subdomain without a record at once, so plan it as one change. The simplest setup is one record at the parent at p=reject, which covers everything; DMARC p=reject: how to get there covers the move. While the parent is still being cleaned up, two setups are specific to subdomains:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; np=reject; rua=mailto:dmarc-reports@example.com"

_dmarc.news.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

In the first, np= sets the policy for subdomains that do not exist, so mail from an invented name like billing-news.example.com is rejected while real subdomains follow the parent’s quarantine. Writing sp=reject instead would also reject invented names, since np= falls back to sp=, but it would reject failing mail from the real subdomains too; the current DMARC standard, RFC 9989 (May 2026), which replaced RFC 7489, made the tag part of the core standard.^[9] The second becomes a trap if it outlives its reason: a subdomain’s own p=none overrides a parent at p=reject, which leaves your newsletter, the name phishers most want to copy, unprotected. Delete it once the parent reaches enforcement.

BIMI: the parent decides#

BIMI shows your logo beside your name in mail apps that support it. Gmail requires the DMARC policy to be quarantine or reject: “BIMI doesn’t support DMARC policies that have the p option set to none.”^[11] The BIMI Group goes further: DMARC “MUST be at enforcement on the organizational domain and subdomains”.^[12] So a campaign subdomain at p=reject under a parent still at p=none gets no logo. If you want the logo, move the parent to enforcement first.