How to handle email authentication for ESP customers without their own domains?

When handling email authentication for ESP customers without their own domains, the prevailing strategy involves leveraging subdomains. ESPs can create and manage customer-specific subdomains, configuring SPF, DKIM, and DMARC records to ensure authentication. This approach offers the benefit of reputation isolation, preventing one customer's sending behavior from negatively impacting others. While dedicated IPs offer enhanced control over reputation, they require active management. For smaller customers, shared IPs are often used, but it's essential to mitigate risks by setting up authentication on subdomains. Dynamic DNS record synthesis can streamline the management of numerous subdomains. While some ESPs manage DNS zones directly, others are phasing out mutualized domains in favor of delegated domains or internal domain purchases. SenderID is an older alternative to address authentication.

When ESP customers lack their own domains, a common approach is to use subdomains. ESPs can create and manage subdomains (e.g., customer1.youresp.com), configuring SPF, DKIM, and DMARC records on these subdomains to provide authentication. For smaller customers, shared IPs are often used, but this can negatively impact deliverability if other senders on the IP have poor reputations. Setting up appropriate authentication is critical even without dedicated domains. Dynamic DNS record synthesis can automate DNS management. Some ESPs may phase out mutualized domains, opting instead for delegated domains or internal domain purchases, while others provide manual configuration options and prioritize individual DKIM setup for customers.

The best approach for handling email authentication for ESP customers without their own domains involves using customer-specific subdomains of an ESP-owned domain. This facilitates setting up DKIM, SPF, and DMARC, providing clean authentication and isolating reputation. While generating separate DNS zone files for each customer is an option, it's maintenance-intensive and potentially costly. A more efficient solution is to have the DNS server dynamically synthesize records upon request, integrating authentication maintenance into an existing CNAME-based framework. Customer subdomain authentication processes often involve generating synthetic DNS records, linking authentication maintenance to CNAMEs, and can be implemented with tools like PowerDNS.

When ESP customers lack their own domains, several strategies can be used for email authentication. AWS suggests using Bring Your Own IP (BYOIP) addresses and authenticating them with SPF and DKIM via subdomains. Mailgun highlights the practice of creating subdomains for each customer and configuring authentication records there. SparkPost recommends allocating dedicated IPs for better reputation control and setting up authentication directly on those IPs. Microsoft suggests using SenderID, setting it up to ensure mail servers recognize emails as authentic.