Best practices for using unique or shared email subdomains across multiple sending tools?

Key findings

1. Technical feasibility: It is technically possible for multiple tools to send from the same subdomain, provided that authentication records (like SPF and DKIM) are correctly configured to include all sending IPs. However, receiving mail to a subdomain from multiple tools is not feasible.
2. Reputation isolation: Using unique subdomains for each tool or mailstream helps isolate sender reputation. If one tool experiences deliverability issues (e.g., due to spam complaints or a blocklisting), it won't negatively impact the reputation of other mailstreams or the root domain. This is a key reason for separating subdomains, especially for high-risk sending like cold email.
3. SPF lookup limits: Hitting the 10-lookup limit for SPF records on a root domain is a common reason to switch to subdomains, as each subdomain can have its own SPF record, effectively bypassing this constraint. Learn more about SPF record best practices.
4. Management complexity: Consolidating authentication records (SPF, DKIM, DMARC) for multiple tools on a single subdomain can lead to complex DNS configurations and potential collisions in DKIM selectors. Separating by subdomain simplifies maintenance and troubleshooting.
5. CNAME authentication: Many sending platforms offer CNAME-based authentication, which can simplify DNS setup by offloading some authentication complexities to the provider, reducing the number of TXT records needed on the root domain.

Key considerations

1. Subdomain strategy: While a unique subdomain per tool is often recommended for clarity and reputation management, a strategy of separating subdomains by mailstream (e.g., transactional, marketing, cold outreach) might also be effective, even if a single mailstream uses multiple tools.
2. DNS record limits: Confirm with your security or IT team what specific DNS limits are being encountered. Often, it's the SPF lookup limit, which subdomains help address.
3. Reputation implications: Understand how sharing a subdomain, especially for high-volume or potentially risky sending, can dilute good sender reputation or expose all mailstreams to blocklisting. This is why email deliverability experts recommend using subdomains.
4. Authentication types: Evaluate whether your sending tools support CNAME authentication, as this can simplify DNS management compared to solely relying on TXT records on the root domain. For a deeper dive, consider when to implement subdomains.

Key opinions

1. Preference for separation: Many marketers advocate for a unique subdomain per email tool or per distinct mailstream (e.g., transactional, marketing, cold outreach) to maintain clearer control and prevent reputation contamination.
2. Risk of shared reputation: A significant concern is that if one sending tool or campaign on a shared subdomain performs poorly and accumulates spam complaints or blocklist entries, it can negatively affect the deliverability of all other emails sent from that same subdomain. This is a strong argument for not using the same subdomain for multiple platforms.
3. Simplified maintenance: Keeping subdomains separate streamlines DNS record management, especially for SPF and DKIM, and makes it easier to troubleshoot deliverability issues specific to a tool or email type.
4. CNAME benefits: Marketers find CNAME authentication preferable as it often offloads DNS complexity to the email service provider, simplifying setup and potentially reducing the number of TXT records needed on the main domain.

Key considerations

1. Mailstream vs. tool separation: While separating by tool is common, consider if separating by mailstream (e.g., marketing versus transactional emails) makes more sense for your organization's specific needs, as outlined by email experts at Iterable.
2. Evaluating DNS limits: If a security team cites DNS record limits, it's often related to SPF lookup limits. Subdomains are an effective solution to this, allowing each subdomain its own SPF record.
3. Authentication types: Understand the difference between email authentication (SPF, DKIM, DMARC) and domain ownership authentication, and which type of record your tools require. For more details on this, see using same or different subdomains.
4. Long-term scalability: As your company grows and adopts more sending tools, a clear subdomain strategy will prevent future deliverability headaches and allow for easier onboarding of new platforms.

Key opinions

1. Necessity of subdomains: Subdomains are considered best practice for email sending, particularly to circumvent SPF lookup limits and to better manage deliverability across diverse email streams. This directly addresses the query about how many subdomains to create.
2. Impact of reputation: Sending different types of email (e.g., cold outreach, transactional, marketing) from separate subdomains is crucial because poor performance in one stream can damage the reputation of others on a shared domain. Despite this, a severe blacklist on a subdomain can sometimes impact the main domain, emphasizing the need for robust sending practices overall.
3. Technical vs. ownership authentication: Experts differentiate between email authentication (SPF, DKIM, DMARC) and domain ownership authentication, noting that a security team's concern about 'too many records' might relate to either, often specifically the SPF lookup limit.
4. CNAME as a solution: CNAME authentication is often preferred as it simplifies DNS management for senders by delegating authentication responsibilities to the email service provider, reducing the direct burden on the root domain's DNS records.

Key considerations

1. MX record limitations: A key technical limitation for sharing a subdomain for both sending and receiving is that an MX record can only point to one destination, such as a single ESP. This makes shared receiving functionally impractical across multiple vendors.
2. Strategic splitting: Consider splitting subdomains based on mailstream risk. For instance, cold emails (which carry higher reputation risk) should typically be sent from a separate subdomain. See sending transactional and marketing emails from separate domains.
3. SPF DNS lookup limit: Ensure you understand if hitting the SPF 10-lookup limit is the root cause of your security team's concerns, as subdomains are the direct solution to this issue.
4. Industry best practices: Adhere to industry best practices, such as those published by organizations like the M3AAWG. Their document on sending domains provides valuable guidance.

Key findings

1. Authentication standards: Implementing SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) is essential for email subdomains to improve security and deliverability, as they verify the sender's legitimacy.
2. Reputation management: Subdomains are crucial for protecting the root domain's reputation by providing a shielded separation for different email activities, preventing issues from one stream affecting another.
3. DNS structure: Subdomains are extensions of the primary domain, allowing for organized management of email communication and associated DNS records without overloading the root domain.
4. Dedicated sending domains: Setting up a branded or dedicated sending domain typically involves choosing an associated subdomain, which helps segment email traffic and build specific reputations.

Key considerations

1. SPF record limits: While RFCs permit a certain number of DNS lookups for SPF, exceeding this can lead to validation failures, making subdomains a practical solution to manage multiple authorized senders. Understand SPF DNS timeouts.
2. DKIM configuration: Proper DKIM setup involves unique selectors for different sending entities, which can be easier to manage on distinct subdomains, ensuring messages are correctly signed. A simple guide to DMARC, SPF, and DKIM can help.
3. DMARC policy: A DMARC record on your root domain can protect all subdomains. Subdomains should align with the DMARC policy for proper authentication enforcement. The M3AAWG Best Practices for Sending Domains is an excellent resource.
4. Strategic use: Documentation often advises using separate subdomains for distinct purposes, such as marketing vs. transactional emails, to better manage deliverability and reputation, as FluentSMTP guides explain.