Do all subdomains need their own TXT record for Google Postmaster Tools?

No, not always. Google Postmaster Tools states that once a main domain is verified, its subdomains can roll up into the root domain's data without separate verification. However, if you wish to see independent data for a specific subdomain, you will need to add and verify it separately using a TXT record.

My main domain is verified, but Postmaster Tools is still asking for a TXT record for my subdomain. Why?

This usually means you are trying to add the subdomain as a separate entity in Google Postmaster Tools to get its own, specific set of data. It also could be due to DNS propagation delays or an ownership mismatch if the Google account you are using isn't recognized as the verifier of the root domain.

Does verifying my main domain in Postmaster Tools also cover SPF for my subdomains?

No, SPF records are specific to the domain or subdomain from which emails are sent. A subdomain needs its own SPF record if it is used for sending email, as its scope is limited to verifying authorized sending servers for that particular domain name or subdomain.

What if my TXT record verification keeps failing for a subdomain?

You can try adding a CNAME record for verification, as this is an alternative method Google supports. Also, confirm that the Google account attempting the verification has the necessary permissions. Finally, wait for DNS propagation to ensure the record is visible globally.

Does Google Postmaster Tools track reputation for subdomains differently?

Yes, GPT provides data at both the root domain and individual subdomain levels, especially if subdomains are separately verified. Domain reputation is influenced by all sending entities, including subdomains.

Why does Google Postmaster require a TXT record for a subdomain when the main domain is already verified? - Technical - Email deliverability - Knowledge base

It can be confusing when Google Postmaster Tools asks for a TXT record for a subdomain, especially if you've already verified your main domain. We often assume that once the root domain is verified, its subdomains automatically inherit that status, particularly when Google's own documentation suggests this.

However, the nuance lies in how Google Postmaster Tools handles data aggregation versus independent data tracking for specific sending entities. Let's explore why this happens and what it means for your email deliverability efforts.

Understanding Google Postmaster Tools verification

Google Postmaster Tools requires domain verification to ensure you are the legitimate owner of the domain you're trying to monitor. This prevents unauthorized access to sensitive sending data, which could be exploited for malicious purposes like phishing or spam campaigns. The primary method for this verification is adding a specific TXT record to your domain's DNS settings.

When you verify your main domain (e.g., example.com), Google Postmaster Tools (GPT) generally provides a consolidated view of your email sending data across the root domain and its subdomains. This means if you have subdomains sending mail, their data often rolls up into the main domain's reports. This aggregated view is useful for a general overview of your sending reputation.

Importance of explicit verification

Google’s system is designed to provide both broad and granular insights. While a root domain verification offers a high-level view, explicitly verifying a subdomain provides a deeper, independent look at its specific performance. This is crucial for segments of your email program that might have different sending behaviors or need separate monitoring.

Security: Each subdomain acts as a distinct sending entity, and verifying it helps confirm ownership for that specific sending stream, reducing the risk of unauthorized use or spoofing.
Data segregation: If you want to see detailed data for a specific subdomain, such as marketing.example.com, you need to add it independently and verify it. This allows GPT to track its metrics separately from the aggregate.
Policy enforcement: Some email authentication standards, like DMARC and SPF, are applied at the domain or subdomain level. Explicit verification ensures granular insights into these policies.

The nuance of subdomain verification in GPT

The key phrase from Google's documentation that often causes confusion is: "Once you add and verify ownership of a domain name, you can add sub-domains of that domain and view data without having to verify each of them. To view separate data for only your sub-domains, independently add your sub-domains." This means if you just want the aggregated data from sub.example.com to roll up into example.com, you don't need to verify the subdomain. However, if you want sub.example.com to appear as a distinct entry in GPT with its own, separate dashboards, you must perform an independent verification.

This independent verification for separate data viewing is often why you're prompted for a TXT record. It's not that Google requires it for *all* subdomains, but rather for those you wish to track individually within the Postmaster Tools interface.

Root domain verification

Scope: Covers the main domain and generally aggregates data from its subdomains for a collective view.
Data view: Provides an overall picture of your domain's email health, including traffic and reputation scores influenced by all sending subdomains.
Purpose: Useful for a general understanding of your brand's email sending reputation.

Subdomain specific verification

Scope: Focuses on a single subdomain (e.g., mail.example.com) and its unique sending profile.
Data view: Provides granular data specific to that subdomain, allowing you to identify issues or trends unique to that sending stream.
Purpose: Essential for managing multiple sending platforms or email types that use different subdomains.

It's worth noting that GPT aggregates data for domains and their subdomains by default. However, if you want to see data specific to a subdomain, you need to add it separately. This is why you get the prompt for an additional TXT record, as it serves as proof of ownership for that specific subdomain entry within the tool, distinct from the root domain's overarching verification.

Why specific subdomain verification is required

If you're facing this issue, here are a few potential reasons why Postmaster Tools is asking for a new TXT record for a subdomain:

Independent data view desired: As discussed, you are likely trying to add the subdomain as a separate entity to get its own metrics, requiring a new verification.
Ownership mismatch: The specific Google account you are using might not have been the one that initially verified the root domain. Google Postmaster Tools ties verification to the user account that performs it, or to an account with sufficient ownership permissions. If a different account initially verified the root domain, you may need to re-verify the domain or ensure proper access.
DNS propagation issues: Sometimes, even if the record is correct, DNS changes can take time to propagate across the internet. This can lead to temporary verification failures. Use a DNS lookup tool to confirm the TXT record has propagated correctly.

If you are encountering issues, ensure that the TXT record is correctly added to your subdomain's DNS. The process is similar to adding an SPF record for a subdomain, where the TXT record points to the specific subdomain, not the root domain.

Example TXT record for subdomain verificationDNS

Host/Name: subdomain.yourdomain.com
Record type: TXT
Value: google-site-verification=XXXXXXXXXXXXXXXXX

Additionally, check the Postmaster Tools interface itself. Sometimes, a previously verified subdomain might become unverified due to changes in DNS records or if the verifying account loses access.

Best practices for multi-domain management

Managing multiple domains and subdomains in Google Postmaster Tools requires a strategic approach to ensure you're getting the most out of the data without unnecessary complications. While the tool is powerful, understanding its nuances is key.

For instances where you want comprehensive data on specific sending entities, such as transactional emails from transactional.example.com versus marketing emails from marketing.example.com, independent verification is highly recommended. This allows you to pinpoint deliverability issues to specific sending streams rather than having to extrapolate from aggregated data.

Also, consider the user roles within your Google account. As one user in the Email Geeks Slack community pointed out, if the person attempting to add the subdomain isn't the same user who verified the main domain, or doesn't have the appropriate permissions, Google Postmaster Tools might prompt for re-verification to confirm ownership. Ensure that the account used has the necessary administrative privileges.

Finally, while TXT records are common, Google also supports CNAME verification. Sometimes, if you're experiencing persistent issues with TXT records, using the CNAME verification method might resolve the problem. This can be a cleaner option, especially if your DNS has a lot of existing TXT records, making it 'crowded' or 'fuzzy' as some experts describe it.

Views from the trenches

Best practices

Always verify your root domain first for aggregated data.

Independently verify subdomains when you need granular, segmented data in Postmaster Tools for specific sending streams.

Ensure the Google account used for verification has full ownership permissions for the domain.

Regularly check your DNS records for correct TXT or CNAME entries, especially after any DNS changes.

Consider using CNAME verification if TXT records cause persistent issues or make your DNS cluttered.

Common pitfalls

Expecting subdomains to automatically provide separate data without individual verification after root domain verification.

Using a Google account without sufficient permissions to verify domains or subdomains in Postmaster Tools.

Mistyping TXT record values or hostnames during DNS configuration, leading to verification failures.

Not accounting for DNS propagation time, which can delay successful verification by minutes or hours.

Overlooking existing TXT records that might conflict with new verification entries.

Expert tips

If you're managing multiple email sending platforms, each potentially using a different subdomain, separate verification helps isolate and troubleshoot deliverability issues more effectively.

Use a structured naming convention for your subdomains (e.g., mail.yourdomain.com for general sending, alerts.yourdomain.com for notifications) to better organize Postmaster Tools data.

Leverage the API access for Google Postmaster Tools if you have a large number of domains/subdomains to manage, as it can automate the process and provide custom reporting.

Periodically review your Postmaster Tools setup to ensure all active sending domains and subdomains are properly monitored and verified.

When encountering issues, double-check that your DNS provider's interface doesn't add extra domain parts to the TXT record, causing a mismatch.

Marketer view

Marketer from Email Geeks says that they were able to add one subdomain without issues, but then encountered a TXT record request for a second subdomain, which seemed to contradict Google's own instructions about subdomains.

2022-11-18 - Email Geeks

Expert view

Expert from Email Geeks says that each domain is essentially treated as a separate entity in certain contexts, which explains why independent verification might be needed even if the main domain is verified.

2022-11-19 - Email Geeks

Summary

The requirement for a TXT record for a subdomain in Google Postmaster Tools, even when the main domain is already verified, stems from the desire for granular, independent data tracking. While Google provides a consolidated view for a verified root domain, if you want separate insights into a specific subdomain's performance, you must verify it individually.

This setup allows for a more detailed analysis of your email campaigns, helping you diagnose and address deliverability issues more precisely. Always ensure correct DNS configuration and proper account permissions when setting up your domains and subdomains in Google Postmaster Tools.