Summary
When SPF and DKIM are configured on a subdomain, but emails are delivered through a main domain, it generally does not cause an issue, provided the authentication records are correctly aligned. The key is to ensure that the domains authenticated by SPF (return-path) and DKIM (d=tag) are consistent with the organizational domain in the From header. This alignment is crucial for DMARC validation and overall email deliverability. Misconfigurations, however, can lead to authentication failures and potential delivery problems. For more information on setting up authentication, you can review a simple guide to DMARC, SPF, and DKIM.
Key findings
- Authentication points: SPF authenticates the Return-Path domain, while DKIM authenticates the domain specified in its d= tag.
- From header domain: Neither SPF nor DKIM directly authenticate the From header domain itself.
- Alignment importance: For DMARC to pass, the SPF-authenticated domain and the DKIM-signed domain must align with the organizational domain of the From header. This is the ideal setup.
- Subdomain reputation: Using a subdomain for sending can help protect the reputation of your main domain, as reputation issues are often contained.
- SPF policy inheritance: Subdomains should not inherit the SPF policy of the main domain, as this can negatively impact authorized email sources not linked with the subdomain.
Key considerations
- DMARC policy: Ensure your DMARC record includes a subdomain policy (sp tag) to specify how to handle emails from subdomains.
- Explicit SPF: If using a subdomain for sending, it needs its own SPF record that explicitly authorizes the sending server.
- DKIM setup: DKIM should be set up on the subdomain with the d=tag matching the organizational domain of the From header, even if it's the main domain.
- Monitoring: Regularly monitor DMARC reports to ensure SPF and DKIM are passing authentication and alignment checks for both your main domain and subdomains.
What email marketers say
Email marketers often encounter situations where subdomains are used for sending, while the displayed From address is from the main domain. The primary concern is usually around whether this setup affects deliverability or causes authentication issues. Marketers commonly confirm that as long as SPF and DKIM records are correctly configured on the subdomain and align with the organizational domain of the From header, this approach is not problematic and can even offer benefits for sender reputation management. This strategy allows for segregation of email types, helping to protect the main domain's reputation if issues arise with subdomain sending.
Key opinions
- Header confusion: Marketers can find it confusing when the email is received from the main domain but the header shows subdomain authentication.
- Subdomain protection: Sending emails from a subdomain specifically for that purpose can help protect the reputation of the main domain from potential spam issues.
- Reputation inheritance: Subdomains, especially new ones, will inherit some of the reputation of the parent domain, meaning a bad reputation on the main domain can affect subdomains.
- Server mismatch: A server mismatch between the subdomain's authentication and the main domain's From address isn't an issue as long as SPF explicitly authorizes the sending service for the subdomain.
- No inherited SPF: Subdomains do not automatically inherit the main domain's SPF record; they require their own.
Key considerations
- Header visibility: Marketers should review email headers to understand which domain is actually being authenticated for SPF and DKIM, particularly the Return-Path.
- DMARC alignment for subdomains: Ensure your DMARC record's sp tag is correctly configured to manage subdomain email policies.
- Dedicated subdomains: Consider setting up dedicated subdomains for different types of email (e.g., marketing vs. transactional) to isolate reputation.
- Consistent configuration: Maintain clear and consistent SPF and DKIM configurations for all sending subdomains to avoid confusion and ensure proper authentication.
Marketer view
Email marketer from Email Geeks mentioned they were encountering a scenario where their client had SPF and DKIM records set up on a subdomain, specifically mg.theircompany.com, but the actual emails were being delivered through the main domain, theircompany.com. This setup raised questions about potential issues arising from the discrepancy between the authentication domain and the delivering domain.The marketer further clarified that emails were observed as coming from the main domain, but upon inspecting the headers, the authentication (SPF and DKIM) appeared to be tied to the subdomain. This discrepancy was causing some confusion, as it wasn't immediately clear how this would impact deliverability or DMARC alignment.
Marketer view
An email marketer from Super User questioned the alignment of DKIM and SPF for subdomains in relation to DMARC. Their understanding was that DMARC's primary security objective is to ensure that the domain visible in the From address is consistent with the domain actually sending the email.They were seeking clarification on how subdomains fit into this alignment model and if separate authentication records are needed to satisfy DMARC when using subdomains for email delivery, especially when the visible From address is a top-level domain.
What the experts say
Email experts agree that having SPF and DKIM on a subdomain while delivering emails from a main domain is not inherently problematic. The crucial factor is proper DMARC alignment. As long as the SPF-authenticated domain (Return-Path) and the DKIM-signed domain (d=tag) are within the same organizational domain as the From header, DMARC will pass. Experts often emphasize that the authentication domains do not always need to be identical to the From header domain; alignment at the organizational level is sufficient. This setup is considered an ideal configuration for robust email authentication.
Key opinions
- Return-path authentication: SPF primarily authenticates the Return-Path (envelope-from) domain, which is often a subdomain set by the email service provider.
- DKIM d= tag: The DKIM d=tag specifies the signing domain, which should ideally align with the organizational domain of the From header.
- From header vs. authentication: It's common and acceptable for the domains authenticated by SPF and DKIM to differ from the visible From header, as long as DMARC alignment is achieved.
- Ideal alignment: The ideal scenario is when the SPF-authenticated domain and the DKIM-signed domain are within the same organizational domain as the From header, ensuring DMARC passes.
- No issues: This setup, when correctly configured for DMARC alignment, is not only acceptable but often considered the best practice for robust email authentication.
Key considerations
- DMARC policy for subdomains: Experts recommend configuring a DMARC record that specifically addresses subdomain policy using the sp tag, even if the subdomain doesn't actively send emails.
- Authentication check: Always inspect email headers to verify that SPF and DKIM are authenticating the expected domains and that DMARC is passing alignment.
- Dedicated sending subdomains: Utilizing specific subdomains for email sending can help isolate reputation issues from the main brand.
- Multiple SPF records: Avoid creating multiple SPF records on a single domain, as this can cause rejections; merge them into one if necessary.
Expert view
Email expert from Email Geeks clarified the authentication process, stating that SPF authentication is tied to the Return-Path domain. They observed that in the provided headers, the message-id was based on the mg. subdomain, strongly indicating that the Return-Path (also known as the envelope-from) was also from this subdomain.This means SPF would correctly authenticate against the subdomain, which is the expected behavior for such a setup, rather than authenticating directly against the main domain's From header.
Expert view
An email expert from Email Geeks further explained that neither SPF nor DKIM are designed to authenticate the From header directly. They noted that it is a common and acceptable practice for the domains that SPF and DKIM authenticate to be different from the domain displayed in the From header.The expert confirmed that upon inspecting the envelope information, the Return-Path was indeed the mg. hostname, which means SPF would correctly authenticate that specific subdomain, aligning with the observed headers.
What the documentation says
Official documentation and technical guides provide clear frameworks for SPF and DKIM implementation, particularly concerning subdomains and their interaction with main domains. These resources emphasize that SPF and DKIM operate on specific domains within the email's headers or envelope, not necessarily the visible From address. For DMARC compliance, the key is alignment: the authenticated domains must belong to the same organizational domain as the From header. This structure allows for flexibility in email architecture while ensuring robust authentication and prevent spoofing. It is often recommended to configure distinct SPF records for subdomains if they are used for sending, rather than relying on inheritance from the main domain.
Key findings
- Separate SPF records: Subdomains do not inherit the SPF record of the main domain; each subdomain used for sending requires its own SPF record.
- DMARC goal: The primary goal of DMARC is to ensure that the domain in the From address aligns with the domain authenticated by SPF or DKIM.
- One SPF record: The SPF specification requires that a domain have only one SPF record. Multiple SPF records can cause validation issues and email rejections.
- Subdomain policy (sp): The DMARC sp tag allows domain owners to define specific DMARC policies for their subdomains.
- Flexibility in DMARC: DMARC alignment allows for SPF or DKIM authentication on a subdomain to pass, as long as the subdomain is part of the same organizational domain as the From header.
Key considerations
- Explicit authorization: Any external service sending emails on behalf of a subdomain must be explicitly authorized in that subdomain's SPF record.
- DMARC policy strength: Bulk senders should implement DMARC with a minimum policy of p=noneto monitor alignment before enforcing stricter policies.
- Domain reputation separation: While subdomains inherit some reputation, using them specifically for sending can help contain reputation issues from affecting the main domain.
- Configuration for all domains: It is important to ensure proper SPF and DKIM configurations for all subdomains, even those not directly used for email, especially if a DMARC record is applied to the organizational domain.
Technical article
Documentation from AutoSPF indicates that allowing subdomains to inherit the SPF policy of their main (parent) domain can have adverse effects. This setup might negatively impact the deliverability of emails from legitimate sources that are authorized to send on behalf of the subdomain but are not explicitly linked with the main domain's SPF record.Therefore, it is generally advised to configure specific SPF records for subdomains that send emails, ensuring that only authorized senders for that particular subdomain are included, preventing broader policy conflicts and authentication failures.
Technical article
Documentation from Super User describes the security objective of DMARC. It states that DMARC aims to ensure that the domain visible in the email's From address accurately reflects the same domain that is authorized to send the email through either SPF or DKIM authentication.This alignment helps to prevent email spoofing and phishing attacks by verifying that the apparent sender is indeed legitimate. When using subdomains for authentication, this means the subdomain must align with the organizational domain of the From header.
Related resources
14 resources
Related pages
Does a subdomain used for sending emails need its own SPF record?
Can DKIM be set up on a subdomain, and which domain should be used for signing?
Will using a subdomain for different email types affect my primary domain's reputation?
How to configure SPF, DKIM, and DMARC when sending marketing emails from a subdomain but signing with the primary domain?
A simple guide to DMARC, SPF, and DKIM
Will DMARC pass with aspf=s if SPF record is on a subdomain?
How can I resolve DMARC verification failures when using a subdomain for email sending?
Should I use subdomains for outbound email delivery to improve deliverability?
List of DMARC tags and their meanings
What is the full form of SPF in email?
