Never send marketing and receipts from the same subdomain

Mailbox providers build reputation around the domain that signs your mail. That single fact has an operational consequence most shops discover the hard way: if your newsletter earns complaints, your order confirmations inherit the damage. Receipts land in spam, customers open support tickets asking where their order went, and the marketing problem becomes a service problem.

The separation that prevents this is not exotic. It is two subdomains.

The split

• mail.shop.com — campaigns, newsletters, automated marketing flows.
• orders.shop.com — order confirmations, shipping notices, password resets, invoices.
• The root domain shop.com sends nothing, and carries the DMARC policy for both.

Both subdomains get their own DKIM keys and their own SPF records. Both should align to the visible From address. Reputation then accrues separately, which means the worst outcome of a bad campaign is a bad campaign.

Why it matters more than it used to

Two reasons. First, enforcement thresholds are now explicit: Google's bulk sender guidelines set a 0.3 % spam complaint limit and recommend staying below 0.1 %, and a single poorly targeted send to a dormant list can cross it. Second, transactional mail is the mail you cannot afford to lose — it is the mail customers are waiting for, and its failure generates work rather than merely lost revenue.

There is also a legal dimension worth noting: transactional messages are sent to perform a contract, while marketing messages need consent or a soft opt-in. Mixing them on one stream makes it harder to prove which was which, and tempts people to slip promotions into receipts — which is exactly how a transactional stream loses its status.

Set the policy at the top

Publish DMARC on the organisational domain so it covers subdomains, and use the sp tag if you want a different policy for them during the transition. Start at p=none, read the aggregate reports until you recognise every sender, then move through quarantine to reject.

The reports are the point. Almost every shop that runs this exercise finds at least one forgotten system sending as its domain — an old helpdesk, a survey tool, an accounting integration set up by someone who has left.

Warming a new subdomain

A new subdomain has no reputation, and sending 40,000 messages from it on day one looks exactly like what a spammer does. Warm it up over two to four weeks:

1. Start with your most engaged people — recent buyers, recent clickers. Their opens, clicks and replies are the positive signal that builds reputation.
2. Increase volume gradually, roughly doubling every few days, and split it across providers rather than sending everything to one.
3. Watch Google Postmaster Tools daily during the ramp. Domain reputation moves within days at this stage.
4. Pause the ramp if complaints rise; do not push through it.
5. Keep the old domain sending in parallel during the transition, shifting share gradually rather than switching overnight.

Transactional mail warms faster because it is wanted, opened and rarely reported. That is another argument for splitting: the two streams need different ramps.

Do you need a dedicated IP?

Usually not. A dedicated IP only helps when your volume is high enough to generate a consistent reputation signal — as a rough rule, tens of thousands of messages per week, sent regularly. Below that, a well-managed shared pool at a reputable provider is better than a dedicated IP that goes cold between campaigns, because reputation decays when you stop sending.

Domain reputation, on the other hand, matters at every volume. Get the subdomains right and leave the IP question until your volume actually raises it.