One domain per job: why password resets should not share a reputation with outreach
Most teams send every kind of mail from one domain, because that is the obvious thing to do and nothing appears to go wrong. Then a marketing send does badly, and two weeks later password reset emails start landing in spam — and nobody connects the two, because those systems share no code, no queue, and no vendor. They share the only thing that mattered: the domain in the From: header. What…
When teams send all types of emails from a single domain, they often encounter issues when certain emails, like password resets, start landing in spam. This happens because all emails share the same From: header domain, which affects the email sender's reputation score. The domain name accumulates a history, and both successful and unsuccessful email sends contribute to it. This shared reputation can lead to asymmetric failure, where transactional emails, which are the most reliable, suffer due to their low risk profile.
To avoid this issue, it is recommended to separate emails based on their risk profile rather than sending them all from the same domain. This means having different domains for different types of emails: yourcompany.com for everything, mail.yourcompany.com for transactional emails like password resets and receipts, and a separate domain for marketing to opted-in lists.
Cold outreach should have its own registered domain. The idea is to keep the high-reputation domain safe and use separate domains to manage the risks associated with different types of emails.
A crucial step is to implement DMARC (Domain-based Message Authentication, Reporting, and Conformance) policies. DMARC provides a framework for email authentication, helping to prevent spoofing and phishing. For the organizational domain, the DMARC policy should be set to quarantine, meaning emails that fail authentication will be sent to a quarantine folder rather than the inbox.
Subdomains, however, inherit this policy. This means setting sp=quarantine in the DMARC record for subdomains, ensuring they also get treated as high-risk mail.
Each domain requires its own SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) records. Subdomains do not inherit these records from the main domain, meaning they must have their own unique SPF and DKIM entries. This ensures that all emails, regardless of where they originate, are properly authenticated. The SPF record specifies which mail servers are allowed to send emails on behalf of the domain, while DKIM provides a cryptographic signature to verify the sender's domain.
When setting up new domains, start with a low volume of emails to establish their reputation. This "warm-up" period allows the domain to build a positive history over several weeks, showing that the emails are legitimate and not spam. It is important to monitor the complaint rate as a leading indicator to ensure that the new domain is receiving emails appropriately.
If migrating from one domain to another, it is not advisable to cut over suddenly. Instead, set up the new subdomain with its own SPF, DKIM, and DMARC records, and confirm that it aligns with the main domain by checking the Authentication-Results header on a real test message. Start with transactional emails, as they are the most reliable and will quickly establish the new domain's history.
Follow with marketing emails, and finally move to cold outreach on a separate domain once the warm-up period is complete. This gradual approach ensures that the new domain builds reputation without sudden shocks that could lead to deliverability issues.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
