Should you use an email subdomain for marketing?

Why senders put marketing email on a subdomain#

A marketing subdomain is a name under your own domain — news.example.com, offers.example.com — that campaigns are sent from, while receipts, password resets and people’s own mail use other names. It is the industry’s standing recommendation. M3AAWG, the anti-abuse working group where senders and mailbox providers write best practice together, says receivers “request (and may require) that different types of email traffic be separated”, and that “it is strongly recommended that senders assign a separate subdomain of the main domain name for each distinct sending purpose.”^[1]

Gmail’s sender guidelines make the same point about addresses: messages of the same category should share a From address, different categories should not, and promotions do not belong inside receipts.^[2] A subdomain is the strongest version of that separation, because it separates the domain — the thing reputation, SPF, DKIM and DMARC are attached to — and not just the local part before the @.

What a subdomain isolates, and what it does not#

The benefit people want is reputation isolation: a campaign that draws complaints should not push the password reset into spam. How much isolation a subdomain gives is not something any mailbox provider publishes as a rule, so it is worth separating what is documented from what is assumed.

What is separate#

• Reputation data. M3AAWG says reputation “is quickly built from sending activity performed on a subdomain” and recommends separation “to increase visibility, distinguish reputations and aid in troubleshooting”.^[1] Gmail’s Postmaster Tools lets you add a subdomain to see its dashboards “independently from the primary domain”,^[3] and its domain reputation view covers “the exact domain used for DKIM and SPF authentication”.^[4] The Postmaster Tools guide covers setting it up.
• SPF. SPF is evaluated for the domain of the envelope sender,^[5] so a return path on the marketing subdomain has its own SPF record and its own ten-lookup budget, and the apex record stays short.
• DKIM keys. DKIM supports many keys per domain through selectors,^[6] and M3AAWG calls it best practice “for each sending subdomain to send using a different selector”.^[1] A leaked marketing-tool key does not sign as your receipts.
• DMARC policy, if you want it. A subdomain can publish its own DMARC record, which overrides the parent’s for that name.^[7]

What is still shared#

• The bulk-sender count. Gmail counts every message from the same primary domain toward the 5,000-a-day threshold, subdomains included.^[8]
• Compliance status. Postmaster Tools reports compliance for primary domains only, using data from their subdomains to decide it.^[4] A non-compliant marketing subdomain shows up against the parent.
• The DMARC fallback. A subdomain without its own record is governed by the organizational domain’s sp= or p=.^[7]
• The brand. M3AAWG notes a subdomain makes “a clear link between the brand and the domain names’ reputations”^[1] — which is the point, and also why a subdomain cannot be used to launder a bad programme.

Subdomains and DMARC alignment#

DMARC passes when SPF or DKIM passes for a domain that aligns with the From domain. In relaxed mode — the default for both adkim= and aspf= — two names align when they share an organizational domain; in strict mode they must be identical.^[7] Yahoo’s sender requirements say relaxed alignment is acceptable.^[9]

The practical consequence: with relaxed alignment you can send from news.example.com with a DKIM signature for example.com and still pass DMARC. That is convenient, but it also means the signature — and the reputation attached to it — is the parent’s. For real separation, sign campaigns with d=news.example.com and put the return path under the same subdomain, which is the “subdomain consistency” layout M3AAWG illustrates.^[1] Strict alignment is rarely worth the fragility; the full mechanics are in DMARC alignment.

Play video: DMARC Training-2: DMARC Identifier Alignment

DMARC for a subdomain: inheritance, sp= and np=#

You do not need a DMARC record at _dmarc.news.example.com. Without one, receivers use the organizational domain’s record: its sp= tag if present, otherwise its p=.^[7] Google’s help puts it plainly: without sp=, “subdomains inherit the DMARC policy set for the parent domain.”^[10]

M3AAWG’s guidance is to keep the record on the organizational domain where you can, and to put one on the subdomain explicitly only when that is not yet possible — “so long as it is understood that the goal is for the record to ultimately be on the organizational domain.”^[1] Three setups, in order of preference:

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; sp=reject; np=reject; rua=mailto:dmarc-reports@example.com"

_dmarc.news.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

The third is a trap if it outlives its reason: a subdomain’s own p=none overrides a parent at p=reject, leaving the one name phishers most want — your newsletter — unprotected. np=, new in RFC 9989, sets the policy for subdomains that do not exist at all, so invented names like billing-news.example.com can be rejected outright.^[7] The full rollout is in DMARC p=reject: how to move from p=none safely.

BIMI and the parent domain#

BIMI shows your logo beside your name in mail apps that support it, and it is where a subdomain strategy most often surprises people. Gmail requires the sending domain’s DMARC policy to be quarantine or reject at 100%; “BIMI doesn’t support DMARC policies that have the p option set to none.”^[11] The BIMI Group’s implementation guide goes further: DMARC “MUST be at enforcement on the organizational domain and subdomains”.^[12]

So a campaign subdomain at p=reject under a parent still at p=none does not qualify. If a logo in the inbox is part of the reason for your marketing programme, the parent domain’s DMARC rollout is on the critical path, not the subdomain’s.

Choosing and naming the subdomain#

M3AAWG asks that the name “be relevant to the type of email traffic sent to avoid confusion for both the recipient and the filtering system”, and gives offers.mybrand.com for marketing and info.mybrand.com for transactional as examples.^[1] A few rules that follow:

• Say what it is. news., offers., updates. or marketing. tell a reader and a reviewer what to expect. Random strings look like evasion.
• Keep the brand in it. Use a subdomain of the domain people know, never a lookalike. M3AAWG “strongly discourage[s]” cousin domains, which “look like phishing campaigns to users and anti-abuse systems alike”.^[1]
• Make it real. Domains in the From should resolve to a live web page about the sender, and abuse@ and postmaster@ should exist and be read.^[1]
• Keep it. Reputation builds with consistent use over time, and switching domains or IPs “can require a ramp-up for the new combination”.^[1] Pick a name you will still like in five years.

The schedule itself — who to mail first and how fast to grow — is in how to warm up a new domain or IP address.

Step by step: set up a marketing subdomain#

The order matters: authenticate before you send, and move volume across gradually rather than on one campaign day.

1. 1

   Pick a descriptive subdomain of your real domain

   Choose a name such as news.example.com or offers.example.com that says what the mail is. Never use a lookalike domain, and make the name resolve to a real page about you.

2. 2

   Authenticate it as a sending domain of its own

   Publish a DKIM key under a selector on the subdomain and put the return path under it, so SPF and DKIM both pass for the subdomain and align with a From address on it.

3. 3

   Cover it with DMARC

   Let the parent domain's DMARC record apply, using sp= if subdomains need a different policy, or publish a record at _dmarc on the subdomain only while the parent is not ready.

4. 4

   Add it to Postmaster Tools

   Add the subdomain in Google Postmaster Tools so its reputation, spam rate and authentication data can be read separately from the parent domain's.

5. 5

   Move campaign volume across gradually

   Start with your most engaged subscribers and raise volume over weeks. M3AAWG suggests considering about six weeks of warm-up as an average for a new sending domain.

6. 6

   Keep every other stream off it

   Send receipts, password resets and people's own mail from other names, and nothing but marketing from the subdomain, so its reputation reflects one kind of mail.

The DNS records, in full#

A complete, self-contained marketing subdomain has four kinds of record. The values below use placeholder hosts; your sending service gives you the real ones.

; Envelope sender (return path): SPF and bounces
bounce.news.example.com.        MX   10 feedback.mail-provider.example.
bounce.news.example.com.        TXT  "v=spf1 include:spf.mail-provider.example ~all"

; DKIM: a selector of its own, signing as the subdomain
s1._domainkey.news.example.com. TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqh…"

; DMARC: usually nothing here — the parent's record applies
_dmarc.example.com.             TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

SPF sits on the return-path name because that is the domain SPF checks,^[5] and a return path under your own subdomain is what makes the SPF leg align — see custom return path, explained. Gmail’s bulk-sender rules also require one-click unsubscribe on marketing mail, whatever domain it comes from;^[2] the Gmail Promotions tab guide covers those headers and the rest of the requirements.

On Rasket#

Rasket verifies each sending domain separately, so news.example.com is a domain in its own right: a DKIM key at the rasket selector signing as that name, and a return path on send.news.example.com by default, so SPF and DKIM both align. The DMARC card on the domain page writes the record for the parent domain unless you ask for one on the subdomain. Campaigns — our marketing feature — send on a marketing stream whose bounces and complaints are counted apart from your transactional mail, so the separation is kept in the numbers as well as the DNS. See verified domains, Campaigns and marketing email.

When a subdomain is the wrong answer#

M3AAWG calls distinct subdomains best practice “especially for bulk sending”, but adds that “for smaller volumes of email, it is acceptable to use different local parts of the sender address”.^[1] It also warns that each segment needs “sufficient and relatively consistent traffic volume” to build a reputation at all, and that lapses or big swings hurt.^[1]

So skip the subdomain if you send a few hundred campaign emails a month — a separate address such as news@example.com is enough, and a subdomain with little traffic never builds a reputation of its own. And never use a subdomain to escape a reputation problem: the cause of the complaints travels with you.

Myths about marketing subdomains#

• Documented by Google “A subdomain keeps you under the bulk-sender threshold.” False: Gmail counts subdomains with the primary domain.^[8]
• Unproven “A subdomain starts with the parent’s good reputation.” M3AAWG says proper use of subdomains helps a programme “benefit from the organizational domain’s existing reputation”, and also that a new sending domain needs a ramp-up.^[1] No provider documents how much carries over, so warm it up anyway.
• “The From address has to use the subdomain.” Not for authentication. M3AAWG notes the visible From need not use the sending subdomain “so long as the organizational domains in each match”.^[1] Readers do find a consistent address easier to trust.
• “A subdomain gets its own BIMI logo regardless of the parent.” The BIMI Group requires enforcement on the organizational domain too.^[12]
• Documented by Google “Moving to a subdomain gets campaigns out of Promotions.” No. Gmail’s tabs weigh “who the email comes from, what type of content is in the message and how Gmail users have interacted with similar content”,^[13] and a marketing email is promotional whatever domain sends it.