A dedicated sending domain is a subdomain you use exclusively for outbound email, such as mail.yourcompany.com, authenticated with its own SPF, DKIM, and DMARC records. It isolates your marketing reputation from your corporate email, so a bad campaign never puts your team's day-to-day messages at risk.
Subdomain or separate domain?
Two approaches get called a "dedicated sending domain," and the difference matters.
A subdomain of your main domain, like news.yourcompany.com, is the right answer for almost everyone. It inherits some of your organizational domain's standing, it is obviously connected to your brand, and it keeps reputation compartmentalized. Recipients see a sender that is clearly you.
A completely separate domain, like yourcompany-mail.com, starts with zero reputation and looks like the pattern spammers use to escape blocklists. It has narrow legitimate uses, mostly cold outreach programs that accept the risk of burning a domain. For newsletters, transactional mail, and lifecycle campaigns, do not do this.
Why not just send from your root domain?
Because everything shares one reputation. If a promotional campaign to a stale list generates complaints, the damage lands on the same domain your sales team uses for one-to-one email and your app uses for password resets. Recovering takes weeks, and during that time your invoices are going to spam.
Separating streams gives you four concrete benefits:
- Blast radius control. A marketing problem stays a marketing problem.
- Independent warm-up. You can ramp a new sending stream without touching corporate mail flow.
- Cleaner diagnostics. DMARC reports for the subdomain describe only your bulk sending, so the data is readable.
- Provider flexibility. Switching email platforms means changing records on a subdomain, not on the domain your entire company depends on.
The cost is about thirty minutes of DNS work, once.
Pick the subdomain name
| Pattern | Example | Best for |
|---|---|---|
| mail. | mail.yourcompany.com | General purpose, one stream |
| news. or updates. | news.yourcompany.com | Newsletters and marketing |
| notify. or app. | notify.yourcompany.com | Transactional and system mail |
| hello. or team. | hello.yourcompany.com | Friendly one-to-many sending |
| e. or em. | e.yourcompany.com | High-volume senders wanting brevity |
Two rules. Avoid anything that reads as spammy, such as offers., deals., or blast. And if you send meaningfully different types of mail, use two subdomains rather than one, so a promotional stumble never delays a receipt.
The DNS records you need
Exact values come from your email platform, but the shape is consistent. Here is what you are adding and why each one exists.
| Record | Type | Host | Purpose |
|---|---|---|---|
| SPF | TXT | mail.yourcompany.com | Lists which servers may send for this domain |
| DKIM | CNAME or TXT | selector._domainkey.mail.yourcompany.com | Cryptographic signature proving the message is yours |
| DMARC | TXT | _dmarc.mail.yourcompany.com | Tells receivers what to do with failures and where to report |
| Return-Path | CNAME | bounce.mail.yourcompany.com | Aligns the envelope sender so SPF passes alignment |
| Tracking | CNAME | link.mail.yourcompany.com | Serves click links from your brand, not a shared host |
A few details that trip people up. Your SPF record for the subdomain is independent of the root domain's SPF; subdomains do not inherit it. DKIM is usually published as a CNAME pointing at your provider so key rotation happens without you touching DNS again. And the custom return-path is what makes SPF align with the visible From address, which is the part DMARC actually checks. If you generate the record values yourself, our SPF, DKIM and DMARC generator will produce correctly formatted records.
Step by step
- Add the subdomain in your email platform. It generates the records specific to your account, including the DKIM selector.
- Create the records at your DNS host. Watch the host field: many DNS providers append the root domain automatically, so entering the full name produces mail.yourcompany.com.yourcompany.com. Enter just the left-hand portion when the provider auto-appends.
- Set a permissive DMARC policy first. Start with p=none plus an rua address so you collect reports without rejecting anything while you verify alignment.
- Wait for propagation. Usually minutes, occasionally up to a few hours depending on your previous TTL.
- Verify inside the platform. Most tools have a check button that confirms all records resolve correctly.
- Update your From addresses. Change campaign and application senders to the new subdomain, and set a reply-to that a human monitors.
- Send test messages and read the headers. Confirm SPF pass, DKIM pass, and DMARC pass with alignment on the From domain.
- Tighten DMARC after a few weeks. Once reports show only legitimate sources passing, move to p=quarantine and then p=reject.
Verify it actually worked
Do not trust a green checkmark in a dashboard. Send a real message to an inbox you control and inspect the raw headers.
You want to see all three of the following: an SPF result of pass with the return-path on your bounce subdomain, a DKIM result of pass with the signing domain matching your sending subdomain, and a DMARC result of pass. The last one is the one that matters, because DMARC passes only when SPF or DKIM both authenticates and aligns with the visible From domain. It is entirely possible to have SPF pass and DMARC fail, which is exactly the situation the custom return-path fixes.
Also check that your click-tracking links render on your own link subdomain rather than a shared provider hostname. Shared tracking domains are a common quiet cause of filtering, and they look wrong when a recipient hovers over a button. For the wider picture on what moves inbox placement, see our guide to improving email deliverability.
Warm the new domain before you scale
A brand-new sending subdomain has no history, and providers treat unknown senders cautiously. Even with perfect authentication, jumping straight to 100,000 messages will get you deferred.
Start with a few hundred messages a day to your most engaged contacts, roughly double every two to three days while deferrals stay near zero, and hold volume steady rather than sending in unpredictable bursts. Two to four weeks of this establishes enough history for normal volume. If you are migrating from an existing setup, run both domains in parallel for a couple of weeks and shift traffic gradually rather than cutting over in one evening.
Mistakes that cost people a week
- Two SPF records on one host. Only one TXT SPF record per hostname is valid. Merge includes into a single record.
- Exceeding the SPF lookup limit. More than ten DNS lookups causes a permerror and SPF failure. Trim unused includes.
- Forgetting the root DMARC subdomain policy. If your organizational domain publishes sp=reject, that policy applies to your new subdomain too. Check it before you launch.
- Leaving the return-path unconfigured. Everything looks fine until DMARC alignment fails silently.
- Changing DKIM selectors mid-campaign. Rotate keys between sends, never during one.
- Sending corporate mail from the new subdomain. That defeats the entire point of the separation.
Frequently asked questions
Do I need a dedicated sending domain for a small list?
If you send fewer than a few thousand messages a month, a properly authenticated root domain is usually fine. The moment marketing volume could plausibly affect your company's regular email, set up a subdomain.
Should the sending domain be a subdomain or a separate domain?
Use a subdomain of your main domain in almost every case. A separate lookalike domain starts with no reputation and resembles the pattern used to evade blocklists, which works against you with filters.
How long does DNS propagation take for a sending domain?
Usually a few minutes to an hour, though it can take longer if the previous record had a high TTL. Verify with your platform's checker rather than assuming a fixed waiting period.
Can I use the same sending domain for marketing and transactional email?
You can, but separating them is better. Two subdomains keep a poorly received campaign from delaying password resets and receipts, which are the messages users notice most when they are late.
Do I still need DMARC if SPF and DKIM are set up?
Yes. SPF and DKIM authenticate the message, but DMARC is what enforces alignment with the visible From address and gives you reporting. Major mailbox providers increasingly expect a DMARC record from bulk senders.
IGSendMail configures SPF, DKIM, and DMARC automatically when you add a sending domain, and includes free 24-hour migration if you are moving from another platform. Set up your sending domain with IGSendMail.
