This guide assumes subdomain delegation for email vendors is already deployed and passing. It covers what breaks at scale and how mature teams operate it.
Edge cases that break a working setup#
- Delegating the whole zone to a vendor via NS records, giving them control over more than mail.
- Forgetting sp= in DMARC, leaving delegated subdomains unenforced.
- Mail forwarded through mailing lists or personal forwarders, which alters headers and content.
- Acquisitions and rebrands that introduce domains nobody audited.
- Vendors silently changing their sending infrastructure.
Operating it as infrastructure#
- Assign an owner for each sending domain and each vendor relationship.
- Put DNS records under version control or a change-review process.
- Alert on authentication pass rate drops and reputation changes, not just outages.
- Run a quarterly audit against the setup steps below.
- Document runbooks for the three most common failures.
Reference: the baseline setup#
- List every vendor that sends as your brand.
- Assign each a subdomain and delegate DNS or publish its records directly.
- Publish SPF and DKIM per subdomain using the vendor's values.
- Set the organizational DMARC record with sp= to cover all subdomains.
Frequently asked questions#
Does using a subdomain hurt brand recognition?
The visible From can still show your brand name; recipients rarely notice the subdomain, and providers reward the isolation.