Subdomain delegation gives each third-party sender its own subdomain (for example news.example.com for the ESP, help.example.com for the helpdesk) with dedicated SPF, DKIM, and DMARC records, so each vendor's reputation and configuration are isolated.
What good looks like#
- Done: List every vendor that sends as your brand.
- Done: Assign each a subdomain and delegate DNS or publish its records directly.
- Done: Publish SPF and DKIM per subdomain using the vendor's values.
- Done: Set the organizational DMARC record with sp= to cover all subdomains.
What bad looks like#
- Seen in audits: Delegating the whole zone to a vendor via NS records, giving them control over more than mail.
- Seen in audits: Forgetting sp= in DMARC, leaving delegated subdomains unenforced.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
Does using a subdomain hurt brand recognition?
The visible From can still show your brand name; recipients rarely notice the subdomain, and providers reward the isolation.