One SPF record cannot hold every vendor without exceeding the lookup limit, and one shared domain means one vendor's mistakes damage everyone's placement.
Mistake 1: Delegating the whole zone to a vendor via NS records, giving them control over more than mail#
Why it hurts: this undermines subdomain delegation for email vendors at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: List every vendor that sends as your brand.
Mistake 2: Forgetting sp= in DMARC, leaving delegated subdomains unenforced#
Why it hurts: this undermines subdomain delegation for email vendors at the point where mailbox providers make their decision, and it is rarely surfaced by your own tooling until placement drops.
Fix: Assign each a subdomain and delegate DNS or publish its records directly.
Frequently asked questions#
Does using a subdomain hurt brand recognition?
The visible From can still show your brand name; recipients rarely notice the subdomain, and providers reward the isolation.