Transactional vs marketing email — separate them or suffer

Transactional email — receipts, password resets, account notifications — is high-value and high-engagement. Marketing email is lower-engagement and prone to complaints. Mixing them on one sending domain means a bad marketing campaign can take down your password resets. Don't.

Why mixing is dangerous

Receivers build reputation per sending domain and per sending IP. A marketing campaign that accidentally triggers a complaint spike pulls down the reputation of every other email leaving that domain. The next morning your password resets are landing in spam.

The converse is also true but less alarming: high-engagement transactional traffic raises reputation overall. But you can't bank on it offsetting a bad marketing send.

The clean split

Use subdomains:

• transactional.example.com — receipts, account notifications, password resets.
• mail.example.com or marketing.example.com — newsletters, campaigns, promotions.
• The bare example.com reserved for human-to-human business mail.

Each subdomain gets its own DKIM key and its own DMARC alignment. SPF is published on each. Most ESPs let you delegate a subdomain to them via CNAME so you don't have to manage their IP rotations.

What about IP pools?

For sub-100k-monthly volume, shared ESP IPs are fine. Above that, request a dedicated IP per stream. You're now responsible for warming them, but you also stop sharing reputation with whoever else is on the shared pool.

DMARC across subdomains

A single DMARC record at _dmarc.example.com covers all subdomains by default. You can override per-subdomain with a record at _dmarc.<subdomain>.example.com. Common pattern: strict (p=reject) on the bare domain, more lenient (p=quarantine) on subdomains while you're still rolling out.

Migration from a unified setup

If you're already mixing, splitting is straightforward but has to be careful:

1. Set up the new subdomain with full SPF, DKIM, DMARC.
2. Warm the new subdomain over 4 weeks (see the warm-up post).
3. Migrate one stream at a time. Start with the lower-volume one.
4. Don't decommission the old setup until 30 days after migration — DMARC reports will show you any forgotten senders.

If you only do one thing

If you're sending both transactional and marketing from the same domain, plan the split this quarter. The fix gets harder the longer you wait, and the day you regret not doing it is the day a bad campaign takes down your password resets.