Email Deliverability: Send Bulk Mail From a Subdomain, Not Your Root Domain

You shipped the app. The welcome email works on your laptop, then it fails its first real test of email deliverability when a customer writes back: I never got it, check your spam. You look, and there it sits in their junk folder, between a prince with a wire transfer and a pharmacy with a deal.

I run email systems across multiple domains, including authentication, reputation monitoring, and delivery controls. Authentication is required, but it does not guarantee inbox placement. Content, sending patterns, domain and IP reputation, list quality, complaint rate, and recipient engagement also affect the result. Here is how the controls fit together and why a dedicated bulk-sending subdomain is usually the cleaner design.

The short version: SPF authorizes senders, DKIM signs messages, and DMARC checks alignment with the visible From domain and publishes a policy for failures. Major mailbox providers require stronger authentication and unsubscribe controls for high-volume senders. Those controls establish identity and policy. They do not promise inbox delivery. Send marketing and bulk mail from a dedicated subdomain such as mail.yourbrand.com to separate configuration and reputation signals from person-to-person mail. The separation reduces shared risk, but providers can still associate related domains, infrastructure, and sending behavior.

Why your app email lands in spam

Missing authentication is one reason an app email lands in spam. Mailbox providers also analyze message content, volume changes, sending infrastructure, past behavior, recipient engagement, list quality, and spam complaints. A fully authenticated message can still be filtered when the other signals are poor.

The visible From address can be forged, so receiving systems look for authenticated evidence and a history of responsible sending. Google’s sender guidelines cover authentication, DNS, TLS, spam rates, message formatting, forwarding, and subscription practices. Google recommends keeping Postmaster Tools spam rates below 0.10 percent and avoiding 0.30 percent or higher.

This used to be advice. Now it is the gate. Since February 1, 2024, Gmail requires anyone sending more than 5,000 messages a day to authenticate with SPF, DKIM, and DMARC and to put a one-click unsubscribe in every marketing message. Yahoo set the same bar. In May 2025, Microsoft’s Outlook joined them, routing non-compliant high-volume senders straight to Junk and, for repeat offenders, rejecting the mail outright. The three biggest inboxes now agree on the price of entry.

SPF, DKIM, and DMARC: the three proofs every sender needs

SPF, DKIM, and DMARC are three DNS records that together prove a message is really from your domain. SPF lists the servers allowed to send for you. DKIM signs each message so it cannot be forged or altered in transit. DMARC ties both to the address the reader sees and tells the receiver what to do when the proof fails.

Record	What it proves	What happens on failure
SPF	This server is allowed to send for the domain	The receiver notes the fail
DKIM	The message is signed by the domain and unaltered	The signature check fails, the mail is flagged
DMARC	SPF or DKIM passed and matches the visible From	You choose: none, quarantine, or reject

The one that ties it together is DMARC, and the word that matters is alignment. A spammer can pass SPF and DKIM on their own junk domain all day. DMARC only passes when the authenticated domain matches the From address your reader actually sees, which is the part the spammer cannot fake without your DNS. DMARC also carries a policy you set. Start at p=none, which only watches and reports. Move to p=quarantine, which sends failures to spam. Land on p=reject, which tells the world to throw away any mail that fails the check in your name. None is the training wheels. Reject is the brakes.

I once chased a client’s mail that kept hitting spam down to one missing DKIM record and a password manager quietly leaking the domain’s login. The fix was not better words. It was the proof that was never there.

Send bulk mail from a subdomain, not your root domain

Send marketing and bulk mail from a dedicated subdomain such as mail.yourbrand.com, and keep person-to-person mail on the root where practical. This gives each stream separate authentication, monitoring, and reputation signals. It reduces the chance that one stream directly contaminates another, but it is not a complete firewall. Providers may connect related domains, IP addresses, links, and sending behavior.

Here is the failure I design against. A company sends its newsletter, its receipts, and the founder’s actual replies all from the one root domain. A single marketing blast goes to a stale list, the complaints spike, and the domain’s reputation falls. Now the founder’s reply to a client lands in spam, because the inbox cannot tell the founder’s mail from the blast that just annoyed a few thousand people. They all wore the same name.

I split the streams by name and purpose. Person-to-person mail stays on the root. Bulk and marketing use a subdomain with their own DKIM key, monitoring, and sending plan. DMARC’s sp= tag can publish a policy for subdomains while the organizational domain uses its own p= policy. New sending infrastructure should increase volume gradually while the team watches delivery, complaints, bounces, and engagement. There is no universal warm-up schedule that guarantees acceptance.

How to set up email that lands in the inbox

Set up SPF, DKIM, and DMARC on your sending domain, move your bulk mail to a subdomain, warm that subdomain up slowly, and keep complaints low with a working one-click unsubscribe. That is the whole checklist. Each item is a DNS record or a header, not a guess, and together they decide whether you reach the inbox. This is the same gap between looks-handled and is-handled that the padlock hides, where HTTPS proves the connection but not the privacy. The visible signal is never the proof.

Once DMARC is at enforcement, quarantine or reject, BIMI can display your logo next to your name in supporting inboxes, usually after you obtain an eligible mark certificate. Authentication and provider requirements still decide whether the logo appears. The same care applies when you reach out cold, whether that is an AI voice on the phone or a first email to a lead.

Good email combines authentication, permission, list hygiene, useful content, predictable sending, low complaint rates, and easy unsubscribe. A dedicated subdomain makes those systems easier to operate and diagnose.

Frequently asked questions

Why does my app email go to spam?

Common causes include missing or misaligned authentication, poor domain or IP reputation, sudden volume changes, weak list quality, high complaints, bounces, misleading content, and low engagement. Authentication is necessary for serious sending, but it is only one part of deliverability.

Do I need SPF, DKIM, and DMARC, or just one?

You need all three. SPF authorizes your sending servers, DKIM signs the message so it cannot be altered or forged, and DMARC ties both to the visible From address and sets what happens on a failure. Since February 2024, Gmail and Yahoo require all three from senders above 5,000 messages a day, and Outlook enforced the same from May 2025.

Should I send email from a subdomain or my root domain?

Send bulk and marketing mail from a dedicated subdomain and keep person-to-person mail separate where practical. This isolates configuration and some reputation signals. It reduces risk to the root domain but does not guarantee complete reputation separation or inbox placement.

What is a good spam complaint rate?

Google asks senders to keep the spam rate in Postmaster Tools under 0.10 percent and to never reach 0.30 percent. Past that ceiling your delivery drops fast and recovers slowly. Mail only people who asked, honor unsubscribes right away, and you stay well under the line.

What does DMARC p=none, quarantine, and reject mean?

They are the three actions DMARC can tell receivers to take when a message fails authentication. p=none only monitors and reports, so you can see what is sending as you. p=quarantine sends failing mail to spam. p=reject blocks it outright. Start at none to watch, then move to reject once your real mail passes cleanly.