Sending domain isolated from corporate domain

Sending campaigns or transactional email from the company's primary domain — the same domain used for employee email and the public website — means a single deliverability incident puts all corporate communication at risk. A reputation hit on company.com from a marketing campaign can cause ceo@company.com to land in spam at Gmail. RFC7489-s3 describes this failure mode implicitly: DMARC policy applied to the primary domain affects all mail from that domain, marketing or not. Domain isolation using a sending subdomain (mail.company.com) confines reputation impact to the sending infrastructure and leaves corporate email unaffected by campaign performance.

Move all bulk sending From addresses to a subdomain you authenticate independently from the corporate domain. Authenticate the subdomain with its own SPF, DKIM, and DMARC records:

// Change this:
const from = 'noreply@company.com'

// To this:
const from = 'noreply@mail.company.com'

Then publish DNS records for mail.company.com independently:

# SPF for mail.company.com
mail.company.com TXT "v=spf1 include:sendgrid.net ~all"

# DKIM selector for mail.company.com
k1._domainkey.mail.company.com TXT "v=DKIM1; k=rsa; p=<pubkey>"

# DMARC for mail.company.com
_dmarc.mail.company.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@company.com"

The corporate company.com DMARC policy remains separate and is unaffected by mail.company.com reputation. Track both sets of records in infrastructure-as-code.