Receivers blend marketing and password reset mail into one history for the From: domain

The two systems that fail together share almost nothing. A marketing platform and a password reset service run on different code and different vendors, and what they have in common is the domain in the From: header ^[3]. That domain accumulates one history, and the receiver cannot tell which system emitted which message ^[2]. The damage lands asymmetrically: transactional mail has near-total open rates and effectively zero complaints, and the dev.to post argues it is the traffic that gets hurt ^[4].

Cold outreach gets its own registered domain in the post's scheme, not a subdomain, so that inheritance does not run in the other direction. The post puts it this way: "the whole point is that when a domain burns, it burns alone" ^[5].

Splitting into subdomains achieves little unless the organizational domain publishes sp=, according to the post ^[6]. The record it gives is `v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected]; pct=100` ^[7]. Enforce p=reject at the organizational level and reject reaches subdomains you forgot you had, including any that are not fully authenticated yet ^[9]. sp=none runs the other way, as a deliberate escape hatch that leaves one lagging subdomain at monitoring while the brand domain enforces ^[10].

A domain may publish exactly one v=spf1 record, and two are a permanent error ^[12]. Each record inspects as valid on its own, so the pair can sit in DNS for months after a website host and a mail provider each add one ^[12]. Then there is the ten-lookup ceiling. Every include, a, mx, ptr, exists and redirect costs a DNS lookup, nested ones included, and include:_spf.google.com alone is four ^[13]. In a record that still looks short, four vendors of that size come to sixteen lookups, six past the limit ^[14].

DKIM fails more quietly. If d= names the ESP's domain, the signature verifies and DMARC still fails on alignment ^[15].

A mailbox warming at twenty a day that also sends thirty real messages is sending fifty from a mailbox with no history ^[17]. That is two and a half times the rate its warm-up schedule assumes ^[18].

The migration order in the post follows the same risk logic: stand up the subdomain with its own SPF, DKIM and DMARC and confirm alignment by reading the Authentication-Results header on a real test message, move transactional first, move marketing next with complaint rate as the leading indicator, and move cold outreach to its own registered domain last ^[19]. For the DNS half, the post points at an SPF, DKIM and DMARC checker, or spf-audit if you would rather run it in CI ^[20].

The specification half of this you can verify in your own zone today. The reputation half is asserted from experience; the post offers no receiver telemetry on how a domain's history is aggregated ^[21]. It transfers on one condition: that your transactional and marketing streams currently present the same From: domain. If resets already sign under their own subdomain with their own keys and their own d=, receivers are scoring something other than the blended history the post describes ^[22].