Your email program looks like one Klaviyo account until a sale to a cold segment and your shipping notifications share a From domain. Then it looks like one reputation problem with two kinds of angry customers.
Architecture is the decision to not put those streams on the same identity. This page is the map. The DNS for a subdomain is the subdomain setup guide. The meaning of the hostname is what a sending domain is. The IP choice is dedicated versus shared. Read those for the procedures. Use this page to decide which one you need.
Last verified: 26 September 2026. Provider rules are the ones in the Gmail, Yahoo, and Microsoft documents linked from the cluster, not new thresholds.
The streams in your sending architecture, and why they should not be identical
| Stream | What failure costs | What to isolate |
|---|---|---|
| Campaigns and sales | Complaints from people who did not want that offer | Its own From domain or DKIM domain, engaged audiences, one-click unsubscribe |
| Lifecycle flows (welcome, cart, browse, post-purchase) | The same person getting a flow and a campaign the same day | Filters and Smart Sending so the streams do not stack. Flows versus campaigns |
| Transactional (order, shipping, password) | Support tickets, and on a shared account a pause that stops the receipt | A different DKIM domain or a different platform from the sale mail |
Yahoo’s sender requirements put the split in the recommendation section, not in the enforcement list: do not send bulk mail from the same IPs you use for user and transactional mail, and separate by IP or DKIM domain because each has a reputation. Google’s sending-practices section says that if you use more than one IP, use a different IP for each message type, such as account notifications versus promotions. That is a best practice on the guidelines page, not a line in the bulk-sender requirement list. Microsoft’s 550 5.7.515 article does not require a separate IP. Gmail and Microsoft do publish rules that apply per From domain once you are a bulk or high-volume sender. A subdomain that sends close to 5,000 or more messages to personal Gmail accounts in 24 hours is in Gmail’s bulk rules on its own. That does not mean a quieter subdomain can skip authentication; it only means the bulk-sender requirements, including one-click unsubscribe, attach to that name directly. Two platforms on one From domain still share that domain’s reputation. Klaviyo versus SES is the platform choice, and the SPF lookup limit is what a second include costs.
Transactional versus marketing is the content and consent difference. This page is only the identity difference. A receipt can still go to spam if its domain is cold or unauthenticated. Isolation does not exempt it. When that is already happening, use why order confirmations go to spam.
A shape that matches those constraints
You will probably end up near this, and then adjust:
- Root or a stable subdomain for transactional mail, authenticated, low complaint risk, not used for the weekly sale.
- A marketing subdomain for campaigns and commercial flows, warmed, with its own Postmaster Tools property and its own Yahoo complaint enrollment.
- One platform or two, on purpose. Klaviyo for marketing and SES or the store platform for receipts is common. If both use one SES account, a complaint review can pause receipts too. That constraint is in the SES deliverability guide.
- Shared IP unless you have a reason not to. Volume, control, and a neighbor problem are the reasons people look at a dedicated IP. The data page is the dedicated-versus-shared study. Do not add a dedicated IP to “fix” a domain that fails DMARC.
Agencies repeat this per client. A shared agency domain is how one client’s sale becomes another client’s receipt problem. The agency guide is that version.
What your sending architecture cannot skip
Every name you add needs its own authentication and its own warm-up. SPF, DKIM, and DMARC with alignment is the floor on each hostname, and RFC 9989 did not create an exception for subdomains. The record-level steps, including registering each subdomain in Postmaster Tools, are in the subdomain setup guide. The SPF, DKIM, and DMARC explanation is the reference, and DMARC in 2026 is the standards delta. A new name inherits no reputation, so changing the sending domain is the cutover order.
One-click unsubscribe belongs on your marketing stream, where Gmail and Yahoo require it for bulk marketing mail. Google also recommends honoring the request within 48 hours; that is a recommendation, not a requirement. Keep the header off password resets and receipts, so nobody unsubscribes from the mail they are waiting on.
Monitor per domain. A single account average hides the subdomain that is in spam. Watch Postmaster Tools, Yahoo complaints, and placement at Gmail, Yahoo, AOL and Outlook per stream, not once for “the brand.”
How to know your sending architecture is working
- A bad campaign moves complaint rate and spam placement on the marketing domain, and order mail on the other domain does not follow it the same day.
- Authentication passes on both. A failure on receipts is an incident even when campaigns look fine.
- You can point to which platform sends which stream. If you cannot, the inventory step is not done, and an ESP migration will surprise you.
Sending architecture mistakes to avoid
Do not create a subdomain per campaign; you will never warm them, and you will not monitor them. Do not send win-backs from the transactional domain because “it has the good reputation,” because you will spend that reputation. And do not change the architecture during the week you are already in spam. The first 24 hours says not to swap domains to escape a crisis. Design the split when you can watch it.
InboxEagle
Monitor the domain that actually signed the mail
Run each sending name through the checker, the campaign subdomain and the receipt domain separately, so one healthy result does not stand in for both.
Sources
- Sender best practices, Yahoo. Recommendation to separate marketing from transactional mail by IP or DKIM domain.
- Email sender guidelines, Google. Bulk rules apply to the domain that sends the volume.
- Fix NDR 550 5.7.515, Microsoft. The From domain is the unit of that rejection.
- Amazon SES sending review FAQ, AWS. A pause applies to the account’s sending.