Subdomain sending
Sending each type of mail from its own subdomain, so a bad newsletter week is far less likely to drag your password resets down with it.
See it
What it is
Mailbox providers score reputation per sending domain, and subdomains carry their own score. Split your mail streams across subdomains and a bad campaign week is mostly contained: marketing trouble is much less likely to drag password resets into spam, and the root domain your team uses for human mail stays out of it. A common layout is notify.yoursite.com for transactional, news.yoursite.com for bulk, and the root reserved for people. Read that as a smaller blast radius, not a wall. Filters also weigh the organizational domain, the sending IPs, the ESP, the links in your content, and the brand behind all of it, so a genuinely bad marketing program can still cost you at the transactional subdomain.
Reach for it before you have a problem, not after. Retrofitting means warming a new subdomain from zero while your old one is already damaged. Each subdomain needs its own SPF record, its own DKIM keys and selector, and its own warmup ramp. DMARC is the exception: a policy on the organizational domain covers subdomains automatically, unless you override it with the sp= tag or publish a DMARC record directly on the subdomain, which wins over the parent for that subdomain.
Two misconceptions. Reputation is not cleanly inherited: a brand new subdomain of a trusted root starts closer to neutral than to trusted, so budget for warming anyway. And rotating to a fresh subdomain every time you get filtered is a known evasion pattern (snowshoeing), which providers penalize harder than whatever you were running from.
Ask AI for it
Design a subdomain sending architecture for yoursite.com. Start with the structure: which streams get which subdomain (transactional receipts, resets, and alerts separate from newsletters and campaigns), the root reserved for human mail, and the DMARC policy layout including how sp= on the organizational domain differs from p=, and when a subdomain would publish its own DMARC record instead. Then, per stream, name the sending provider. Use the provider-generated SPF, DKIM, and Return-Path records I paste in; where I have not given you any, output clearly marked placeholders and the dashboard step that generates the real value, rather than inventing selectors or tokens. Finish with a warmup ramp per subdomain and the reputation metrics to watch during it.