How to isolate domains by brand or department?

Imagine you run a travel company with three very different brands: a budget airline, a luxury cruise line, and a corporate travel department. You wouldn't want a complaint spike from the budget airline's flash-sale blasts to tank the deliverability of the cruise line's premium newsletters. That's exactly the problem domain isolation solves.

Here's how to think through the decision and actually set it up.

Step 1: Decide between subdomains and separate root domains

Subdomains (like news.brand.com and alerts.brand.com) are faster to spin up and easier to manage. But they share a parent-domain association, which means reputation can still bleed if mailbox providers connect the dots.

Separate root domains (like flightdeals.com and cruiseletters.com) give you the cleanest separation. Mailbox providers treat them as genuinely independent senders. The tradeoff is cost (domain registration, ongoing maintenance) and warmup time: every new root domain starts with zero reputation and needs a proper warmup period before you send volume.

A simple rule of thumb: use subdomains when your brands share an audience and have similar engagement levels. Use separate root domains when a high-complaint stream could genuinely damage an unrelated brand.

Step 2: Set up independent authentication for each domain

Every domain you send from needs its own complete authentication stack. That means:

• SPF record that lists only the sending sources for that specific domain. Don't copy-paste the same SPF record across domains if they use different infrastructure.
• DKIM keys that are unique per domain (and ideally per selector, if you use multiple ESPs for one domain).
• DMARC policy set independently so you can enforce or monitor each domain on its own timeline. A marketing domain might start at p=none while your transactional domain is already at p=quarantine.

Shared authentication is one of the most common ways isolation fails in practice. If two brands share a DKIM signing domain or the same SPF include, mailbox providers can still associate them.

Step 3: Separate your sending infrastructure

Still if you're sending enough volume to justify it, dedicated IPs per brand give you the cleanest IP-level separation. High-volume senders (think millions of emails per month per brand) benefit most from this. For smaller brands, shared IPs are fine as long as you're on separate sending streams within your ESP.

Whatever you do, make sure each brand has its own suppression list and bounce handling. A shared suppression list seems efficient until a spam complaint from Brand A starts filtering Brand B's emails.

Step 4: Isolate your tracking infrastructure

This one surprises a lot of people. If two brands share a link-tracking domain (like click.shared-esp-domain.com), mailbox providers can still connect them through that tracking URL. Set up distinct click-tracking and open-tracking domains for each brand. Most ESPs let you configure a custom tracking domain per account or per sending domain.

The real cost-complexity tradeoff

Full isolation across separate root domains, dedicated IPs, separate ESP accounts, and individual tracking domains is absolutely the cleanest setup. It's also expensive and adds operational overhead every time something needs updating (SPF changes, DKIM rotation, DMARC reports to monitor per domain).

And a tiered approach works well for most organizations. Your highest-risk stream (usually bulk promotional email) gets the most isolation. Transactional email and internal department mail can often share infrastructure safely as long as the authentication is clean and sending volumes don't overlap dangerously.

If you're not sure where your current setup stands, you can check your SPF configuration across each domain right now, for free. Or if the whole thing feels like a lot to untangle, the SOS hotline is free and we'll help you figure out what actually needs fixing.