Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Send password reset emails from a dedicated transactional subdomain, separate from the subdomain you use for marketing and outreach. Keeping the two streams apart limits how far a problem with bulk sending can spill onto the account messages your users depend on. It reduces that exposure. It does not guarantee inbox placement, so the authentication and monitoring described below still apply.
Why password resets and outreach should use separate sending identities
A password reset is a short, time-sensitive message that a user expects and acts on immediately. A campaign is a larger, less predictable stream that can generate complaints, bounces, and unsubscribes. If both go out under the same sending domain, the reputation signals from the campaign are attached to the same identity that delivers the reset. A bad campaign week can then make legitimate security mail harder to deliver.
Microsoft’s guidance on outbound spam recommends the same separation. Its wording is direct: “Consider using a custom subdomain exclusively for bulk email.” Its DMARC guidance gives the rationale: “You don’t want issues with mail sent from those email services to affect the reputation of mail sent by users in your main email domain.” Both statements are vendor documentation from Microsoft Learn, not the view of an individual author.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Separation is a containment measure. Receiving systems weigh several inputs, including authentication results, sender reputation, message content, and how recipients interact with past mail. A separate subdomain changes the sender boundary, but it cannot promise that a reset will always reach the inbox.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A workable layout for the two streams
Microsoft’s own examples use t.contoso.com for transactional mail and m.contoso.com for marketing mail. Your labels can differ. Common patterns are security.example.com or transactional.example.com for resets and other account-critical messages, and mail.example.com or marketing.example.com for outreach. The labels are naming choices, not requirements.
| Stream | Example subdomain | Messages it carries | Main risk to contain |
|---|---|---|---|
| Transactional and account security | security.example.com or transactional.example.com |
Password resets, sign-in alerts, verification codes | Delivery delays or spam filing that block account recovery |
| Marketing and outreach | mail.example.com or marketing.example.com |
Newsletters, campaigns, cold or partner outreach | Complaints and bounces that lower the reputation of the sending identity |
Your sending platform must be able to send from and authenticate each chosen subdomain. If a provider can only sign mail for the primary domain, the separation exists on paper only.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Authentication: SPF, DKIM, and DMARC for each subdomain
Each sending subdomain needs its own authentication setup. Changing only the visible From address does not configure any of the records below. Microsoft distinguishes the visible header address (5322.From) from the envelope sender (5321.MailFrom) and from the DKIM signing domain, and DMARC evaluates the relationship among them.
SPF: one record per sending domain
SPF lists the sources authorized to send for a domain. Subdomains do not inherit the parent’s SPF record, so each sending subdomain needs its own. Keep exactly one SPF record per domain or subdomain. Publishing two records can produce a permanent SPF error.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
SPF evaluation has a lookup budget. Microsoft’s current SPF guidance describes a limit of 10 DNS lookups per evaluation. Each include statement for a bulk or transactional provider consumes part of that budget, which is one reason Microsoft favors giving other sending services their own subdomains.
DKIM: sign with a domain that matches the From address
DKIM adds a cryptographic signature to each message. For a DMARC pass, the signing domain must align with the visible From domain. Configure the sending service so the reset stream signs with the transactional subdomain and the outreach stream signs with the outreach subdomain. Microsoft’s DKIM guidance also recommends subdomains for services that the organization does not directly control.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
DMARC: tell receivers what to do with failures
DMARC requires that at least one of SPF or DKIM passes and aligns with the visible From domain. It also tells receivers how to handle messages that fail, and it can return aggregate reports. A DMARC record can apply to subdomains unless a subdomain publishes its own DMARC record. Review those reports after each change, because a new vendor or a changed sending address can break alignment without any visible symptom in the sending platform.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSetup sequence for a two-stream domain
- Choose one subdomain for transactional mail and one for outreach. Keep both under your organizational domain and do not use the primary domain for bulk sending.
- Confirm that each sending service supports the chosen subdomain for sending and for DKIM signing.
- Publish one SPF record for each subdomain, listing only the services that send from it, and check the total DNS lookup count against the 10-lookup limit.
- Enable DKIM signing for each subdomain and publish the DKIM key records the provider gives you.
- Publish a DMARC record for each subdomain, or confirm that the parent record applies as you intend.
- Send test messages from each stream and check that SPF and DKIM pass and align with the From domain before relying on the setup.
- Review DMARC aggregate reports regularly and recheck the records whenever a sending vendor changes its configuration.
Subdomains or separate registered domains
There are two architecture options. You can use separate subdomains under one organizational domain, or you can register separate domains for each stream. Microsoft’s guidance directly supports the subdomain approach. It does not compare the two options head to head, and it does not recommend buying a second registered domain for this scenario. The table below separates what the Microsoft guidance establishes from what you need to assess yourself.
| Factor | Separate subdomains under one organizational domain | Separate registered domains |
|---|---|---|
| Reputation boundary | Microsoft recommends this to limit how problems with bulk services affect the primary domain’s mail | Not stated in the Microsoft guidance reviewed; the boundary depends on how receivers treat the separate domains |
| Authentication setup | Each subdomain needs its own SPF, DKIM, and DMARC configuration | Not stated in the Microsoft guidance reviewed; the same three records are needed for each domain |
| DNS and operational overhead | One domain to manage, with separate records per subdomain and a shared SPF lookup budget per subdomain | Additional domain registration, DNS ownership, and renewal to manage |
| Fit for account-critical mail | Supported by Microsoft’s guidance for separating transactional and bulk streams | Not stated in the Microsoft guidance reviewed; evaluate against your own deliverability data |
Neither option is automatically better. Choose the one your organization can authenticate, monitor, and maintain consistently.
Limits and cautions
- Separation reduces shared exposure. It does not guarantee that resets reach the inbox, and it does not stop filtering based on content or recipient behavior.
- The Microsoft guidance reviewed for this article sets out Microsoft’s recommendation and its reasoning. It does not establish how every mailbox provider treats subdomains, and it does not measure a deliverability improvement.
- Microsoft’s outbound-spam documentation states that bulk email sent from Microsoft 365 is best-effort and is not a supported primary bulk-mail platform use case. If you send outreach through Microsoft 365, read the current service terms and use a dedicated bulk sending provider for campaigns.
- Keep account-critical messages monitored even after the streams are separated. Watch for authentication failures, bounce spikes, and reports that show unexpected senders.
- Check the current Microsoft Learn pages for SPF, DKIM, and DMARC before implementing, because the requirements and wording change over time. The guidance used here reflects Microsoft’s documentation retrieved in 2026.
Vendor-specific behavior is not covered here. When you compare sending providers, check support for subdomain sending, DKIM signing on each subdomain, DMARC reporting, bounce handling, and operational monitoring, and confirm those features in the provider’s own documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
