A password reset and a promotional newsletter look like the same thing to your website. To Gmail they are not the same thing at all, and to the FTC they are governed by different rules. The practical stakes are simple: if your marketing mail earns complaints and your receipts share its reputation, customers stop receiving the emails they actually need.
The legal line is "primary purpose," not intent
Under the CAN-SPAM Rule at 16 CFR 316.3, an email whose content is exclusively transactional or relationship content is a transactional message. That includes messages sent to facilitate, complete, or confirm a transaction the recipient already agreed to, warranty and product recall information, and notices about changes to the terms of an ongoing relationship.
Mix commercial content in and the rule gets specific about how it tips. A mixed message is deemed commercial if a recipient reasonably interpreting the subject line would conclude the message contains an advertisement, or if the transactional content does not appear in whole or in substantial part at the beginning of the body. That second clause is the one people trip over. Putting the receipt below a product carousel is enough to reclassify the message, which means it now needs an unsubscribe mechanism and everything else CAN-SPAM requires of commercial mail.
The real deliverability reason to split the domain
Mailbox providers build reputation at the domain and subdomain level, and they build it from user behaviour: complaints, deletions without reading, and replies. Marketing mail generates complaints as an ordinary cost of doing business. Receipts do not. If both ride on the same sending domain, every complaint your promotional programme earns is also a mark against the domain sending your password resets.
Splitting into subdomains, for example mail.example.com for marketing and receipts.example.com for transactional, gives each stream its own reputation to build and its own reputation to lose. It also means a bad campaign, or a compromised marketing account, cannot take your account recovery emails down with it. Both subdomains still align to your organisational domain for DMARC, so you keep the brand and the alignment while isolating the risk.
The cost of this is real and worth stating: each subdomain needs its own warm-up period and its own DKIM key, and low-volume transactional subdomains take longer to establish reputation because they send less. Do not split until you have enough volume on each side to sustain a reputation.
The 2024 bulk sender requirements changed the baseline
In February 2024 Google and Yahoo both began enforcing requirements on bulk senders, defined by Google as anyone sending more than 5,000 messages a day to Gmail accounts. The requirements are not exotic, but they are now the floor rather than good practice.
5,000/day
Google’s bulk sender threshold, measured per day to Gmail addresses
0.3%
Spam complaint ceiling. Google advises staying under 0.10%
2 days
Yahoo’s window for honouring an unsubscribe request
Sources: Google Workspace Admin Help, Email sender guidelines; Yahoo Sender Best Practices.
- SPF and DKIM on your sending domain, with DMARC published. A policy of p=none satisfies the minimum.
- Alignment between the From: header domain and the domain that passes SPF or DKIM.
- One-click unsubscribe in the headers, implemented as RFC 8058 List-Unsubscribe-Post, plus a visible unsubscribe link in the body.
- Valid forward and reverse DNS (PTR) records for your sending IPs, and TLS on the connection.
- Spam complaint rate kept below 0.3%. Google recommends staying under 0.10%.
Note what applies to which stream. The one-click unsubscribe requirement is aimed at marketing and subscription messages, not receipts, which is another reason keeping the two streams distinct makes your configuration simpler rather than harder. Authentication applies to everything you send, without exception. If SPF, DKIM, and DMARC are unfamiliar, start with SPF, DKIM, and DMARC Explained.
What a sane setup looks like
| Item | Transactional | Marketing |
|---|---|---|
| Consent required | No, the user initiated the underlying action | Yes in the EU and Canada, best practice everywhere |
| Unsubscribe | Not required, and adding one invites people to opt out of receipts | Required in the body and, for bulk senders, as an RFC 8058 header |
| Sending identity | Dedicated subdomain, separate DKIM key | Dedicated subdomain, separate DKIM key |
| Queueing | Immediate, with retry logic and alerting on delivery failure | Batched, throttled, scheduled |
| What you monitor | Delivery latency and hard failures | Complaint rate, unsubscribe rate, engagement |
Key takeaways
- CAN-SPAM classifies by primary purpose: a mixed message becomes commercial if the transactional content is not at the beginning of the body.
- Reputation is tracked per domain and subdomain, so marketing complaints degrade receipts sent from the same identity.
- Separate subdomains isolate reputation but each needs its own warm-up and DKIM key.
- Since February 2024, senders over 5,000 messages a day to Gmail must have SPF, DKIM, DMARC, RFC 8058 one-click unsubscribe, and a spam rate under 0.3%.
- Transactional mail needs immediate sending with retries and delivery alerting, not a marketing queue.
Related reading
Sources
- 16 CFR 316.3, Primary purpose, eCFR, U.S. Federal Trade Commission
- Email sender guidelines, Google Workspace Admin Help
- Sender best practices, Yahoo
- RFC 8058: Signaling One-Click Functionality for List Email Headers, IETF (2017)
- Deliverability
- Technical
Written by
Valter Brandt
Chief Marketing Officer
Valter Brandt is the Chief Marketing Officer of ThisCom, working with clients across the United States and internationally. He has led marketing strategy through the major shifts in social advertising, mobile, content marketing, programmatic media, and marketing automation.
All articles by Valter Brandt →
