Yes. Keep transactional mail such as receipts and password resets on a different From address, and ideally a different sending domain or IP, from promotional mail. Complaints about promotions then cannot drag down delivery of the messages your users must receive.
Definition
Transactional email is triggered by a user action or account event: a reset link, a receipt, a security alert. Marketing email is sent to a list to promote something. Mailbox providers score reputation per domain and per IP address, so mixing the two ties their fates together.
Google's sender guidance says this directly. Messages of the same category should share the same From address, with examples of separate addresses for sales receipts, promotions and account notifications. If you must send from multiple IP addresses, it suggests a different address for each message type, for example one for account notifications and another for promotions. It also says not to mix content types in the same message, such as putting promotions inside a sales receipt.
Why it matters for security
A password reset that lands in spam is a support problem and a security problem. Users who cannot recover an account tend to use weaker workarounds, and attackers benefit when your real alerts are missed. Reputation damage from a promotional send is the usual cause.
Google also notes that sending IP quotas are shared by all senders on that IP. When the IP hits its quota, all domains sending from it stop. A shared pipeline for both streams means a marketing burst can delay resets.
What to split
| Item | Transactional | Marketing |
|---|---|---|
| From address | alerts or accounts address | news or offers address |
| Subdomain | Its own, authenticated with SPF and DKIM | Its own |
| IP or pool | Dedicated or separate pool when volume allows | Separate pool |
| Unsubscribe | Offer notification settings | One-click unsubscribe required for bulk marketing |
| Content | Only the transaction | Promotions allowed |
| Volume ramp | Steady | Ramp gradually, avoid bursts |
Authenticate each subdomain with SPF and DKIM, and publish DMARC for the sending domain. Google asks bulk senders for SPF, DKIM and DMARC, and requires the From domain to align with the SPF or DKIM domain.
Steps
- Inventory every message your product sends and tag each as transactional or marketing.
- Create a separate sending subdomain per stream and authenticate it.
- Move marketing to its own address, pool and provider settings.
- Keep promotions out of transactional templates, including footers.
- Monitor spam rate and reputation separately for each stream.
- Review again when volume grows, since the right split changes with scale.
Send at a steady rate rather than in bursts, and ramp new sending identities slowly. See the bulk sender requirements checklist for the authentication basics.
Where Safeguard fits
Safeguard's asset discovery and compliance evidence automation help you keep an inventory of the domains and services that send on your behalf, which is the first step to splitting them. The free scan is at https://gold.safeguard.sh/scan.
Quick check
Can transactional mail include a promotion?
Google's guidance says not to mix content types in one message, so keep promotions out of receipts and resets.
Do I need separate IPs on day one?
Not always. Start with separate From addresses and subdomains, then separate IPs as volume justifies it.
Sources
Last reviewed: 19 October 2026.
