Separate Resend transactional and marketing mail with dedicated sending subdomains

Split transactional and marketing mail into two sending streams

1. Decide on two sender subdomains, for example mail for transactional and news for marketing. Never send marketing from your root domain if it also receives mail; a subdomain keeps the root reputation clean.
2. Add the transactional subdomain in the Resend dashboard first and complete DNS verification (SPF, DKIM, DMARC) before sending anything from it. Docs: https://resend.com/docs/add-a-domain
3. Add the marketing subdomain the same way. Both streams need DMARC published or Gmail and Yahoo will throttle bulk mail.
4. In your app, route every send through a helper that picks the from address by email type: order confirmations, password resets, and receipts go out from the transactional subdomain; newsletters, launches, and promos go out from the marketing subdomain.
5. Create one API key scoped to the transactional domain and a second scoped to the marketing domain (domain_id on key create). If the marketing key is ever rotated or paused, transactional mail keeps flowing.
6. Warm the marketing subdomain up on the new-domain ramp before any large campaign; transactional volume can start on the normal cadence because it is expected mail. Docs: https://resend.com/docs/knowledge-base/warming-up
7. Check that complaints stay under 0.08% and bounces under 4% per stream. If marketing spikes, transactional delivery is unaffected because the streams have separate reputations.
8. Verify by sending one test mail from each subdomain and confirming in the dashboard logs that each shows the expected from domain and authentication passes.

Verified against the Resend email-types and subdomain-vs-root-domain docs on 2026-09-26: separate subdomains per stream keep reputation isolated, both streams need SPF, DKIM, and DMARC, and domain-scoped API keys limit each key to one sending domain.