Start here: authenticate the transactional subdomain
The cleanest entry point into this category is the anchor authentication guide — it walks through the three protocols every transactional subdomain has to publish before the first send leaves the pipeline, and the alignment rules every mailbox provider will check the first message against.
Check your transactional auth stack in 30 seconds
The free SPF/DKIM/DMARC validator runs an instant DNS lookup against the transactional subdomain and tells you which arm is failing and why.
Run the free validator →SPF, DKIM, and DMARC for transactional mail
Mailbox providers apply the same authentication bar to transactional mail that they apply to bulk marketing — Gmail and Yahoo have made SPF, DKIM, and DMARC mandatory for any sender shipping roughly 5,000 or more messages per day to their users, and Microsoft applies equivalent checks on the Outlook.com side. A transactional sub-domain that skips DMARC, or that uses a 'From:' domain which does not align with the DKIM d= domain, gets the same 550 5.7.X bounce as a marketing stream. Walk through the full protocol stack and run the validator that confirms your records are clean before the first password reset ships.
Dedicated IP vs shared IP for transactional sending
A dedicated IP is the safer default once transactional volume exceeds a few hundred thousand messages per month — marketing and transactional mail have different sending cadences, different list-quality profiles, and different mailbox-provider expectations, and a marketing-driven complaint event on a shared IP will quietly drag down the inbox placement of every password reset, receipt, and shipping notification sent from the same address. Read the shared-IP risk case, the bounce-recovery checklist when a contaminated IP history shows up, and the DNS posture a dedicated IP has to publish before its first send.
Complaint-rate thresholds at Gmail and Outlook
Gmail applies a hard spam-rate threshold to transactional senders at 0.1% — sustained above that level the domain gets throttled, and once it crosses 0.3% the Postmaster Tools domain reputation score drops from High to Low within a single reporting window. Outlook.com shows the same shape through the Microsoft SNDS filter-color band and the JMRP complaint feed. Read the exact thresholds, how to interpret the Postmaster chart, and how the inbox-placement work in the cold-outreach guide ties into a transactional stream.
Blocklist remediation for transactional senders
If your transactional IP or sending domain lands on Spamhaus, Cisco Talos, Barracuda, SenderScore, or SORBS — even once — every password reset and receipt starts seeing the same 550 access-denied responses on the next send. A single blocklist hit can take a fresh transactional stream out of the inbox before it even gets warm. Diagnose the hit, run the two free validators that check the major lists in parallel, and walk the delisting workflow that gets the IP back into rotation.
Transactional warm-up
Even transactional sub-domains need a warm-up ramp. Mailbox providers do not distinguish 'transactional' from 'bulk' at the domain layer — they score engagement signals — and a brand-new sub-domain that suddenly starts sending password-reset and order-confirmation emails at 800 per day looks identical to a low-reputation bulk sender until its engagement history builds up. Read the day-by-day schedule, the signals to slow down, and where a transactional sub-domain fits inside the broader warm-up picture.
List-Unsubscribe headers for transactional mail
Gmail and Yahoo require a working List-Unsubscribe header plus a List-Unsubscribe-Post: List-Unsubscribe=One-Click action header that complies with RFC 8058 on any sender approaching the 5,000-per-day bulk threshold — and a header without the matching -Post action is treated as non-compliant. Receipts and account alerts still need both, even though the recipient did not subscribe in the marketing sense, because the bulk-sender rules apply to message volume and sender identity rather than to message intent. Read the exact header spec and tie it back to the broader Gmail bulk-sender checklist.