Managing client sending domains across different ESPs

Agency sending has one structural requirement: nothing a client does should be able to damage another client, or you. That means a separate sending identity per client at the DNS level and at the platform level, plus per-client visibility so you can prove which account caused a problem. Everything else is workflow.

Isolate at the domain, not at the campaign

Reputation attaches to domains, subdomains and IPs. Campaign tags, lists and folders are invisible to receivers. So isolation has to be structural:

• Client's own domain, dedicated subdomain. Ask for mail.clientdomain.com or send.clientdomain.com rather than the bare corporate domain. The client's invoices, recruiting mail and support replies then cannot be affected by the campaigns you run.
• Separate DKIM selector per platform sending for that client, so you can retire one without touching the other.
• DMARC on the organisational domain with rua= pointed at an inbox you monitor. Watch the sp= tag: a strict policy with no subdomain policy applies to your new subdomain too, which is usually right but will break any sender you forgot to authenticate.
• Never cold-send from your agency's own domain on behalf of a client. One complaint spike then hits every client's mail and your own.

Platform-level isolation, product by product

Subusers on SendGrid and configuration sets on SES are the two most under-used features in agency setups. Without them, suppression lists and event data are pooled, and you lose the ability to answer "which client's list caused this".

Make the DNS handover survivable

Most agency deliverability incidents start as DNS incidents. Reduce the surface:

1. Send the client a single list of records with exact names and values, and say which host they are for. Mixing a Cloudflare screenshot with a GoDaddy record set is how a CNAME ends up as k1._domainkey.clientdomain.com.clientdomain.com.
2. Check SPF before adding an include. The 10-DNS-lookup limit is per record, and an agency adding a third include to a client's existing SPF is a common way to produce a permerror that breaks every sender at once. Count the lookups first; flatten or move the stream to a subdomain with its own SPF record if you are near the limit.
3. Never publish two SPF TXT records on one name. Two records is a permanent failure, not a merge.
4. Verify with a received message. Read Authentication-Results for spf=, dkim= and dmarc= and confirm header.from alignment, rather than trusting the platform's verification badge.
5. Record who holds DNS access per client, because you will need it again within a month.

Reporting that holds up in a client meeting

Per client, per month: authentication status, bounce and complaint rate, per-provider inbox placement, blocklist status for the domain and sending IP, and daily reputation trend for each mailbox. The useful framing is a trend plus the one thing that changed, not a score. When placement drops the week after a new list import, the import is the story.

Keep each client's placement grid split by provider. "Gmail fine, Microsoft 365 in Junk" is a specific, fixable finding; an averaged percentage is not.

Offboarding, which almost nobody documents

When a client leaves, do all of it:

• Remove your SPF include and DKIM CNAMEs from their DNS, or you keep the ability to send as them.
• Delete or suspend the subuser, configuration set, server or domain on the platform.
• Revoke OAuth grants and delegated mailbox access from their side, and confirm it.
• Export the suppression list and hand it over. It is their data and it protects their next agency.
• Stop warm-up on their mailboxes so you are not generating traffic on a domain you no longer monitor.

What not to do

• Do not run many clients under one shared sending domain to save setup time.
• Do not rotate throwaway domains per campaign. Receivers score domain age and consistency; churn reads as evasion.
• Do not start a new client's campaign on a domain registered that week. Warm it first, then ramp.
• Do not use one dedicated IP across several clients. Their complaint rates merge, and you cannot separate them again.
• Do not promise a placement percentage. Placement is a measurement, not a deliverable.

MailPilot is built for this shape of work: every plan includes unlimited mailboxes, so adding another client's domain costs nothing extra, and each mailbox gets its own warm-up, SPF/DKIM/DMARC check, daily reputation score and per-provider inbox placement measurement. Mailboxes connect over OAuth for Gmail and Outlook, or over SMTP and IMAP for SendGrid, Amazon SES, Mailgun, Postmark and custom SMTP, which covers most mixed client estates.