A subdomain or a completely separate domain?

A subdomain, in almost every case. It keeps the brand recognisable in the From address, which matters to recipients, and receivers treat it as its own reputable entity. An unrelated domain buys a little more isolation and costs you the recognition that helps people decide the mail is genuine.

Does the subdomain need its own DKIM records?

Yes. Each subdomain is its own domain here, with its own records to publish and its own verification. That separation is the entire mechanism: shared records would mean a shared identity, which is what you are trying to avoid.

How long does warming take?

Longer than a day and shorter than a quarter, and anybody who gives you a precise number is guessing, because it depends on your volume, your list quality and which receivers your recipients use. Increase gradually and watch your complaint and bounce rates rather than following a fixed schedule.

I run two brands. Is that the same question?

It is a related one with a clearer answer: two brands should send from their own domains, because recipients recognising the sender is the point. Workspaces keep the contact data and consent separate, and separate domains keep the reputations separate too.

Deliverability

Separate subdomains for marketing and transactional mail

At real volume, marketing and transactional mail want separate subdomains so that receivers score them separately. At low volume, splitting makes both worse. Here is where the line sits and how to cross it safely.

Read this if you send meaningful marketing volume and also send mail people need, like receipts and password resets. Skip it if you are early: one domain is the right answer and this guide will talk you out of the split.

Why the split exists

Receivers build a reputation for the domain that signs your mail, and that reputation is one number applied to everything signed the same way. Marketing mail and transactional mail earn very different reactions: a campaign gets ignored, deleted unread and occasionally reported as spam, while a password reset gets opened within seconds because somebody is waiting for it. Sign both with the same domain and the campaign's reception is part of what decides whether the reset reaches the inbox.

Splitting them means verifying a second domain, normally a subdomain such as news.yourdomain.com, and sending marketing from there while transactional stays where it is. Each subdomain is its own domain in Sending and Domains, with its own DKIM records to publish, so receivers score the two streams independently. A bad week on the marketing subdomain stays on the marketing subdomain.

The failure this prevents is specific and it is not hypothetical: a promotional send that draws complaints degrades a shared reputation, and the first thing anybody notices is support tickets about password reset emails going missing. The mail that matters most is the mail that has the least tolerance for a delay, and it is the mail nobody thinks about until it stops.

Why one domain is better until it is not

Reputation is earned per domain, and a new domain has none. Splitting divides whatever history you have across two identities and starts the second from nothing, which at low volume is strictly worse than staying put: neither subdomain accumulates enough signal to be trusted quickly, and you have doubled the DNS you have to keep correct.

So the ordering matters more than the decision. Send from one authenticated domain until your marketing volume is large enough and regular enough that it clearly has a reputation of its own. Split when the marketing stream is big enough to hurt the transactional one, not in anticipation of a day when it might be.

How to split without breaking the mail that matters

The whole risk of this operation is on the transactional side, so the rule is that transactional mail never moves. It keeps the domain that already has a reputation, and marketing goes to the new one.

01 Add the marketing subdomainAdd news.yourdomain.com in Sending and Domains, or over the API, and publish the DKIM records it returns. It is a separate domain with separate records; authenticating the parent does not authenticate it in a way that gives it its own reputation.
02 Create a sender identity under itA verified domain with no identity still cannot send. Create the From address you want marketing to come from, under the new subdomain.
03 Move MARKETING first, and only marketingPoint campaigns, bulk sends and marketing-typed templates at the new sender. Leave every transactional send exactly where it is. If something goes wrong here, the blast radius is a campaign, which is recoverable.
04 Warm it graduallyStart with your most engaged recipients and increase volume over days rather than switching your whole list at once. A cold domain that suddenly sends a large campaign looks exactly like a domain that has been compromised, because that is what a compromised domain does.

The one thing never to do

Never put authentication mail on a cold domain. Password resets, login codes and verification links are the mail with the least tolerance for a spam folder, and a brand-new domain is precisely where mail is most likely to land in one. If you are going to move transactional mail at all, it moves last, long after the new domain has a history, and it moves to a domain that has been sending successfully for weeks.

In practice this means the split is almost always one-directional: marketing leaves, transactional stays. If you find yourself planning to move receipts onto a fresh subdomain to keep things tidy, the tidiness is not worth what it risks.

What SendHeron separates regardless

Splitting domains is a decision about how receivers see you. Several things are already separated inside the platform whether you split or not, and they cover the failure modes people usually reach for a second domain to solve.

The two streams run on separate sending infrastructure and are reported separately, so a complaint spike on a campaign is visible as a campaign problem rather than buried inside one combined number.
Suppression is tiered. An unsubscribe blocks marketing only, and it never stops a receipt or a password reset, so somebody leaving your newsletter does not lose access to their account.
Pausing marketing never pauses transactional. If sending is halted for reputation reasons, the mail people are waiting for keeps moving.
Transactional links are not rewritten through click tracking, so a reset link does not depend on a redirect being up. Marketing gets both the open pixel and the click wrapping; transactional gets only the pixel. The marketing rewrite is signed: the redirect carries a signature over the destination it was built for, so it will only ever forward a reader to the address we signed and cannot be reused to point anywhere else.

When this does not apply

Do not split if your marketing volume is small or irregular, and do not split as a first move when deliverability is already bad. A split divides a weak reputation into two weaker ones. If mail is landing in spam today, fix authentication and list hygiene on the single domain first, because those are almost always the actual cause and they are cheaper to correct.

Questions

A subdomain or a completely separate domain?: A subdomain, in almost every case. It keeps the brand recognisable in the From address, which matters to recipients, and receivers treat it as its own reputable entity. An unrelated domain buys a little more isolation and costs you the recognition that helps people decide the mail is genuine.
Does the subdomain need its own DKIM records?: Yes. Each subdomain is its own domain here, with its own records to publish and its own verification. That separation is the entire mechanism: shared records would mean a shared identity, which is what you are trying to avoid.
How long does warming take?: Longer than a day and shorter than a quarter, and anybody who gives you a precise number is guessing, because it depends on your volume, your list quality and which receivers your recipients use. Increase gradually and watch your complaint and bounce rates rather than following a fixed schedule.
I run two brands. Is that the same question?: It is a related one with a clearer answer: two brands should send from their own domains, because recipients recognising the sender is the point. Workspaces keep the contact data and consent separate, and separate domains keep the reputations separate too.