When transactional mail fails, the product fails
For a SaaS product, email is part of the login flow. A verification code that lands in spam is a sign-up that never activates. A password reset that never arrives is a support ticket, and often a churned customer. Invoices and dunning emails that miss the inbox turn into failed renewals. None of this shows up in your error tracker, because from your application's side the message was sent successfully.
That is why deliverability belongs next to uptime monitoring. Your status page can be green while a third of new users at Outlook never see their confirmation code.
Common causes in SaaS setups
- Shared domain reputation. Product emails and marketing newsletters sent from the same domain, so a campaign that collects complaints drags down password resets.
- SPF over 10 lookups. A transactional provider, a marketing ESP, a help desk, a CRM and Google Workspace in one record often exceed the RFC 7208 limit, and receivers return permerror.
- DKIM key rotation. A provider rotates keys or a new subdomain launches without a DKIM record, and DMARC starts failing.
- Abuse through your own product. Trial accounts used to send spam through invite or share features, which lists your sending domain or IP.
- A dedicated IP without warm-up or without a correct PTR record.
How to separate transactional and marketing mail
The most effective structural fix is separation. Send product emails from one subdomain, for example mail.example.com, and marketing from another, such as news.example.com, each with its own DKIM keys and, ideally, its own sending stream at your provider. Both stay aligned with DMARC on the organizational domain, and a bad campaign no longer threatens the login flow.
- 1 List every system that sends email as your domain, using DMARC reports rather than memory.
- 2 Move product email to its own subdomain and set up DKIM for it at your transactional provider.
- 3 Keep SPF on each subdomain short, with only the providers that send from it.
-
4
Publish DMARC at
p=nonewith a rua address, fix anything unaligned, then move toquarantineandreject. - 5 Monitor each subdomain separately, so an alert points to the right stream.
Run a free check on your own domain or IP, then keep it monitored.
Check NowWhat monitoring watches for a SaaS team
Alerts go to Slack and email on every plan, and to Teams and signed webhooks from Business up, so a listing can page the same on-call rotation as an outage. On Scale, the REST API lets you pull status into your own dashboards. Every check is a DNS lookup, and nothing is ever sent from your domain by us.
| Signal | Why it matters for product email | Alert example |
|---|---|---|
| Blacklists on 109 lists | Listed domains and IPs get codes rejected | Domain listed on Spamhaus DBL |
| SPF, DKIM, DMARC | Failures move resets and codes to spam | SPF permerror after adding a provider |
| DMARC sources | Shows abuse and unknown senders | New source sending 2,000 messages as your domain |
| Gmail spam rate | Rules apply to your whole domain | Spam rate above 0.1 percent |
| Inbox placement | Proves codes reach the inbox | Outlook placement dropped since last test |
Rules from Gmail, Yahoo and Outlook apply to you too
Google and Yahoo's February 2024 rules count all mail from your domain toward the bulk sender threshold of about 5,000 messages a day, transactional included. Bulk senders need SPF, DKIM, an aligned DMARC record, valid reverse DNS and a spam rate under 0.3 percent, ideally under 0.1. One-click unsubscribe applies to marketing mail, not to password resets. Microsoft introduced similar authentication rules for high volume senders to Outlook.com in May 2025.
If you are not sure where your setup stands, run the free email deliverability test or check your record with the SPF checker.
Which plan suits a SaaS product
Most SaaS teams start on Business at $149 a month ($74 billed yearly): 100 domains and IPs every 15 minutes, webhooks and Teams, sender source discovery, DMARC reports up to 1,000,000 messages a month, reputation signals and 50 inbox placement tests. Platforms that send on behalf of their own customers, or run many dedicated IPs, move to Scale for CIDR ranges, the REST API, SSO and priority support with a named contact. Read more about DMARC monitoring if spoofing of your login emails is the main concern.
Frequently asked questions
Why are my password reset emails going to spam?
Usually because the sending domain fails SPF, DKIM or DMARC alignment, shares reputation with marketing mail, or is listed on a blacklist. Check authentication first, then reputation in Google Postmaster Tools and Microsoft SNDS.
Should transactional and marketing emails use separate domains?
Yes, at least separate subdomains with their own DKIM keys and sending streams. This keeps a complaint-heavy campaign from hurting sign-up and reset emails.
Do Gmail bulk sender rules apply to transactional email?
Transactional mail counts toward the volume threshold and must meet the authentication and spam rate rules. One-click unsubscribe is only required for marketing and subscribed messages.
How do I get alerted when transactional email deliverability drops?
Monitor your sending domains and IPs for blacklist listings and authentication changes, connect Postmaster Tools for spam rate, and route alerts to the same channel as your uptime alerts through Slack, Teams or a webhook.
Can someone abuse my SaaS to send spam from my domain?
Yes, through invite, share or notification features that let users put their own text in emails. DMARC reports and blacklist alerts are often the first sign of it.