Email deliverability and sending domains

What it does

Domain authentication publishes DNS records that tell receiving mail servers the client has authorised Customer Insights - Journeys to send on behalf of their domain. Without it your From address gets rewritten to a Microsoft-owned domain with no reputation, and your mail lands in spam or nowhere.

Key facts

Four DNS records per domain: one TXT for ownership verification, two CNAME records for DKIM (CNAME1 and CNAME2), and one CNAME to align the Envelope-From / Return-Path for SPF. The wizard gives you copy buttons; use them, because a mistyped record fails with a message that doesn't tell you which character is wrong.
If an existing CNAME at the apex blocks the ownership TXT, publish it at the dynmktown.<domain> subdomain instead — dynmktown.contoso.com for contoso.com, dynmktown.mail.contoso.com for mail.contoso.com.
Root domains and subdomains are authenticated separately. Authenticating contoso.com does nothing for news.contoso.com.
Authenticate the domain exactly as it appears after the @ in the intended From address. Authenticating www.contoso.com gets you [email protected], which nobody wants.
Every new environment ships with an instance domain and dyn365mktg.com pre-authenticated. They exist so the trial works. They carry no reputation and are not connected to the client's brand.
Setting a default sending domain means new emails automatically adopt an authenticated From address, and an unauthenticated one gets rewritten to <account>@<authenticated-domain>. Set it under Settings > Default marketing settings.
The go-live error check blocks an email whose From address sits on an unauthenticated domain, so this fails late if nobody handled it early.
Domains are registered for a use case: email sending, form hosting, or both. Forms and form prefill do not require domain authentication — that's a separate allowed-domains list.
With modernised business units enabled, the wizard adds a Business unit lookup and an Enable across organizations checkbox that decides whether the domain is shared or restricted to that unit.
Bulk sender requirements (Gmail and Yahoo, in force since February 2024) bite above roughly 5,000 messages a day: authenticated domain, working one-click unsubscribe with the List-Unsubscribe-Post: List-Unsubscribe=One-Click header, and a spam complaint rate held under 0.30% as measured by Google Postmaster Tools. Never send bulk from a gmail.com or yahoo.com From address.
Platform bounce tolerance is up to 8% before sending gets suspended and the sender notified. The industry expectation is under 2%, and that's the number to design towards.
Warm-up takes 4 to 8 weeks. Microsoft's guidance is to start with subscribers who opened or clicked in the last 30 days, widen to 60 days in weeks three and four, avoid anyone dormant for 90-plus days for the first six weeks, and add volume in increments of around 15% of current volume. Throughput guidance tops out around 500,000 emails per day per journey.

When to use / skip

There's no skip. Domain authentication is a hard prerequisite for any real send, and it's the item most likely to be sitting with a DNS team you have no access to. Raise it in the first workshop, not the week before go-live.

The warm-up is the part clients try to skip, usually because they're migrating from another ESP and assume reputation travels with them. It doesn't — reputation attaches to the sending infrastructure as much as the domain, and a cold start at full volume gets you throttled by exactly the providers you care about.

Configuration decisions

Which domain or subdomain sends marketing mail. A dedicated marketing subdomain isolates reputation from corporate mail, which is worth real money if a campaign ever goes wrong.
Which authenticated domain becomes the default sending domain, and therefore what unauthenticated senders get rewritten to.
Whether the existing SPF record gets the include: for the Dynamics sending domain, or whether Envelope-From alignment via the CNAME is sufficient on its own.
DMARC policy at the client end — Microsoft's wizard covers DKIM and SPF, but bulk sender compliance needs a DMARC record and somebody has to own the p= value.
Per business unit or shared across the organisation, if modernised business units are in play. This is set at domain registration.
The warm-up schedule: which engaged cohort goes first, at what volume, and who is watching bounce and complaint rates week by week.

Gotchas

DNS propagation means verification can fail immediately after the records are added and succeed an hour later. People assume the records are wrong and start editing them.
The ownership TXT and the DKIM CNAMEs are separate failures — the wizard tells you which record didn't resolve, and that message gets skimmed.
Authenticating the domain doesn't authenticate its subdomains, and the reverse. Clients who send from three subdomains need three registrations.
One-click unsubscribe won't render in Gmail or Yahoo for non-bulk mail, or for domains those providers don't yet trust. A missing button in your inbox test is not proof it's misconfigured — check the headers.
Bounce suppression is silent from the marketer's point of view. Addresses that hard bounce stop receiving mail and the segment count doesn't change, so "we sent to 50,000" and "50,000 were attempted" diverge quietly.
421 responses are retried for up to 72 hours, so a delivery problem during warm-up shows up as unexplained lag rather than a clear failure.
Trial and proof-of-concept content built against the instance domain carries that From address forward when it's promoted. Check every email, not just the new ones.

Consultant notes

Get the DNS request raised in week one with the exact records attached. It's a two-minute change for a DNS admin and a three-week wait if it goes through a ticket queue.
Tell the client plainly that the first six weeks are a warm-up, not a campaign. Set the volume plan as a delivery artefact and get marketing to sign it.
Recommend Google Postmaster Tools on day one — the 0.30% complaint threshold is measured there and it's the only view you'll get of Gmail's opinion of the client.
Before go-live, check the From address on every live and draft email against the authenticated domain list, and confirm the default sending domain isn't still the instance domain.
Push back hard on importing a purchased or long-dormant list into the first send. That's the fastest route to the 8% bounce suspension and it takes weeks to recover from.

Worth another look if the bulk sender thresholds move again, or if dedicated IP options appear.