Why would adding one service break all my mail?

Because the ten-lookup limit applies to the whole sender policy. If one more include pushes it over, evaluation errors for every message checked against it, not just the new service's.

Do I need to add the service to SPF at all?

Often not for DMARC: if the service signs with a DKIM key under your domain, that alone produces an aligned pass. Adding an include that cannot align only spends lookups.

Should marketing mail use a subdomain?

It is a reasonable default. It keeps its reputation separate, gives it its own sender policy and lookup budget, and still aligns with your domain in relaxed mode.

Questions

What should I check before adding a new email sending service?

Before a new service sends mail as your domain, check three things: that authorising it in your sender policy will not push the policy over its ten-lookup limit, that the service can sign with a DKIM key published under your domain so its mail aligns, and what your DMARC policy will do to its mail if either is missing. Getting the order wrong means the new service's mail — or, worse, all your mail — starts failing authentication on the day it is switched on.

The lookup limit you may already be near

A sender policy may trigger at most ten DNS lookups when evaluated, counting every include and every nested include inside it.

Each sending service is usually added as one include, and large providers' includes contain several lookups of their own.

A policy already authorising a mail provider, a CRM and a help desk is frequently close to the limit before anything is added.

Crossing it produces a permanent error for every message evaluated against the policy — not just the new service's.

So count the lookups the policy triggers today before adding anything, rather than after mail starts failing.

Alignment, which decides whether the service helps or hurts

Most services send with their own bounce domain by default, so SPF passes for them rather than for you and does not align.

Alignment therefore usually has to come from DKIM: the service signs with a key published under your domain, at a selector it tells you.

Services that support this call it a custom or authenticated domain; the records they ask you to publish are the DKIM key and sometimes a bounce subdomain.

A service that can only sign with its own domain will not produce aligned mail, and under an enforcing DMARC policy its messages will be rejected or quarantined.

Which is the question to ask before choosing the service, not after.

What your DMARC policy will do in the meantime

Under a monitoring policy, unaligned mail from the new service is delivered and reported, which gives you time.

Under quarantine or reject, it is filtered or refused from the first message.

If your policy enforces, publish the DKIM record and confirm it validates before the service sends anything real.

Aggregate reports show the new source appearing, and whether it passes, within a day or so of sending.

A subdomain policy tag can set different treatment for subdomains, which matters if the service sends from one.

Sending from a subdomain instead

Giving bulk or marketing mail its own subdomain keeps its reputation separate from the mail your staff send.

The subdomain gets its own sender policy, so the main domain's lookup budget is untouched.

It needs its own DKIM key and falls under the organisational domain's DMARC policy unless it publishes its own.

Alignment in relaxed mode still works, since a subdomain aligns with its organisational domain.

The cost is a slightly different From address, which is usually acceptable for automated mail.

The order that avoids losing mail

Count the current sender policy's lookups, and decide whether the service goes on the main domain or on a subdomain.

Publish the DKIM key the service provides, and confirm it is retrievable at the selector the service names.

Add the service to the sender policy only if needed for alignment or for receivers that check it, and recount.

Send a test message and read its headers for the SPF, DKIM and DMARC verdicts.

Watch the next aggregate reports for the new source before sending to a real list.

When a service is retired

Remove its include from the sender policy, which returns lookups to the budget.

Remove its DKIM key, since an abandoned key is one more thing that can be misused.

Remove any verification or bounce records it asked you to publish.

An unmaintained policy full of services nobody uses is the usual reason a domain sits at the lookup limit.

Frequently asked questions

Why would adding one service break all my mail?: Because the ten-lookup limit applies to the whole sender policy. If one more include pushes it over, evaluation errors for every message checked against it, not just the new service's.
Do I need to add the service to SPF at all?: Often not for DMARC: if the service signs with a DKIM key under your domain, that alone produces an aligned pass. Adding an include that cannot align only spends lookups.
Should marketing mail use a subdomain?: It is a reasonable default. It keeps its reputation separate, gives it its own sender policy and lookup budget, and still aligns with your domain in relaxed mode.

Sources

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website