Should an AI agent send from your own domain?

Usually, yes. Email from your own domain is email people recognise and can reply to, and it’s the only kind your domain’s SPF, DKIM and DMARC records can vouch for. The catch is that mailbox providers judge a domain by all the mail it sends, so an agent that draws spam complaints can hurt delivery for your whole team. Keep the agent on a short leash: approval for new recipients, a daily limit and a pause on complaints. A subdomain of its own makes its mail easier to watch, but doesn’t wall it off. A provider’s shared domain is fine for testing and weak for anything customers see.

What are the choices?

Why does your own domain help?

• People recognise it. An email from acme.com about an Acme invoice looks like what it is. The same email from a domain they’ve never seen looks like phishing, and people are right to treat it that way.
• Replies come back to you. The conversation stays in your business, where your team can see it.
• It can be verified. Only a domain you control can publish the SPF, DKIM and DMARC records that let a receiver check that mail from your address really came from you (how they work). Gmail, Yahoo and Microsoft’s Outlook.com now require them from anyone sending to their users in volume.

What’s the risk?

Mailbox providers decide where mail lands partly on the reputation of the domain it comes from, and that reputation is built from everything the domain sends. When recipients mark an agent’s email as spam, those complaints count against the same domain your team’s invoices, quotes and replies come from. Google asks senders to keep the share of their mail reported as spam below 0.3%, and recommends staying under 0.1%. At low volume, a handful of complaints is enough to cross that.

Bounces matter too: writing to addresses that don’t exist is a sign of a bought or guessed list, which is exactly how an agent behaves when it invents an address.

Subdomain or separate domain?

A subdomain such as agents.acme.com keeps your name in front of recipients and gets mail records of its own: its own MX, SPF and DKIM. DMARC treats it as part of acme.com, so your domain’s DMARC policy covers it unless you give it one of its own. Don’t expect it to wall the agent off, though. Gmail counts a subdomain’s mail toward its parent domain’s volume under its bulk-sender rules, and Google doesn’t say a subdomain keeps a reputation of its own. What a subdomain does give you is a clear view: Google Postmaster Tools can show a subdomain’s mail on its own if you add it, so trouble with the agent’s mail is easier to spot and to switch off.

A separate domain isolates more, at a price: a new domain has no history, so its first emails are treated with suspicion, and a name that looks like yours but isn’t (acme-ai.com, acmemail.com) is a pattern phishing uses. Recipients and filters are right to be wary of it.

For most teams, the main domain or a subdomain with strict sending rules beats a lookalike domain.

When is a shared domain fine?

For trying an agent out, for internal tools, and for mail that only goes to your own team. Not for customers: they don’t know the domain, you can’t set its DMARC policy, and its reputation depends on every other customer of that provider, including the careless ones.

What protects your domain, whichever you pick?

1. Authenticate it. SPF, DKIM and DMARC on the domain the agent sends from, the same as for your team.
2. Approve the first email to anyone new. Spam complaints come from people who didn’t expect to hear from you (human-in-the-loop email).
3. Set a daily limit. A bug or a loop should fill a queue, not an outbox.
4. Pause on the first signs of trouble. A complaint or a few bounces should stop the agent before they become a pattern.
5. No cold email from agents. Use them for mail people expect: replies, follow-ups to people who wrote in, messages to existing customers.
6. Say it’s an AI. People should know who they’re writing to, and in the EU it’s required (what the EU AI Act asks).

How does SuperMailOS handle it?

Agent inboxes use a domain you’ve verified, the same as your team, so their mail carries your domain’s authentication. To keep agents apart, add a subdomain such as agents.yourcompany.com as a domain of its own and give agents addresses there (it counts toward your plan’s domains: 3 domains on Pro, unlimited domains on Business).

Whichever domain an agent uses, one spam complaint, or three bounced addresses, on its mail in 24 hours pauses that agent, sooner than the limits that would pause your workspace, and everyone else keeps sending. Its mail still counts toward your workspace’s own limits, because it goes out under your domains. New recipients wait for a person by default, and every agent has a daily limit (100 emails unless you change it). We don’t offer a shared agent domain. More in the agent inboxes guide.

Sources

• Google, Email sender guidelines, its FAQ, and Postmaster Tools on adding domains and subdomains.
• Yahoo, Sender best practices.
• Microsoft, Outlook’s new requirements for high-volume senders (2025).
• RFC 9989 (May 2026), the current DMARC standard, which replaced RFC 7489: alignment and organizational domains.

Questions