Sending transactional emails from your apex domain puts your company-wide email deliverability on the line every time an app sends a receipt or password reset. In this guide, you will configure dedicated MX and SPF records for a subdomain inside Namecheap BasicDNS or PremiumDNS, isolating your application traffic while keeping your root mailbox completely untouched.
I recently moved an internal ticketing app from root notifications to support.myproject.com. The app was blasting hundreds of automated alerts each day. Mixing those notifications with regular Google Workspace executive email resulted in intermittent spam filtering. Separating them into an isolated subdomain fixed the delivery issues immediately.
Why You Should Route Subdomain Email Separately
When you send emails from notifications.example.com instead of example.com, receiving mail transfer agents (MTAs) like Gmail and Outlook calculate your sender reputation on that subdomain independently. If an automated script sends an invalid batch of messages that bounce, your main office inbox on example.com won’t get blacklisted.
DNS handles subdomains as discrete zones. However, many developers assume that subdomains inherit records automatically. They don’t. An MX record on example.com does nothing for an inbound message addressed to user@billing.example.com. The receiving server looks up MX records specifically for billing.example.com. If none exist, some servers fall back to the subdomain’s A record, but most modern mail systems drop or reject the message outright with an NDR (Non-Delivery Report).
If you already configured your apex records by following how to set up Namecheap Private Email MX, SPF, and DKIM records, you already know the basics of DNS records. Applying those same concepts to a subdomain requires one major adjustment: understanding how Namecheap handles the Host field.
The Namecheap Host Field Gotcha
The single most common mistake on Namecheap DNS is entering the fully qualified domain name (FQDN) into the Host input box. On standard BIND zone files, you might write out mail.example.com. with a trailing dot. Namecheap does not work that way.
In Namecheap Advanced DNS, the system automatically appends your root domain to whatever string you place in the Host field. If your root domain is example.com and you type mail.example.com into the Host field, Namecheap creates a record for:
mail.example.com.example.comThat double-domain bug will cause every DNS lookup to fail with an NXDOMAIN error. To target mail.example.com, enter only the prefix mail in the Host column. Namecheap appends the rest behind the scenes.
If you run your website on an external host while managing DNS on Namecheap, you might also want to review our guide on how to create a subdomain on Hostinger with Namecheap DNS to keep your web records organized alongside your mail records.
Step 1: Add Custom Subdomain MX Records
Log in to your Namecheap dashboard, click Domain List, find your domain, and click Manage. Navigate to the Advanced DNS tab. Scroll down to the Mail Settings section first.
By default, Namecheap shows a drop-down menu in Mail Settings with options like No Email Service, Namecheap Private Email, and Custom MX. When setting up email routing for a subdomain, leave that main Mail Settings dropdown alone if you already use it for your apex domain. Instead, add your subdomain MX records manually under the Host Records table.
Click Add New Record inside the Host Records section. Select MX Record from the dropdown.
- Type: MX Record
- Host: Enter your subdomain prefix (for example,
notifyorapp). - Value: The mail exchange server provided by your email host (for example,
inbound.postmarkapp.comorsmtp.google.com). Do not put an IP address here; MX records require a hostname. - Priority: Set according to your provider instructions (typically
10). - TTL: Set to
Automaticor5 minwhile testing.
If your provider requires multiple MX hosts for redundancy, add each one as a separate record with identical Host values but different Priorities and Values:
Type: MX Record | Host: app | Value: mx1.subdomain-mail.com | Priority: 10
Type: MX Record | Host: app | Value: mx2.subdomain-mail.com | Priority: 20Save each record by clicking the green checkmark.
Step 2: Craft an Isolated SPF TXT Record
The Sender Policy Framework (SPF) tells recipient mail servers which IP addresses and mail platforms are permitted to send email on behalf of your domain. According to RFC 7208 Section 2.4, SPF records do not fall back to the apex domain. If an email arrives from orders@app.example.com, the recipient server evaluates the TXT record on app.example.com. If that record does not exist, the check returns None, rendering SPF validation useless.
To authorize your sending service, add a new TXT record specifically tied to your subdomain host. In the Namecheap Host Records section, click Add New Record.
- Type: TXT Record
- Host:
app(use the exact prefix chosen for your MX record) - Value:
v=spf1 include:spf.sendgrid.net ~all(adjust the include mechanism based on your transactional mail provider) - TTL:
Automatic
Here is an example snippet showing the exact raw TXT value you might enter when using Brevo (formerly Sendinblue) or Postmark:
v=spf1 include:spf.postmarkapp.com ~allUse ~all (SoftFail) during your test period. If a legitimate server sends an email that fails the test, receiving servers still accept the message while flagging the header. Once you verify your pipeline in production, you can switch to -all (HardFail) if your organization requires strict enforcement.
Step 3: Configure DKIM for the Subdomain
SPF handles source validation, but modern anti-spoofing checks require DKIM (DomainKeys Identified Mail). DKIM uses public-key cryptography to verify that the message body wasn’t modified in transit. You can read the full DKIM specification on the IETF RFC 6376 documentation.
Your mail provider will supply a DKIM selector and a public key, usually formatted as a CNAME or a TXT record. Here is where the Namecheap Host field catches people off guard again.
If your provider asks you to add a DKIM selector named pm._domainkey for your subdomain app.example.com, the target name is pm._domainkey.app.example.com. On Namecheap, strip the apex domain. Enter this in the Host field:
pm._domainkey.appIf your provider uses CNAME-based DKIM (like AWS SES or SendGrid), configure it like this in Namecheap:
- Type: CNAME Record
- Host:
s1._domainkey.app - Value:
s1.domainkey.u1234567.wl.sendgrid.net. - TTL:
Automatic
If they provide a raw 2048-bit RSA public key, choose TXT Record, enter s1._domainkey.app into the Host box, and paste the public key string into the Value field:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0b...Step 4: Align DMARC Policies
DMARC ties SPF and DKIM together. Unlike SPF, DMARC does support inheritance. If you already have a DMARC record on your apex domain (_dmarc.example.com), the receiving MTA will apply that policy to subdomains unless the subdomain defines its own policy, or unless the root policy contains the sp (subdomain policy) tag.
If your apex DMARC policy is set to strict reject:
v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.comThat p=reject applies to app.example.com automatically. If your subdomain email fails SPF or DKIM alignment, receivers will discard the email. If you want a relaxed policy for testing on your subdomain without modifying your root domain’s security, add an explicit DMARC record for the subdomain:
- Type: TXT Record
- Host:
_dmarc.app - Value:
v=DMARC1; p=none; sp=none; rua=mailto:dmarc-reports@example.com - TTL:
Automatic
Setting p=none allows you to receive aggregate reports and identify missing authentication headers without risking dropped transactional emails.
Testing Your DNS Setup with Dig and NSLookup
After clicking save in Namecheap, wait about 60 to 180 seconds. While Namecheap propagates changes rapidly, local resolver caches can take a few minutes. Open your terminal and test the records directly against public resolvers like Google (8.8.8.8) or Cloudflare (1.1.1.1).
To inspect your subdomain’s new MX records, run:
dig @1.1.1.1 app.example.com MX +noall +answerYou should see an answer section returned in the terminal looking like this:
; <> DiG 9.10.6 <> @1.1.1.1 app.example.com MX +noall +answer
app.example.com. 300 IN MX 10 inbound.postmarkapp.com.Next, query your subdomain’s SPF TXT record:
dig @1.1.1.1 app.example.com TXT +shortThe output should display your SPF string wrapped in quotes:
"v=spf1 include:spf.postmarkapp.com ~all"Finally, check that your DKIM record resolves properly by pointing dig at your specific selector:
dig @1.1.1.1 pm._domainkey.app.example.com TXT +shortIf any of these commands return an empty line, query Namecheap’s authoritative nameservers directly (such as dns1.registrar-servers.com) to see if Namecheap has committed the record to its zone file. If the authoritative server returns nothing, check your Host field for typing mistakes.
A Real Gotcha: SPF 10-DNS-Lookup Limit on Subdomains
When I first set up email routing for a client’s staging subdomain, delivery broke with a 550 5.7.26 SPF PermError. The email log showed that SPF evaluation exceeded the maximum allowed DNS lookups.
The client had copied their root domain’s SPF record directly to the subdomain. That root record included Google Workspace, Zendesk, Salesforce, and Mailchimp. Because SPF allows a maximum of 10 nested DNS queries, all those nested includes hit the limit before the subdomain’s actual mail server was parsed.
To fix this, keep your subdomain SPF record lean. Authorize only the single service that sends mail from that specific subdomain. If app.example.com only sends messages through Postmark, your SPF record needs only Postmark:
v=spf1 include:spf.postmarkapp.com ~allDo not include Google Workspace or other root office tools unless users are actively logging into webmail to send messages from that exact subdomain address. Keeping it focused eliminates SPF evaluation timeouts and keeps your DNS responses lightweight.
If you also route standard inbound mail to external inboxes without paying for separate mailboxes, check our guide on Namecheap free email forwarding to Gmail for apex configuration tips.
Frequently Asked Questions
Can I use Namecheap’s built-in Mail Settings menu for a subdomain?
No. The dropdown under “Mail Settings” on Namecheap (Private Email, Gmail, Custom MX) only configures records for the root domain (@). For subdomains, add all MX and TXT records as discrete entries in the Host Records table above the Mail Settings panel.
Do I need an A record for my subdomain if it only handles email?
No. You do not need an A or CNAME record pointing to a web server if the subdomain is used purely for mail transport. Mail delivery relies on MX records. However, some older mail filters perform a reverse check on the sender domain’s A record; adding an A record pointing to your application or landing page does no harm and improves compatibility.
Will changing subdomain MX records disrupt my main business email?
Not at all. Because DNS treats the subdomain as an independent hostname, your apex MX records (pointing to Google Workspace, Microsoft 365, or Namecheap Private Email) will operate without interruption. Only mail addressed specifically to @subdomain.example.com uses the new route.
What happens if I don’t set an MX record for the subdomain?
If a subdomain sends an email but has no MX record, receiving mail servers may attempt to fall back to the subdomain’s A record (known as MX fallback). If no A record exists or the IP does not accept SMTP traffic, outbound mail will fail deliverability checks on providers that require a return-path host capable of receiving bounce notifications.
Next Steps
Now that your subdomain has functional MX and SPF routing on Namecheap, make sure to monitor your sender reputation using Google Postmaster Tools. If your application resides on another host, you can also review our walkthrough on how to configure Namecheap Private Email MX on Hostinger nameservers when managing DNS across hybrid providers.
