Routiq Labs · domain day
Everything worth doing on the day you buy a domain, in the order you should do it. None of it is hard. All of it is annoying to retrofit once something is live and people are already using the old address.
If you commented DOMAIN, this is the full list. The reel gave you the first three. Part II is the half it left out, and it is the part that decides whether your email arrives.
Part I — Domain day
The first three are the ones from the video. Four and five are the bonus everybody asked for in the comments.
01
www.yoursite.com for the marketing site. app.yoursite.com for the actual app.
Why: They get rebuilt on different days by different tools. Splitting them on day one means neither deploy can take the other down.
CNAME www → your host
02
notify.yoursite.com for no-reply and password resets. mail.yoursite.com for marketing.
Why: A marketing blast that gets spam-flagged drags down the reputation of whatever sent it. Keep it away from the address that sends password resets.
two subdomains, verified separately
03
yoursite.com/sitemap.xml, listing every page you publish.
Why: It's how Google finds pages nothing links to yet. Costs nothing and most frameworks generate it for you.
/sitemap.xml
04
Choose yoursite.com or www.yoursite.com and 301 the loser to the winner.
Why: Otherwise Google sees two copies of the same site and splits the credit between them.
301 redirect
05
Sits next to the sitemap. Points at it, and tells crawlers what to skip.
Why: Keeps admin routes, staging and search pages out of the index. One file, four lines.
/robots.txt
Part II — The half the video left out
Three records, one afternoon, and the difference between a password reset arriving and quietly not.
A subdomain does not send email. It does not protect anything either. These three records are what make step 02 real, and without them your password resets land in spam.
“Who is allowed to send as me?”
Lists the servers permitted to send from your domain. Your email provider gives you the exact value.
The gotcha: You may only have ONE SPF record per domain. Two is not stricter, it is broken, and mail providers will fail both. If you add a second sender, merge it into the existing record.
“Was this actually sent by them, unmodified?”
A cryptographic signature on every message. Your provider gives you two or three CNAMEs to paste.
The gotcha: It is per sending service. Adding a second provider later means adding its DKIM records too, or that provider's mail starts failing while the first keeps working.
“What should happen when the first two fail?”
The policy, published at _dmarc.yoursite.com. Also the only one that reports back to you.
The gotcha: Start at p=none with a reporting address. It changes nothing and shows you who is already sending as you. Only move to quarantine, then reject, once the reports are clean. Going straight to reject on day one is how people silently kill their own invoices.
The DMARC ramp
p=none
Week 1
Nothing is blocked. Reports tell you every source sending as you, including the ones you forgot.
p=quarantine
Once reports are clean
Failures go to spam instead of the inbox. Recoverable if you got something wrong.
p=reject
The destination
Failures are refused outright. Nobody can spoof you, and you cannot afford a mistake in the records.
Part III — The list
Twelve items. The right-hand column is what it costs you to skip it, which is the only reason any of them are worth doing today rather than eventually.
| Do this | When | If you skip it |
|---|---|---|
| Turn on registrar auto-renew | Minute one | You lose the domain to a squatter over a lapsed card. |
| Turn on WHOIS privacy | Minute one | Your home address is in a public database, and the spam calls start within a day. |
| Decide where DNS lives | Before any record | Records added at the registrar while the host is authoritative do nothing at all. This is the single most common wasted hour. |
| Drop TTL to 300s | While you're changing things | A typo takes 24 hours to fix instead of five minutes. Put it back up afterwards. |
| www + app subdomains | Day one | Migrating a live app onto a subdomain later means breaking every link. |
| notify + mail subdomains | Day one | Marketing reputation and transactional reputation become the same thing. |
| SPF, DKIM, DMARC on each sender | Same hour you create them | Password resets land in spam and you blame the code. |
| Verify the domain with your email provider | Before the first send | The first campaign goes out unauthenticated, which is the worst possible first impression to a mailbox provider. |
| Pick canonical, redirect the other | Day one | Duplicate content, split ranking. |
| sitemap.xml + robots.txt | Day one | Slow indexing, and staging pages showing up in search. |
| Force HTTPS | Day one | Mixed-content warnings and a browser telling visitors you're not secure. |
| Set a calendar reminder for expiry | Day one | Auto-renew fails silently more often than anyone admits. |
Part IV — The five
Every one of these looks like it worked at the time. That is what makes them expensive.
yoursite.com is the one thing you can never rebuild reputation for. Send from notify. and mail. and keep the root clean.
Added a second provider, added a second record. Both now fail. Merge them into one.
It feels responsible. It silently rejects your own invoicing tool, your CRM and whatever else you forgot was sending as you.
The records save, look correct, and do nothing. Check the nameservers before you touch anything.
A brand new sending domain has no reputation. Ramp over a couple of weeks, or you get filtered before anyone reads one.
While we’re being honest
Routiq sends everything from one address on noreply@routiq.ai. Seven different email types, transactional and lifecycle, all on the same subdomain. I tell clinics to split notify. from mail. and I have not finished doing it myself. It is on the list, and it is the reason I know exactly what it costs to leave.
Next
Nine jobs every app has, and what to run for each one: the starter stack, the self hosted version, and what it becomes at 10,000 users. Including which email tool goes on the subdomains you just made.