Agency email management requires: per-client domain isolation (never share sending domains between clients), dedicated SMTP credentials per client, independent [authentication](/email-authentication/email-authentication-guide) (SPF/DKIM/DMARC per domain), reputation monitoring per domain (Google Postmaster Tools), and a standardized onboarding process. The critical rule: if Client A's sending damages their domain, Client B must be completely unaffected. This requires infrastructure isolation at the domain level — not just separate campaigns.
Agency Email Management: Client Deliverability at Scale
Agency Architecture
Agency SMTP Infrastructure
├── Single Provider Account (Mailgun/Postal/SendGrid)
│ ├── Client A: marketing.clienta.com (isolated domain + credentials)
│ ├── Client B: marketing.clientb.com (isolated domain + credentials)
│ ├── Client C: marketing.clientc.com (isolated domain + credentials)
│ └── ... (unlimited domains)
├── Monitoring Layer
│ ├── [Google Postmaster Tools](/monitoring-analytics/google-postmaster-tools-guide) (per client domain)
│ ├── HetrixTools (blacklist monitoring for sending IPs)
│ └── n8n (automated alerting + dashboard)
└── Campaign Platform
├── GoHighLevel (sub-account per client)
├── OR: ActiveCampaign (per-client accounts)
└── Each sub-account → uses client-specific SMTP credentials
The Isolation Principle
Why isolation matters: A single client sending to a purchased list can trigger blacklisting. Without isolation, every client on your infrastructure suffers.
Domain isolation: Each client's domain has independent reputation. Client A's domain gets blacklisted → only Client A is affected.
IP isolation (optional): At high volume per client (50K+/month), dedicate IPs per client. At lower volume, shared IPs with domain isolation is sufficient.
Credential isolation: Each client's GHL sub-account uses its own SMTP credentials linked to its own domain. One client's compromised credentials don't affect others.
Onboarding Process (Standardize This)
Client Onboarding Checklist (30-60 minutes)
1. Domain Setup (10 minutes)
- Choose sending domain (marketing.clientbrand.com or clientbrand.com)
- Add domain to SMTP provider (Mailgun/Postal)
- Generate SMTP credentials for this domain
2. DNS Configuration (15 minutes — client/IT action) Send client these records to add:
- SPF:
v=spf1 include:[provider-spf] -all - DKIM: [CNAME/TXT records from provider]
- DMARC:
v=DMARC1; p=none; rua=mailto:[email protected] - Tracking:
links.clientdomain.com CNAME [provider tracking]
3. Platform Configuration (10 minutes)
- Enter SMTP credentials in client's GHL sub-account
- Configure From: address ([email protected])
- Test: send test email, verify SPF/DKIM/DMARC pass
4. Monitoring Setup (5 minutes)
- Add client domain to Google Postmaster Tools
- Add client sending IP to blacklist monitoring
- Document credentials in agency credential management
5. Warmup (Ongoing)
- Start warmup plan (GHL warmup guide)
- 50-100 emails/day Week 1, increasing over 3-4 weeks
- Monitor at SMTP provider dashboard
Scaling Economics
5 Clients: Managed SMTP
| Option | Cost | Notes |
|---|---|---|
| Mailgun Foundation | $35/mo | Up to 50K total |
| Agency monitoring | $0 | HetrixTools free + manual Postmaster Tools |
| Total | $35/mo |
15 Clients: Self-Hosted Becomes Compelling
| Option | Cost | Notes |
|---|---|---|
| Mailgun Scale | $90/mo | Up to 100K total |
| OR: Self-hosted Postal | $10/mo | Unlimited emails, delivery dashboard |
| Monitoring (n8n) | $5/mo | Automated alerting |
| Total (self-hosted) | $15/mo | Saves $75/mo vs Mailgun |
30+ Clients: Self-Hosted Required
| Option | Cost | Notes |
|---|---|---|
| Mailgun Custom | $175+/mo | 200K+ emails |
| Self-hosted Postal | $15-20/mo | Unlimited |
| Monitoring (n8n) | $5/mo | Automated |
| Total (self-hosted) | $20-25/mo | Saves $150+/mo |
Client Reputation Management
Monthly per-client check (5 minutes per client):
- Postmaster Tools: Domain reputation stable? Spam rate under 0.1%?
- SMTP Dashboard: Bounce rate under 2%? Complaint rate under 0.1%?
- Blacklists: Any listings? (HetrixTools auto-alerts)
- Volume: Consistent? Any spikes?
When a Client's Reputation Drops
- Identify the cause (bad campaign, list import, spam complaints)
- Reduce sending to engaged-only for that client
- If blacklisted: begin delisting while fixing root cause
- Report to client: what happened, what was fixed, prevention measures
- Monitor recovery over 2-4 weeks
When to Fire a Client (Deliverability Edition)
- Repeatedly imports purchased/scraped lists despite warnings
- Refuses to implement engagement-based segmentation
- Consistently generates complaint rates above 0.3%
- Their sending practices risk your shared infrastructure
Protect your infrastructure. One bad client on shared IPs can damage everyone.
Productizing Email Infrastructure
As an agency service offering:
| Service | What's Included | Suggested Price |
|---|---|---|
| Email Setup | Domain auth, SMTP config, testing | $300-500 one-time |
| Email Management | Monthly monitoring, list cleaning, reporting | $100-300/month |
| Full Infrastructure | Setup + management + warmup + optimization | $300-500/month |
| Self-hosted SMTP | Server deployment + ongoing management | $200-400/month |
Infrastructure cost (self-hosted): $15-25/month total. Revenue potential: $5,000-15,000/month across 15-30 clients. Margins: 90%+.
Practitioner note: Per-client domain isolation is non-negotiable. I've worked with agencies that shared one sending domain across 20 clients. One client uploaded a 50K purchased list. The shared domain got blacklisted. All 20 clients' email went to spam. Two weeks of recovery. Three clients left the agency. The cost of that one shortcut was catastrophic.
Practitioner note: Standardize your onboarding. Create a template for DNS records (fill in client domain), a checklist for SMTP setup, and a warmup plan document. With standardization, onboarding a new client takes 30 minutes. Without it, each client is a 3-hour custom project.
If you need agency email infrastructure designed and deployed, schedule a consultation — I build scalable agency email architecture.
Sources
- Mailgun: Multi-Domain Management
- Postal: Multi-Organization Support
v1.0 · March 2026
Frequently Asked Questions
Should each client have their own sending domain?
Yes, always. Each client sends from their own domain (marketing.clientbrand.com) with their own authentication. If one client's list generates complaints, only their domain is affected. Shared domains = shared reputation = shared risk.
Do I need separate SMTP providers per client?
No — one provider account with multiple domains. Mailgun, SendGrid, and self-hosted Postal all support multiple domains per account. Each client domain gets its own SMTP credentials and authentication within your single account.
How do I monitor deliverability across 20+ clients?
Set up Google Postmaster Tools for each client domain. Use n8n automation to check blacklists and aggregate metrics into a dashboard. Check each client's SMTP provider analytics monthly. Automate alerts for reputation drops and blacklistings (HetrixTools free monitors 32 IPs).
What's the most cost-effective architecture for agencies?
Self-hosted Postal ($10/month) for agencies with 15+ clients. Postal's multi-organization support maps to per-client management with delivery tracking. One VPS, all clients, isolated domains. Cost at 20 clients: $10/month total vs $90-275/month on Mailgun.
How do I onboard a new client's email quickly?
Standardize: 1) Add client domain to SMTP provider, 2) Send DNS records (SPF, DKIM, DMARC, tracking CNAME) to client/IT, 3) Create SMTP credentials, 4) Configure in client's GHL/ESP sub-account, 5) Test authentication, 6) Start warmup. With a standard process: 30-60 minutes per client.
Want this handled for you?
Free 30-minute strategy call. Walk away with a plan either way.