Yes, if the email says who sent it and the registration tells the truth. None of the US, UK, EU, Canadian or Australian rules I read cares whether you send from your main domain or a secondary one, and consent rules apply as they always did. In the US, the criminal line for the domain itself is the registration: under 18 U.S.C. § 1037, knowingly registering two or more domains under a false identity, then sending more than 100 commercial emails a day from them, carries up to a year in prison, and up to three once a day’s volume passes 2,500.
Every email infrastructure build we run starts with sending domains that are not the client’s main one, so the company domain is never at risk. That puts the legal question on every build, and the answer is rarely about the domain.
The domain is not the disguise. A false registrant is.
Key numbers
| Item | Number |
|---|---|
| Domains registered under a false identity, 18 U.S.C. § 1037 (plus multiple commercial emails sent from them) | 2 or more |
| Email accounts registered under a false identity, same rule | 5 or more |
| Emails that count as multiple under § 1037 (in 24 hours, or 1,000 in 30 days, or 10,000 in a year) | More than 100 |
| Maximum prison term, base case (or a fine, or both) | 1 year |
| Volume that raises the maximum to 3 years (in 24 hours, or 25,000 in 30 days, or 250,000 in a year) | More than 2,500 |
| Falsified domain registrations that raise it to 3 years | 10 or more |
| Maximum if the offence furthers a felony or repeats one | 5 years |
| FTC civil penalty per violating email | $53,088 |
| Daily volume that brings Gmail’s stricter sender rules | 5,000 |
| Australia: days sender contact details must stay valid (Spam Act, section 17) | 30 |
Read on 12 October 2026: 18 U.S.C. § 1037 and 15 U.S.C. §§ 7702 and 7704 on Cornell LII, the FTC’s CAN-SPAM compliance guide, Gmail’s email sender guidelines and section 17 of Australia’s Spam Act 2003 on AustLII.
The mistake: judging the domain, not the registration
It is tempting to judge the domain, as if getyourbrand.com beside yourbrand.com looked like hiding. The laws read the email and the record behind it. A secondary domain registered to your company, sending email that names your company and gives its postal address, tells every reader who sent it. One registered under a placeholder name tells them nobody did, and that is the version the US criminal statute goes after.
A placeholder registrant, a persona in the From line, no address in the footer.
Sending over 100 emails a day from two or more domains registered under a false identity is a crime under 18 U.S.C. § 1037.
Your company as registrant, your brand in the domain, a real person signing, your postal address.
That answers the identity question in every law I read for this piece.
What CAN-SPAM reads in the header
CAN-SPAM defines header information to include “the originating domain name and originating electronic mail address.” The FTC’s guide turns that into the rule: your From, To, Reply-To and routing information, “including the originating domain name and email address,” must be accurate and identify the person or business who initiated the message. Each email that breaks the law can cost up to $53,088.
Nothing there says main domain. It says identify, and a From line that “accurately identifies any person who initiated the message” gets a safe harbour.
Header information that is technically accurate still counts as materially misleading if it includes a domain name the access to which was obtained “by means of false or fraudulent pretenses or representations.” So a domain bought under a false identity can taint every email it sends, before any criminal question. With the valid physical postal address every commercial email must carry, a truthfully registered secondary domain passes the Act’s identity tests.
Where a secondary domain becomes a crime
CAN-SPAM also added a criminal provision, 18 U.S.C. § 1037, and its fourth paragraph reads as if written about sending infrastructure. It covers anyone who knowingly registers, “using information that materially falsifies the identity of the actual registrant,” five or more email accounts or two or more domain names, and intentionally sends multiple commercial emails from any combination of them. The FTC’s guide names the same conduct, “using false information to register for multiple email accounts or domain names,” as carrying criminal penalties, including imprisonment.
Multiple means more than 100 emails in 24 hours, more than 1,000 in 30 days or more than 10,000 in a year. The base penalty is a fine, up to a year in prison, or both. The maximum rises to three years if, among other things, the case involves 10 or more falsified domain registrations or 20 or more falsified account registrations, or if the volume exceeded 2,500 emails in 24 hours, 25,000 in 30 days or 250,000 in a year, and to five years if the offence furthers a felony or the defendant has a prior conviction for this kind of conduct.
Gmail’s sender guidelines set stricter requirements for senders of 5,000 or more messages a day to Gmail accounts. A team at that volume is already twice past the statute’s 2,500 line, so the registrations are the part left to get right. And to pass DMARC, the same guidelines say, the domain that authenticates a message must be the domain in its From header: the secondary domain is the one Gmail checks.
Materially falsified is wider than a fake name: registration information counts if it is “altered or concealed” in a way that would impair a recipient, an internet access service, a person alleging a violation or law enforcement from identifying, locating or responding to the sender. Whether a registrar’s privacy service meets that test, the statute does not say. I would not volunteer to find out: register in the company’s legal name.
Outside the US, the test is identity
The rules below are written around identity, with one Canadian exception.
In the UK, regulation 23 of PECR bars marketing email “where the identity of the person on whose behalf the communication has been sent has been disguised or concealed.” Unlike the consent rule in regulation 22, which applies only to individual subscribers, it reaches a B2B email to a company address. Article 13(4) of the EU’s ePrivacy Directive says marketing email that disguises or conceals the sender’s identity “shall be prohibited” in any event.
Canada’s CRTC regulations require every commercial electronic message to name the business sending it, and any business it is sent for, say which is which, and give a mailing address plus a phone number, email or web address. The Competition Act makes a false or misleading representation in an electronic message’s sender information reviewable conduct, and an offence when done knowingly or recklessly. A separate subsection does the same for a representation in a locator, which the Act defines to include a URL: the only rule outside the US I read that reaches the address itself.
Australia’s Spam Act, section 17, requires the message to clearly and accurately identify the individual or organisation who authorised the sending, with contact details likely to stay valid for at least 30 days. Switzerland’s Unfair Competition Act lists failing “to indicate the correct sender” of mass advertising as unfair; our Switzerland cold email guide covers it.
Whether you may email the person at all is a separate question; I covered it in which cold email law applies to you.
Four moves before you buy the next domain
Register every sending domain to the business that sends
Use the company’s legal name and a contact address someone reads. When an agency buys domains for a client, put them in the client’s name and registrar account, so the record matches the email. The ownership side of that question is in how to choose a lead generation agency.
Make the domain point home
Pick a variation of your brand, not a name that could belong to anyone, and redirect it to your main site, so a recipient who types it into a browser lands on you. If you are still sizing the setup, start with how many domains and inboxes you need.
Sign as a real person, with the address under the name
Put a real employee in the From line and the company name and postal address in the signature. CAN-SPAM requires the address in every commercial email, and a USPS box or a registered private mailbox counts. Made-up personas raise their own problem, which I covered in AI SDR disclosure.
Keep a register of every domain you send from
One sheet: domain, brand, registrant, registrar account, date bought and the mailboxes on it. When anyone asks who sent an email from one of your domains, the answer should take one look.
The bottom line
A secondary domain is a sending address, not a disguise. Buy it in your company’s name, point it at your main site and sign as a real person. The registration is the part a federal statute attaches a prison term to. It is also how we build email infrastructure for clients: separate sending domains so the main one is never at risk, paid directly to the vendors so the client owns every asset. I am not a lawyer; this is what the texts said when I read them on 12 October 2026.