Subdomain strategy

Every TLS certificate a company issues is published in public certificate-transparency logs, so its hostnames are a public map of how it is built. We pulled those names for 33 competitors and probed up to 150 per domain on 5 October 2026 (scoreboard). They show two things. The architecture behind the marketing claims. And a search asset most competitors underuse: the help centre, which answers the "how do I…" queries that buyers and AI assistants ask.

#What the cert logs reveal

EmailBison sells one instance per customer. EmailEngine is Postal Systems' source-available IMAP/SMTP-to-REST gateway, licensed at $1,450 a year (Open source in cold email, Build costs and team). 49 of 55 responding EmailBison hosts serve its default page. That fits EmailBison's own claim that "each customer receives a dedicated network cluster" (EmailBison). If our 150-host sample is representative, the certificate count approximates the number of customer instances. 698 is an upper bound, since one customer can hold "overflow" and "custom" hosts. The EmailBison teardown found three hosts that redirect to an agency's own branded login, which suggests white-label resale.

ReachInbox and Zapmail share an architecture. Both run numbered ee, ee2 … shards (48 and 96), each with one public EmailEngine page. That fits a connector layer built on EmailEngine and sharded at a few thousand mailboxes per instance, the scaling unit Postal Systems itself describes (Sending architecture). Same naming, same vendor and same shard pattern suggest a shared engineering lineage. We have not confirmed common ownership.

Smartlead runs regional API endpoints. GraphQL, webhook and realtime hosts sit under ten AWS region labels, from us-east-1 to eu-central-1 and ap-south-1. That fits its scale (Smartlead) and is the part of its stack an entrant would take longest to match.

#Help centres: the SEO asset most competitors underuse

Help articles answer concrete, high-intent questions ("how to connect Outlook to X", "why are my emails bouncing"), and AI assistants quote them. We fetched each help centre's home page and sitemap.

Three takeaways:

• Smartlead's help centre barely exists for search engines. The Notion-hosted site lists 23 URLs, and its server-rendered HTML carries Notion's generic product description ("A collaborative AI workspace…") instead of Smartlead's. The 40-page /smartlead-101/ course on the main domain partly makes up for it.
• Reply.io hides its help centre on purpose, and Clay hides its GitBook support site. Both give up the "how do I" long tail.
• Intercom is the default (9 of the 16 we identified), because it ships indexable, localisable articles with sitemaps. Developer docs have converged on Mintlify (Instantly, Salesforge, Clay, lemlist, EmailBison and Reply.io API docs), which also generates llms.txt (llms.txt, pricing.md and AI crawlers).

#Other subdomain types

#Subdomain or subfolder

Google has published no rule that subdomains rank worse. The vendors' own moves show which way they think it goes. Content keeps moving into the main domain: blog.hunter.io, blog.lemlist.com, blog.smartreach.io, blog.warmy.io and blog.lavender.ai all redirect into /blog/. Woodpecker moved its Intercom help centre to /help-center/. Amplemarket moved its university into a subfolder. Instantly runs a Ghost blog but serves it at instantly.ai/blog/, and its robots.txt disallows /blog/ghost/ (the CMS admin path). The working rule across the market: apps, APIs, docs and status on subdomains; anything meant to rank in a subfolder.

#What this means for an entrant

• Launch the help centre in a subfolder, from day one, indexable. Intercom or Help Scout at /help/ costs nothing extra and beats Smartlead's Notion page and Reply.io's hidden centre. Write the 100 articles a multi-client agency needs (client workspaces, reply routing, per-country rules) before the 1,000 everyone else writes.
• Put developer docs on Mintlify (or similar) with llms.txt and an OpenAPI spec. It is the market's standard, and it is what coding agents read (API, webhooks and MCP).
• Keep staging out of certificate logs. Use a wildcard certificate for non-production hosts, require auth on every staging host, and never let a test. copy be crawled.
• If you sell per-customer instances, don't name hosts after customers. EmailBison's cert log is effectively a customer list. Use opaque IDs plus customers' own CNAMEs (White-label and agency portals).
• Publish an EU trust centre (sub-processors, data location, DPA, AVV in German) on a trust. host or /trust. It is a procurement document for German buyers and a reason to choose an EU vendor (EU-native compliant outbound).
• Read your rivals' cert logs every quarter. New hostnames (an mcp. host, a new region, a white-label pattern) show up months before a launch post.