subdomains are not sufficient, unfortunately. I think the instance I'm thinking of is technically web/https (chrome's site safety feature where you can specify a domain as 3rd party content- so when something gets flagged uour entire domain doesn't get blacklisted)- but it's much easier to just grab another domain

I think the point is that subdomains are fine, assuming you ARE using a separate IP address for said subdomains.

The majority of my spam from established companies are on subdomains of their main domains. Are they doing it wrong?