Series Edition: Section 2 - Authentication Protocols “Your Emails' Identity Crisis”

Your Emails Need an ID Card

SPF, DKIM, DMARC Explained (Without the Jargon)

Here’s an example: You write the ideal email. It has everything. You have a good copy and good design. You send it to 50,000 recipients. Gmail blocks your email.

Why?

Because you didn’t verify your identity.

This is called authentication, and you must do it.

The Trust Problem

These days, ISPs (Internet Service Providers: Gmail, Yahoo, Outlook, et al.) do not trust anything by default. The first thing they want to ask about an incoming email is whether it is legitimate and whether it really came from whoever the sender claims to be.

And why do they do that? Because spammers are sneaky. They use fake domain names, masquerade as your bank, clone organizations, and send you emails which are supposedly sent "from: [email protected]," whereas they were sent from some shady server located in Russia.

To establish authenticity, ISPs designed a special mechanism that we refer to as an email's ID card and authentication protocols!

But here's how things are different: In February 2024, just two years ago, Gmail and Yahoo implemented this rule. If you're not authenticated, and you're trying to send 5,000 emails per day, they will not be accepted or moved to the junk folder without any consideration for the content. You'll be rejected. And today, in 2026, there are even more severe measures in place. There are no temporary warnings from ISPs anymore. Your emails get immediately rejected.

So if you haven't set this up yet, you have a serious problem right now.

The Three Protocols

There are three authentication systems. They work together like a security team. SPF is your basic ID check. DKIM is your certified signature. DMARC is the enforcement layer.

SPF: The Clipboard

SPF stands for Sender Policy Framework. Here's the simple version: SPF is a whitelist.

You make a list of the servers that are allowed to send emails using your domain name. The email will be passed by Gmail if the email comes from any of those servers. Otherwise, the email will fail.

Imagine a bouncer with a list at the entrance of a nightclub. "Names on the list, come in. Not on the list? Then you can stay outside!"

Now here’s the downside: SPF checks the source only. However, a smart attacker can spoof an email if they know the right server. Yet it is crucial. Every domain need SPF.

DKIM: The Wax Seal

DKIM, which stands for DomainKeys Identified Mail, is tougher to spoof than SPF. This involves digitally signing your message, like stamping a wax seal on an envelope.

Here's how it works: Whenever you send an email, DKIM digitally signs it (this is done automatically by your email provider). Once the recipient gets your email, they authenticate this digital signature and ensure two things: (1) that it is genuinely from you, and (2) that it hasn’t been tampered with since sending.

ISPs consider DKIM very important when evaluating emails. If your email has been DKIM-signed, the ISPs give it priority. On the other hand, if it is unsigned, they are suspicious of it.

Good news: Your email provider takes care of DKIM signing automatically.

DMARC: The Boss

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's the boss of the group. It combines SPF and DKIM and tells ISPs what to do when something goes wrong.

DMARC has two functions:

1. Enforcement: You inform ISPs about what should happen if an email fails SPF and/or DKIM. Should they reject the email? Quarantine it? Or should they simply monitor it?

2. Visibility: Reports come in that will let you know exactly what's going on in your authentication process.

Here's where you have some serious control and insight.

How They Work Together

SPF checks: Is this coming from an authorized server?

DKIM checks: Is this properly signed digitally?

DMARC policy: If either fails, this is your response.

All three work together to create a castle. Basically, you're saying, "Email security is important to me. IISPs can rely on my emails."

If one of them is missing, there is a vulnerability. The ISPs will take advantage of this by using more filtering.

And it must be monitored. You don’t set it up once and leave it alone.

Why ISPs Got Strict

ISPs are overwhelmed with spam. In fact, approximately 46% of email traffic consists of spam. Thus, ISPs are ruthless when it comes to filtering. And one of the first criteria is authentication.

If your email lacks SPF, DKIM, and DMARC authentication protocols, ISPs will instantly assume that you're a spammer. No "maybe" or "possibly." Assume. Because legitimate businesses always authenticate their messages. Professionals don't send unauthenticated emails. Spammers do.

When Google and Yahoo required authentication two years ago, they weren't being jerks. They were saying, "Look, we are overwhelmed with spam. If you want us to consider looking at your message, show us it isn't a scam."

Why ISPs Became a Bouncer

Approximately 46% of all email that is being sent at this very moment is spam. Yeah, about 46%. That's crazy!

Gmail receives 15 billion unsolicited emails EVERYDAY. Yes, you heard right. 15 BILLION!

That is why they decided to tell everyone that “Nobody can be trusted anymore. Everyone must show ID.”

Having SPF, DKIM and DMARC will mean that you are telling Gmail, “I’m here legally and I take security seriously.” Gmail listens to that.

Not having these three means that Gmail treats you as spam. Since only legitimate businesses authenticate emails.

The Death Spiral (This Is What Actually Happens)

1. You fail authentication -> ISPs won’t recognize you

2. ISPs won’t recognize you -> your emails go through filtering

3. Emails are filtered -> people ignore them -> ISPs see low user activity

4. ISPs see low user activity -> they’ll be stricter with filtering next time

5. You’re on the spam permanently -> nothing goes through anymore

And the worst part about it is that the recovery process is long. We’re talking about weeks or even months. You’re going to be struggling against Gmail and Yahoo to get off the spam blocklist. Your reputation is ruined. And even when you do fix the authentication, Gmail’s not going to trust you anytime soon.

But there’s no need for it at all. This is entirely preventable.

Real Talk

If you’re not positive that SPF, DKIM, and DMARC are configured, chances are good they’re not.

Check it right now. Seriously.

Look up “SPF DKIM DMARC checker,” type in your domain, and you’re done in five minutes. If there’s a problem, send an email to your email service provider ASAP. They’ll get it sorted out.

Not done setting them up. Better get started right now. Don’t wait. Do it today. Gmail and Yahoo aren’t playing games.

What You Need to Remember

Authentication is mandatory. This is true for Gmail and Yahoo, which will enforce it by 2026.

No authentication means automatic fraud. ISPs make no exceptions.

There are serious consequences for making mistakes. Loss of income. Reputational damage. Contractor expenses. Support costs. Loss of elections.

It takes time and money to rebuild your reputation. Preventative measures are less expensive than remedial ones.

You need SPF, DKIM, and DMARC, all three.

Next Section

Authentication is the first hurdle that ISPs put up for your emails. They need to confirm that your emails are authentic before looking at anything else.

But there's a second barrier: sender reputation.

Even when emails are perfectly authenticated, ISPs will still question if they should trust the sender by asking: “Are we sure about this sender?” The answer lies in various metrics such as how many users open your email, how often are you reported as spam, your history of sending, and whether you send to invalid email addresses.

We’re kicking off the year with some powerful updates to start your operations and year off right! Here’s what’s new in January:

Subscriber History in Email Subscribers – Gain better insights into your subscribers with a detailed history of their activity, helping you track engagement and interactions over time.

New Email Templates UI – Crafting emails just got easier! Our improved email template interface offers a more intuitive and user-friendly design, making it simpler to create and edit your email templates.

Customizable VIP Approval Emails – Now, you can tailor VIP approval emails to align with your brand’s messaging and tone, ensuring a seamless experience for your exclusive audience.

 Export Failed Rows from Any Import – Encountered issues during an import? No problem! You can now easily export failed rows for quick troubleshooting and corrections, saving time and effort.

Already a nucleus user? Check out this new feature for yourself!

Want to experience these features and the solutions Nucleus can offer your team?

Starting a campaign is exciting—but it can also feel overwhelming. With so many moving pieces, it’s easy to get stuck in the details and lose momentum before you even begin.

Campaign Nucleus helps you launch fast and launch right. Here’s a step-by-step guide to kick off your campaign using our all-in-one platform:

Step 1: Announce Your Candidacy with a Press Release

Let the world know you’re in the race.

Use Campaign Nucleus’s press release tool to quickly draft and distribute your announcement to the media. You can:

· Publish your release directly to your website

· Send it via email and SMS to our pre-vetted Press list

· Track engagement in real time

Step 2: Send an Email to Your Supporters

Now that your campaign is live, it’s time to rally your supporters.

Campaign Nucleus allows you to easily create branded emails and send them to segmented contact lists. Use your first message to:

· Share your candidacy and story

· Link to your donation and volunteer pages

· Invite people to upcoming events

Built-in templates and drag-and-drop design make it easy—even if you’ve never built an email campaign before.

Step 3: Launch Your Campaign Website

No developer? No problem.

Use our drag-and-drop website builder to spin up a professional campaign site in minutes. Add:

· Donation and volunteer forms

· Event listings and social feeds

· Your priorities, bio, and contact info

It’s your digital home base, built to grow with you.

Step 4: Connect Your Fundraising Platform

Whether you're using WinRed, Revv, Anedot, or another tool, Campaign Nucleus integrates seamlessly.

Embed your forms, track donor behavior, and trigger automatic follow-up emails—all while staying compliant and saving time.

Step 5: Set Up Volunteer Training

Supporters are eager to help—so make sure they’re prepared.

With Campaign Nucleus, you can:

· Schedule and manage training sessions

· Invite attendees via email or text

· Track signups and attendance

This ensures your team is informed, on-brand, and ready to take action.

Step 6: Automate & Organize

Once you're live, let the platform handle the busy work:

· Welcome new donors and subscribers automatically

· Assign contacts to follow-up lists

· Send reminder messages for events

Campaign Nucleus helps small teams run like pros, with less manual effort.

🚀 Launch with Confidence

Your launch should be smooth, powerful, and stress-free. With Campaign Nucleus, you get the tools, support, and strategy to build momentum from day one!

DAY 3 · SEPTEMBER 2, 2026

Create reusable review groups, collect clear decisions, protect approved revisions, and keep every sign-off accountable.

For many organizations, writing an email is only the first step. Legal needs to review the language. Leadership needs to approve the message. A candidate, committee, or client may need the final say. When that process lives across long email threads and chat messages, it becomes difficult to know who approved what—and whether the version scheduled to send is the version everyone actually reviewed.

Email Approvals gives campaigns a structured sign-off workflow inside Amplify Emails.

Build approval groups once, then reuse them

Create approval groups for the teams and situations your organization uses most often, such as Legal, Communications Leadership, or Fast Fundraising Review. Each group includes its approvers and its decision strategy.

Choose All when every approver must sign off, Majority when more than half must approve, or Single when one approval is enough. Then select the right group for each campaign instead of rebuilding the review process every time.

Make every response clear

Approvers can choose Approve, Deny, Request Changes, or leave the review Pending. Request Changes is treated as its own status, so feedback does not have to be forced into a denial.

For higher-control workflows, enable Block send if changes. A single Request Changes vote then keeps the campaign from sending until the issue has been resolved—even if the group’s approval strategy has otherwise been met.

Protect the version that was actually reviewed

Approval belongs to a specific campaign revision, not simply to the campaign name. If an approved email is edited, Nucleus opens a new revision and begins a fresh approval round.

This keeps teams from making a last-minute change after sign-off and accidentally sending copy that approvers never saw.

Governance does not have to become a bottleneck

Campaigns can be scheduled while a review is still underway. With autosend enabled, an email that receives approval before its scheduled time will send at that time without requiring someone to return and press another button.

If the scheduled time passes while approval is still open, the campaign is marked overdue so the missed window is visible instead of failing silently.

Keep a complete record of the decision

Email Approvals includes revision deadlines, overdue reminders, email notifications, proxy voting, and an audit trail for every vote. The record can include who voted, when the vote was recorded, notes, browser information, and IP address.

A staff member can also record a proxy vote when needed, with the reason and acting user preserved in the history. At any point, the campaign can be reverted to draft and pulled out of review.

Create a review process your whole team can trust

Email Approvals replaces scattered sign-offs with a clear campaign status, a visible vote sheet, and an approval record tied to the exact revision being sent.