Series Edition: Section 2 - Authentication Protocols “Your Emails' Identity Crisis”

Your Emails Need an ID Card

SPF, DKIM, DMARC Explained (Without the Jargon)

Here’s an example: You write the ideal email. It has everything. You have a good copy and good design. You send it to 50,000 recipients. Gmail blocks your email.

Why?

Because you didn’t verify your identity.

This is called authentication, and you must do it.

The Trust Problem

These days, ISPs (Internet Service Providers: Gmail, Yahoo, Outlook, et al.) do not trust anything by default. The first thing they want to ask about an incoming email is whether it is legitimate and whether it really came from whoever the sender claims to be.

And why do they do that? Because spammers are sneaky. They use fake domain names, masquerade as your bank, clone organizations, and send you emails which are supposedly sent "from: [email protected]," whereas they were sent from some shady server located in Russia.

To establish authenticity, ISPs designed a special mechanism that we refer to as an email's ID card and authentication protocols!

But here's how things are different: In February 2024, just two years ago, Gmail and Yahoo implemented this rule. If you're not authenticated, and you're trying to send 5,000 emails per day, they will not be accepted or moved to the junk folder without any consideration for the content. You'll be rejected. And today, in 2026, there are even more severe measures in place. There are no temporary warnings from ISPs anymore. Your emails get immediately rejected.

So if you haven't set this up yet, you have a serious problem right now.

The Three Protocols

There are three authentication systems. They work together like a security team. SPF is your basic ID check. DKIM is your certified signature. DMARC is the enforcement layer.

SPF: The Clipboard

SPF stands for Sender Policy Framework. Here's the simple version: SPF is a whitelist.

You make a list of the servers that are allowed to send emails using your domain name. The email will be passed by Gmail if the email comes from any of those servers. Otherwise, the email will fail.

Imagine a bouncer with a list at the entrance of a nightclub. "Names on the list, come in. Not on the list? Then you can stay outside!"

Now here’s the downside: SPF checks the source only. However, a smart attacker can spoof an email if they know the right server. Yet it is crucial. Every domain need SPF.

DKIM: The Wax Seal

DKIM, which stands for DomainKeys Identified Mail, is tougher to spoof than SPF. This involves digitally signing your message, like stamping a wax seal on an envelope.

Here's how it works: Whenever you send an email, DKIM digitally signs it (this is done automatically by your email provider). Once the recipient gets your email, they authenticate this digital signature and ensure two things: (1) that it is genuinely from you, and (2) that it hasn’t been tampered with since sending.

ISPs consider DKIM very important when evaluating emails. If your email has been DKIM-signed, the ISPs give it priority. On the other hand, if it is unsigned, they are suspicious of it.

Good news: Your email provider takes care of DKIM signing automatically.

DMARC: The Boss

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's the boss of the group. It combines SPF and DKIM and tells ISPs what to do when something goes wrong.

DMARC has two functions:

1. Enforcement: You inform ISPs about what should happen if an email fails SPF and/or DKIM. Should they reject the email? Quarantine it? Or should they simply monitor it?

2. Visibility: Reports come in that will let you know exactly what's going on in your authentication process.

Here's where you have some serious control and insight.

How They Work Together

SPF checks: Is this coming from an authorized server?

DKIM checks: Is this properly signed digitally?

DMARC policy: If either fails, this is your response.

All three work together to create a castle. Basically, you're saying, "Email security is important to me. IISPs can rely on my emails."

If one of them is missing, there is a vulnerability. The ISPs will take advantage of this by using more filtering.

And it must be monitored. You don’t set it up once and leave it alone.

Why ISPs Got Strict

ISPs are overwhelmed with spam. In fact, approximately 46% of email traffic consists of spam. Thus, ISPs are ruthless when it comes to filtering. And one of the first criteria is authentication.

If your email lacks SPF, DKIM, and DMARC authentication protocols, ISPs will instantly assume that you're a spammer. No "maybe" or "possibly." Assume. Because legitimate businesses always authenticate their messages. Professionals don't send unauthenticated emails. Spammers do.

When Google and Yahoo required authentication two years ago, they weren't being jerks. They were saying, "Look, we are overwhelmed with spam. If you want us to consider looking at your message, show us it isn't a scam."

Why ISPs Became a Bouncer

Approximately 46% of all email that is being sent at this very moment is spam. Yeah, about 46%. That's crazy!

Gmail receives 15 billion unsolicited emails EVERYDAY. Yes, you heard right. 15 BILLION!

That is why they decided to tell everyone that “Nobody can be trusted anymore. Everyone must show ID.”

Having SPF, DKIM and DMARC will mean that you are telling Gmail, “I’m here legally and I take security seriously.” Gmail listens to that.

Not having these three means that Gmail treats you as spam. Since only legitimate businesses authenticate emails.

The Death Spiral (This Is What Actually Happens)

1. You fail authentication -> ISPs won’t recognize you

2. ISPs won’t recognize you -> your emails go through filtering

3. Emails are filtered -> people ignore them -> ISPs see low user activity

4. ISPs see low user activity -> they’ll be stricter with filtering next time

5. You’re on the spam permanently -> nothing goes through anymore

And the worst part about it is that the recovery process is long. We’re talking about weeks or even months. You’re going to be struggling against Gmail and Yahoo to get off the spam blocklist. Your reputation is ruined. And even when you do fix the authentication, Gmail’s not going to trust you anytime soon.

But there’s no need for it at all. This is entirely preventable.

Real Talk

If you’re not positive that SPF, DKIM, and DMARC are configured, chances are good they’re not.

Check it right now. Seriously.

Look up “SPF DKIM DMARC checker,” type in your domain, and you’re done in five minutes. If there’s a problem, send an email to your email service provider ASAP. They’ll get it sorted out.

Not done setting them up. Better get started right now. Don’t wait. Do it today. Gmail and Yahoo aren’t playing games.

What You Need to Remember

Authentication is mandatory. This is true for Gmail and Yahoo, which will enforce it by 2026.

No authentication means automatic fraud. ISPs make no exceptions.

There are serious consequences for making mistakes. Loss of income. Reputational damage. Contractor expenses. Support costs. Loss of elections.

It takes time and money to rebuild your reputation. Preventative measures are less expensive than remedial ones.

You need SPF, DKIM, and DMARC, all three.

Next Section

Authentication is the first hurdle that ISPs put up for your emails. They need to confirm that your emails are authentic before looking at anything else.

But there's a second barrier: sender reputation.

Even when emails are perfectly authenticated, ISPs will still question if they should trust the sender by asking: “Are we sure about this sender?” The answer lies in various metrics such as how many users open your email, how often are you reported as spam, your history of sending, and whether you send to invalid email addresses.

Modern organizations need more than a single email list to effectively engage supporters. Audiences today expect personalized communication, relevant content, and the ability to control what they receive — and organizations need tools that make managing those relationships easier, smarter, and more connected.

That’s exactly what the new Nucleus Email Subscriptions feature delivers.

Built directly into the Nucleus platform, Email Subscriptions gives organizations a modern, flexible, and intelligent way to manage audience communication preferences while keeping everything fully connected to CRM records, segmentation tools, and the email builder.

Move Beyond One-Size-Fits-All Email Lists

Traditionally, many organizations have relied on a single large email list with limited subscriber control. This often leads to generic messaging, lower engagement, and higher unsubscribe rates.

With Nucleus Email Subscriptions, organizations can now create and manage multiple subscription types across:

• Campaign updates
• Events
• Memberships
• Donations
• Volunteer programs
• Website signups
• And more

This allows teams to organize audiences more strategically while delivering communication that feels more relevant and personalized to each supporter.

Smarter Segmentation and Better Campaign Performance

Nucleus Email Subscriptions helps organizations build stronger audience engagement strategies through smarter targeting and cleaner data management.

Teams can now:

• Build more targeted and personalized email campaigns
• Reduce unsubscribe rates by giving users more control
• Automatically enroll supporters into relevant communication categories
• Segment audiences based on interests, actions, engagement, and signup source
• Keep subscriber preferences synced across CRM, email, and audience tools in real time
• Improve campaign performance through more intelligent audience targeting

Because subscription preferences are directly tied into the broader Nucleus ecosystem, organizations gain better visibility into supporter engagement while eliminating disconnected workflows and manual workarounds.

A Better Experience for Supporters

For end users, Email Subscriptions creates a significantly better communication experience.

Instead of being forced into all-or-nothing email lists, supporters can now choose exactly what types of communications they want to receive. Whether someone only wants event updates, volunteer opportunities, donation campaigns, or organizational news, Nucleus gives them the flexibility to manage their preferences more easily.

This level of transparency and control helps organizations build stronger trust with their audiences while improving long-term engagement.

Fully Connected Across the Nucleus Ecosystem

One of the biggest advantages of Nucleus Email Subscriptions is that every subscription action is fully logged, synced, and connected directly to the broader platform ecosystem.

That means organizations no longer need disconnected third-party subscription tools or complicated manual processes to maintain accurate audience data.

Everything works together seamlessly across:

• CRM records
• Audience segmentation
• Email campaigns
• Website signups
• Automation workflows
• Supporter engagement tracking

The result is stronger operational efficiency, cleaner audience management, and more intelligent communication workflows at scale.

Building Stronger Relationships Through Smarter Communication

The launch of Nucleus Email Subscriptions represents a major step forward for campaigns, nonprofits, advocacy groups, and organizations looking to improve how they engage supporters.

By combining flexible subscription management with real-time CRM syncing and advanced segmentation capabilities, organizations can now deliver more relevant communication, strengthen supporter relationships, and build smarter engagement strategies directly within Nucleus.

Smarter audience management starts with giving both organizations and supporters more control — and Nucleus Email Subscriptions is designed to do exactly that.

Ready to ditch the one-size-fits-all email list?

By Julia, Deliverability Expert

At Nucleus, we understand that it can be hard to put a schedule on hard-hitting news. But, did you know that utilizing consistency in your email practices can actually help to improve your sender reputation?

The WHY:

By remaining uniform in certain areas of your email sending, you allow yourself to become more recognizable to both the recipients & the server. This makes it much more likely for recipients to remain engaged in your email content.

The HOW:

Some ways we can apply this method are as follows:

Through the years, we’ve made plenty of improvements and updates to our batching system & with that, I think it’s time for a little review session…

First, we’ll review how to set-up a batch. Then, we are going to review our Nucleus-recommended scaling technique. And lastly, we’ll put your skills to work and run through some examples. Let’s begin!

Set-Up

At the top, we have our selections concerning ‘batch size.’ While I do occasionally see a reason to utilize the ‘percentage’ or ‘remainder’ function (hence its existence), I find that the ‘fixed’ batch size is easiest to manage when warming a new domain, so I recommend taking that route. Below your selection, you can identify the exact volume of recipients you’d like to send to.

Your ’schedule’ is used to determine how each individual batch will be initiated. I generally base this decision off personal comfort and need.

Manual entails the individual sending of each campaign by a user following the campaign launch.

Start means the batches will begin with the start of the campaign – this is likely the easiest option for users.

Delayed would allow you to set times for the batches to be released following the launch of the campaign.

In our ‘reoccurring’ section, you can implement a reoccurrence of batches. I generally do not recommend using the ‘repeat’ selection while warming a new domain/IP as this can affect our reputation, but when it is utilized, I recommend not exceeding more than one send in a 24-hour period.

In order for the batch to send, you will have to set your ‘Status’ to ‘ready’ as it is automatically placed in ‘draft.’

Finally, you can select the email servers that you’d like to include or exclude from your batch. I find that it is easiest to have an individual batch for every server; this allows you to monitor deliverability in the most efficient manner possible.

For more information, contact our team for training or insight and visit your Nucleus Resource Library!

OR