Series Edition: Section 2 - Authentication Protocols “Your Emails' Identity Crisis”

Your Emails Need an ID Card

SPF, DKIM, DMARC Explained (Without the Jargon)

Here’s an example: You write the ideal email. It has everything. You have a good copy and good design. You send it to 50,000 recipients. Gmail blocks your email.

Why?

Because you didn’t verify your identity.

This is called authentication, and you must do it.

The Trust Problem

These days, ISPs (Internet Service Providers: Gmail, Yahoo, Outlook, et al.) do not trust anything by default. The first thing they want to ask about an incoming email is whether it is legitimate and whether it really came from whoever the sender claims to be.

And why do they do that? Because spammers are sneaky. They use fake domain names, masquerade as your bank, clone organizations, and send you emails which are supposedly sent "from: [email protected]," whereas they were sent from some shady server located in Russia.

To establish authenticity, ISPs designed a special mechanism that we refer to as an email's ID card and authentication protocols!

But here's how things are different: In February 2024, just two years ago, Gmail and Yahoo implemented this rule. If you're not authenticated, and you're trying to send 5,000 emails per day, they will not be accepted or moved to the junk folder without any consideration for the content. You'll be rejected. And today, in 2026, there are even more severe measures in place. There are no temporary warnings from ISPs anymore. Your emails get immediately rejected.

So if you haven't set this up yet, you have a serious problem right now.

The Three Protocols

There are three authentication systems. They work together like a security team. SPF is your basic ID check. DKIM is your certified signature. DMARC is the enforcement layer.

SPF: The Clipboard

SPF stands for Sender Policy Framework. Here's the simple version: SPF is a whitelist.

You make a list of the servers that are allowed to send emails using your domain name. The email will be passed by Gmail if the email comes from any of those servers. Otherwise, the email will fail.

Imagine a bouncer with a list at the entrance of a nightclub. "Names on the list, come in. Not on the list? Then you can stay outside!"

Now here’s the downside: SPF checks the source only. However, a smart attacker can spoof an email if they know the right server. Yet it is crucial. Every domain need SPF.

DKIM: The Wax Seal

DKIM, which stands for DomainKeys Identified Mail, is tougher to spoof than SPF. This involves digitally signing your message, like stamping a wax seal on an envelope.

Here's how it works: Whenever you send an email, DKIM digitally signs it (this is done automatically by your email provider). Once the recipient gets your email, they authenticate this digital signature and ensure two things: (1) that it is genuinely from you, and (2) that it hasn’t been tampered with since sending.

ISPs consider DKIM very important when evaluating emails. If your email has been DKIM-signed, the ISPs give it priority. On the other hand, if it is unsigned, they are suspicious of it.

Good news: Your email provider takes care of DKIM signing automatically.

DMARC: The Boss

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's the boss of the group. It combines SPF and DKIM and tells ISPs what to do when something goes wrong.

DMARC has two functions:

1. Enforcement: You inform ISPs about what should happen if an email fails SPF and/or DKIM. Should they reject the email? Quarantine it? Or should they simply monitor it?

2. Visibility: Reports come in that will let you know exactly what's going on in your authentication process.

Here's where you have some serious control and insight.

How They Work Together

SPF checks: Is this coming from an authorized server?

DKIM checks: Is this properly signed digitally?

DMARC policy: If either fails, this is your response.

All three work together to create a castle. Basically, you're saying, "Email security is important to me. IISPs can rely on my emails."

If one of them is missing, there is a vulnerability. The ISPs will take advantage of this by using more filtering.

And it must be monitored. You don’t set it up once and leave it alone.

Why ISPs Got Strict

ISPs are overwhelmed with spam. In fact, approximately 46% of email traffic consists of spam. Thus, ISPs are ruthless when it comes to filtering. And one of the first criteria is authentication.

If your email lacks SPF, DKIM, and DMARC authentication protocols, ISPs will instantly assume that you're a spammer. No "maybe" or "possibly." Assume. Because legitimate businesses always authenticate their messages. Professionals don't send unauthenticated emails. Spammers do.

When Google and Yahoo required authentication two years ago, they weren't being jerks. They were saying, "Look, we are overwhelmed with spam. If you want us to consider looking at your message, show us it isn't a scam."

Why ISPs Became a Bouncer

Approximately 46% of all email that is being sent at this very moment is spam. Yeah, about 46%. That's crazy!

Gmail receives 15 billion unsolicited emails EVERYDAY. Yes, you heard right. 15 BILLION!

That is why they decided to tell everyone that “Nobody can be trusted anymore. Everyone must show ID.”

Having SPF, DKIM and DMARC will mean that you are telling Gmail, “I’m here legally and I take security seriously.” Gmail listens to that.

Not having these three means that Gmail treats you as spam. Since only legitimate businesses authenticate emails.

The Death Spiral (This Is What Actually Happens)

1. You fail authentication -> ISPs won’t recognize you

2. ISPs won’t recognize you -> your emails go through filtering

3. Emails are filtered -> people ignore them -> ISPs see low user activity

4. ISPs see low user activity -> they’ll be stricter with filtering next time

5. You’re on the spam permanently -> nothing goes through anymore

And the worst part about it is that the recovery process is long. We’re talking about weeks or even months. You’re going to be struggling against Gmail and Yahoo to get off the spam blocklist. Your reputation is ruined. And even when you do fix the authentication, Gmail’s not going to trust you anytime soon.

But there’s no need for it at all. This is entirely preventable.

Real Talk

If you’re not positive that SPF, DKIM, and DMARC are configured, chances are good they’re not.

Check it right now. Seriously.

Look up “SPF DKIM DMARC checker,” type in your domain, and you’re done in five minutes. If there’s a problem, send an email to your email service provider ASAP. They’ll get it sorted out.

Not done setting them up. Better get started right now. Don’t wait. Do it today. Gmail and Yahoo aren’t playing games.

What You Need to Remember

Authentication is mandatory. This is true for Gmail and Yahoo, which will enforce it by 2026.

No authentication means automatic fraud. ISPs make no exceptions.

There are serious consequences for making mistakes. Loss of income. Reputational damage. Contractor expenses. Support costs. Loss of elections.

It takes time and money to rebuild your reputation. Preventative measures are less expensive than remedial ones.

You need SPF, DKIM, and DMARC, all three.

Next Section

Authentication is the first hurdle that ISPs put up for your emails. They need to confirm that your emails are authentic before looking at anything else.

But there's a second barrier: sender reputation.

Even when emails are perfectly authenticated, ISPs will still question if they should trust the sender by asking: “Are we sure about this sender?” The answer lies in various metrics such as how many users open your email, how often are you reported as spam, your history of sending, and whether you send to invalid email addresses.

What went wrong?

Controllable factors edition.

At the end of the day, there are many factors that we cannot predict or control when sending emails to a high volume of recipients – some examples of this includes if a server blocks you or if you land into an inbox or spam-box.

BUT… you can use “context clues” to help identify potential causes and use controllable factors to attempt to resolve.

Once you have sent your email, there are usually 3 statistics we look into to gauge our success: deliverability rate, open rate, click rate.

And the only true way to test how something will perform is to send it.

A low deliverability rate generally means that we have hit a server block & this is a less controllable factor.

This is a good time to reach out to your Campaign Nucleus team to look into ways of resolving and mitigating any blocks.

A low open rate can mean that are delivering to the server but landing more so in spam and promotional inboxes instead of our primary inboxes & this is a less controllable factor.

BUTTTT it can also mean…

Your recipients are not engaged with your subject line & this is a controllable factor.

This is a good time to make sure we are not using any offensive or triggering terms & to try testing a few different subject lines.

If you see some improvement in your open rate with the new subject lines, you can assume that your audience and the servers preferred this subject line to the other.

If our deliverability and open rate look good, we can go a step further & look into our click rate (which generally leads to ultimate conversions) to get a better idea of how our email content is performing. If we are seeing a high open rate followed by low click rates, it is generally indicative of our recipients not being engaged with the content after clicking into the email.

This is a great opportunity to test different copy & marketing techniques in your emails. If our click rate increases when we use other copy, we can assume that our recipients respond better to that type of content & should use it more moving forward to drive better conversions.

Of course, every once in a while, the stars align and we are presented with high deliverability rates, high open rates, and high click rates - & this means you have a very good email on your hands.

While the servers will never truly confirm or deny reasons for blocking your messages and placing them in spam & your recipients will likely not give you advice on marketing to them better, we can use these three statistics to help to send the best and most effective emails to our recipient list.

For more information regarding how to best understand the email statistics our platform offers, be sure to contact our team!

Making the small talk count

I have mentioned the importance of not solely producing content with a “Call to Action” for your subscribers. These types of requests can range from contributing a donation, making a purchase, signing up or subscribing to pages, joining groups, attending seminars, and so many other things. Sometimes… your recipients just need some validation that they are valued before they contribute anything to your cause.

This type of content is especially important during the warming phases of an email marketing campaign, as it helps retain satisfied recipients and foster stronger relationships. By providing valuable, informational content without a direct call to action, you focus on nurturing the relationship and building trust with your audience, rather than pushing for an immediate conversion. This approach allows recipients to engage with your brand on their own terms, creating a more organic connection and improving brand loyalty, which ultimately helps strengthen your sender reputation and boosts long-term deliverability.

With that in mind, it can be difficult to think of ways to produce this type of content. I am here to help!

Before we begin, it's important to remember that readers typically have a short attention span. This means we should avoid overloading our emails with too much information. Instead, we can break up the content into smaller, easy-to-digest pieces across multiple emails. This not only helps ensure recipients fully absorb the valuable information but also allows you to create a series of emails, which will be useful as you scale up your sending audience during the warming process.

Now… onto the topic of content.

Below, you can find some great prompts to use when creating these value-driven emails:

• Mission Statement
  • What is the primary mission of your organization?
• Financial goals (without asking for contributions)
  • What types of programs/uses are funds allocated to?
• Leading Values
  • If there are multiple values, these can be spread among various emails
• Testimonials/Stories
  • Any related personal stories (i.e. volunteer experiences, funding success, company origins, etc.)
• Company Updates
  • Any recent success or changes within the company
• Newsletters/Educational Resources
  • Informational content that may directly impact your users
• Leadership Introductions
  • Allowing your recipients to be familiarized with your team leaders
• Community Impact
  • Expressing any recent community initiatives and exceptional accomplishments
• Ethical practices
  • Ensuring all subscribers are aware of certain key values and practices
• General Gratitude
  • Simply thank those who have chosen to support your cause thus far

I hope this has given you a bit more insight into how you can leverage different types of emails to drive success, even when you're not focusing on a direct call to action. By strategically using informational and value-driven content, you're able to engage your audience in a way that builds trust, fosters relationships, and keeps them invested in your brand. Remember, sometimes the most powerful emails are the ones that simply inform and educate, allowing you to nurture your audience without the pressure of pushing for immediate action.

For more information, contact our team for training or insight and visit your Nucleus Resource Library!

OR