Your organization probably knows who works there.

But do you know exactly who has access to your technology?

That list can be surprisingly different.

Former employees. Contractors. Agencies. Volunteers. Vendors. Consultants. People who changed roles six months ago but still have the permissions they needed in their old job.

Access tends to accumulate quietly. Someone needs access to get something done, so they're added to a platform. Their responsibilities change, the project ends, or they leave—and unless someone actively goes back and reviews those permissions, that access can remain.

That's why one of the simplest questions an organization can ask is also one of the most important:

Who has access to what—and do they still need it?

Access is easy to give. It's harder to keep track of.

Think about how many systems your organization relies on.

Your CRM. Email. Website. Events. Fundraising. Forms. Data. Reporting. File storage. Social accounts. Advertising platforms. Integrations.

Now think about how many people have needed access to those systems over the last year.

Every new employee, campaign staffer, consultant, agency partner, volunteer, or vendor can add another account and another set of permissions to manage.

The problem isn't necessarily giving people access. They need it to do their jobs.

The risk comes when nobody is responsible for reviewing that access later.

Four places access can get messy

1. Employee transitions

When someone leaves an organization, disabling their email account isn't necessarily enough.

They may have separate credentials for your CRM, website, email platform, event system, advertising accounts, data tools, or other technology.

Offboarding should include a clear review of every platform the person could access—not just the systems someone happens to remember.

The same applies when an employee changes roles. Someone who moves from fundraising to communications may no longer need the same permissions they had before.

Good access management isn't only about who works for you. It's about what their current role requires.

2. Too many administrators

Administrator access is convenient.

It's also powerful.

When everyone is an administrator, everyone may be able to change settings, manage users, export information, modify integrations, or perform other high-impact actions.

Most people don't need unrestricted access to do their jobs.

A better approach is simple: give people the access they need to perform their responsibilities—and nothing more.

That limits unnecessary exposure while also making your systems easier to manage.

3. Shared credentials

One username. One password. Five people using it.

It may feel easier, but shared accounts make accountability much harder.

If something changes, who changed it? If the password is shared with a contractor, who remembers to change it when the project ends? If credentials are compromised, how many people and workflows are affected?

Whenever possible, team members should have individual accounts with permissions appropriate to their roles.

That creates clearer ownership and makes access much easier to add, change, and remove.

4. Access that never gets reviewed

Access shouldn't be a "set it and forget it" decision.

Organizations change constantly. People leave. Vendors change. Campaigns end. Projects wrap. Responsibilities shift.

A permission that made perfect sense six months ago might make no sense today.

Regular access reviews give your team a chance to ask:

Does this person still need an account?

Does their current role require this level of access?

Are former employees or contractors still listed?

Are there integrations or third parties that no longer need access?

Who currently has administrator-level permissions?

You don't need to wait for a security problem to ask those questions.

Internal controls matter, too

Managing access isn't only about preventing someone from logging into a system.

It's also about controlling what happens once they're there.

Some actions carry more risk than others. Sending an email to your entire list, changing critical settings, exporting data, publishing content, or modifying important workflows shouldn't necessarily have the same controls as everyday tasks.

That's where permissions and approval processes become important.

A strong digital operation creates appropriate checks around high-impact actions while still allowing teams to work efficiently.

For example, Nucleus Email Approvals can add review and accountability directly into outbound communications. Teams can establish approver groups and determine whether approval requires everyone, a majority, or a single authorized reviewer.

That doesn't slow down communication for the sake of adding another step.

It helps make sure the right people are involved when the stakes are higher.

Make access reviews part of your routine

You don't need an elaborate security program to improve access management.

Start by answering a few basic questions:

• Who currently has access to each critical platform?
• Which users have administrator or elevated permissions?
• Are any former employees, contractors, vendors, or agencies still active?
• Are people using individual accounts rather than shared credentials?
• Do permissions reflect each person's current responsibilities?
• Do you have a consistent process for granting and removing access?
• Are sensitive or high-impact actions protected by appropriate controls?

If some of those answers are difficult to find, that's useful information in itself.

Visibility is the first step toward better control.

The goal isn't more restrictions. It's better access.

Good access management doesn't mean locking everything down until nobody can get their job done.

It's about being intentional.

The right people should be able to access the right tools, data, and capabilities when they need them. And when they no longer need that access, removing it should be just as straightforward as granting it.

That becomes easier when your organization has fewer disconnected systems to manage.

Nucleus brings CRM, communications, events, digital experiences, engagement, data, and other critical organizational functions together in one connected platform. With user permissions, approval workflows, audit logs, and centralized platform controls, teams can create greater visibility into the technology powering their work.

So, who has access to your technology?

If you can't answer that confidently today, now is a good time to find out.

See how Nucleus can help your organization create stronger internal controls and a more connected digital operation.

Email Horror Stories, part 3 of 3

Every ignored unsubscribe becomes a spam complaint, and the complaints are what the providers count.

Part one was the dead list and part two was the cold sender. Part three is the dead coming back to life, because someone unsubscribed and kept getting mail anyway.

Most fundraising teams know they should honor opt-outs. What's harder is knowing how fast to act, and whether the rules reach a campaign or a nonprofit at all. The legal clock and the provider clock aren't the same, and for political senders the legal answer is less obvious than people assume. None of this is legal advice. Where the law is unsettled I say so and flag it for counsel.

Back from the dead

Email Horror Stories, part 2 of 3

A cold sender that suddenly sends big looks exactly like the thing the filters were built to catch.

Last week was about the dead addresses on your list. This week is about the sender. Picture a domain or IP with no history that goes from a trickle to a flood overnight because someone senior decided the deadline was tonight. A mailbox provider can't tell that apart from a spammer who just bought a new domain.

I'm skipping the warm-up how-to, since you've read it already. What follows is what providers do when the spike lands, and which numbers decide whether you come out the other side.

The creature awakens

Email Horror Stories, part 1 of 3

Your list isn't an asset. It's a graveyard, and mailbox providers are the ones who dig things up.

Every program has one: the file nobody wants to touch. The 2019 petition drive. The rented "likely donors" list a vendor swore was clean. The event sign-ins from a conference three cycles ago. It sits in the ESP, it makes the total look big, and the day someone needs volume, it gets mailed.

Then the bounces show up. This post is about why, and what to do before the next send.

The crypt keeper's ledger

DAY 5 · SEPTEMBER 4, 2026

Track signups, ticket sales, and event revenue automatically—and share progress publicly when momentum is part of the message.

Campaign goals often begin with a number: 1,000 petition signatures, 500 event registrations, 200 VIP signups, or $25,000 in ticket revenue. The harder part is keeping that number current and making progress visible to the people who need to act on it.

Goal Tracking brings targets and live progress into Nucleus so your team can spend less time updating spreadsheets and more time moving the campaign forward.

Connect a target to real campaign activity

Create a numeric goal and connect it to a landing page or event. Nucleus can track total form submissions, total event registrations, VIP signups, paid tickets sold, or ticket revenue.

A goal can follow one specific form or event, or it can track every item in that section. Use an All Events goal to measure registrations across a tour, for example, or an All Landing Pages goal to follow total acquisition across a coordinated campaign.

See progress at a glance

The Goals area includes both grid and table views. Goal cards show the current total against the target, percent complete, target date, public-display status, and a direct link to the connected form or event.

The table view adds search, filtering, and sorting across the details your team needs to manage. Goals automatically move to Completed when the current total reaches the target, helping active priorities remain easy to find.

Turn progress into public momentum

When progress itself can motivate supporters, turn on public display to add a progress bar to the connected landing page or event page. The same option is available for event signup pages, VIP forms, and credentialing forms.

A visible goal can create social proof, reinforce urgency, and show supporters that each signup or ticket moves the campaign closer to a shared result.

Start counting from the moment the goal is created

Goal Tracking is forward-looking. Every new goal begins at zero and counts activity that occurs after the goal is created; it does not backfill earlier submissions, registrations, ticket sales, or revenue.

Each goal displays a Counting since date so your team always knows the measurement window. For the clearest reporting, create the goal before launching the campaign or promotion you want to measure.

Make every target visible and actionable

Goal Tracking connects the number your team is working toward with the activity happening across your forms and events. Whether the progress stays internal or appears publicly, everyone can see what has been achieved and what remains.

Goal Tracking arrives September 4 as the final release of Nucleus Release Week. 

Texting is one of the highest-converting channels a campaign has — but only if your messages actually reach a phone. Before you send a single text, you need to register your sending number with the carriers, and campaigns have two main paths to choose from: shortcode and 10DLC. Picking the wrong one can mean delayed launches, throttled messages, or texts that never arrive at all.

Here's how the two compare, and how to figure out which one fits your campaign.

What Is a Shortcode?

A shortcode is a 5-6 digit number (think " 12345") leased directly from the carriers through a shortcode aggregator. It's built for high-volume, one-to-many messaging — the kind of blast you'd send to a large list all at once.

Pros:

• Very high throughput — shortcodes can send tens of thousands of messages per minute
• Strong deliverability once approved, since carriers pre-vet the use case
• Recognizable format that people associate with legitimate bulk sending

Cons:

• Expensive — leasing a shortcode typically runs several thousand dollars a month, plus setup fees
• Slow to launch — carrier approval (via CTIA/aggregator vetting) can take 8-12 weeks
• Overkill for smaller lists or peer-to-peer style outreach

What Is 10DLC?

10DLC stands for "10-Digit Long Code" — essentially a standard-looking phone number that's registered for business (in this case, campaign) messaging through The Campaign Registry (TCR). It's become the default path for most political texting programs.

Pros:

• Much faster to stand up — registration can be approved in days rather than months
• Lower cost — no shortcode lease fees, just registration and per-message carrier fees
• Works well for both mass texting and more personal, conversational or peer-to-peer programs
• Flexible: campaigns can register multiple 10DLC numbers under one brand for different purposes (fundraising, GOTV, volunteer recruitment)

Cons:

• Lower throughput than a shortcode — carriers cap messages-per-second, so very large blasts take longer to send
• Requires ongoing attention to trust scores and campaign-use-case registration to avoid carrier filtering

The Real Difference: Volume vs. Speed to Launch

The decision usually comes down to two questions:

1. How big is your list, and how fast do you need to reach it? If you're sending to hundreds of thousands of contacts on a tight timeline, shortcode's throughput matters.
2. How soon do you need to be live, and what's your budget? If you're launching mid-cycle and need to be texting within days, 10DLC is almost always the practical answer.

For most campaigns — especially state and local races, or federal campaigns still ramping up — 10DLC hits the sweet spot: fast approval, reasonable cost, and enough throughput for most GOTV and fundraising pushes.

Don't Forget TCPA Compliance

Regardless of which path you choose, registration is only half the equation. Every campaign texting program needs to be built around TCPA (Telephone Consumer Protection Act) compliance:

• Clear, documented opt-in for every number on your list
• Easy opt-out language (STOP/HELP) honored immediately
• Accurate campaign-use-case registration that matches what you're actually sending
• Careful monitoring of complaint and filtering rates, since carriers can throttle or block traffic that looks non-compliant

Getting the registration type right gets your messages eligible to be delivered. Compliance is what keeps them actually landing in inboxes cycle after cycle.

Bottom Line

If your campaign needs to move fast, keep costs manageable, and run a flexible mix of mass and peer-to-peer texting, 10DLC is usually the right call. If you're running a massive, single-purpose blast program at national scale and have months of lead time, a shortcode may be worth the investment.

Series Edition: Section 2 - Authentication Protocols “Your Emails' Identity Crisis”

Your Emails Need an ID Card

SPF, DKIM, DMARC Explained (Without the Jargon)

Here’s an example: You write the ideal email. It has everything. You have a good copy and good design. You send it to 50,000 recipients. Gmail blocks your email.

Why?

Because you didn’t verify your identity.

This is called authentication, and you must do it.

The Trust Problem

These days, ISPs (Internet Service Providers: Gmail, Yahoo, Outlook, et al.) do not trust anything by default. The first thing they want to ask about an incoming email is whether it is legitimate and whether it really came from whoever the sender claims to be.

And why do they do that? Because spammers are sneaky. They use fake domain names, masquerade as your bank, clone organizations, and send you emails which are supposedly sent "from: [email protected]," whereas they were sent from some shady server located in Russia.

To establish authenticity, ISPs designed a special mechanism that we refer to as an email's ID card and authentication protocols!

But here's how things are different: In February 2024, just two years ago, Gmail and Yahoo implemented this rule. If you're not authenticated, and you're trying to send 5,000 emails per day, they will not be accepted or moved to the junk folder without any consideration for the content. You'll be rejected. And today, in 2026, there are even more severe measures in place. There are no temporary warnings from ISPs anymore. Your emails get immediately rejected.

So if you haven't set this up yet, you have a serious problem right now.

The Three Protocols

There are three authentication systems. They work together like a security team. SPF is your basic ID check. DKIM is your certified signature. DMARC is the enforcement layer.

SPF: The Clipboard

SPF stands for Sender Policy Framework. Here's the simple version: SPF is a whitelist.

You make a list of the servers that are allowed to send emails using your domain name. The email will be passed by Gmail if the email comes from any of those servers. Otherwise, the email will fail.

Imagine a bouncer with a list at the entrance of a nightclub. "Names on the list, come in. Not on the list? Then you can stay outside!"

Now here’s the downside: SPF checks the source only. However, a smart attacker can spoof an email if they know the right server. Yet it is crucial. Every domain need SPF.

DKIM: The Wax Seal

DKIM, which stands for DomainKeys Identified Mail, is tougher to spoof than SPF. This involves digitally signing your message, like stamping a wax seal on an envelope.

Here's how it works: Whenever you send an email, DKIM digitally signs it (this is done automatically by your email provider). Once the recipient gets your email, they authenticate this digital signature and ensure two things: (1) that it is genuinely from you, and (2) that it hasn’t been tampered with since sending.

ISPs consider DKIM very important when evaluating emails. If your email has been DKIM-signed, the ISPs give it priority. On the other hand, if it is unsigned, they are suspicious of it.

Good news: Your email provider takes care of DKIM signing automatically.

DMARC: The Boss

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's the boss of the group. It combines SPF and DKIM and tells ISPs what to do when something goes wrong.

DMARC has two functions:

1. Enforcement: You inform ISPs about what should happen if an email fails SPF and/or DKIM. Should they reject the email? Quarantine it? Or should they simply monitor it?

2. Visibility: Reports come in that will let you know exactly what's going on in your authentication process.

Here's where you have some serious control and insight.

How They Work Together

SPF checks: Is this coming from an authorized server?

DKIM checks: Is this properly signed digitally?

DMARC policy: If either fails, this is your response.

All three work together to create a castle. Basically, you're saying, "Email security is important to me. IISPs can rely on my emails."

If one of them is missing, there is a vulnerability. The ISPs will take advantage of this by using more filtering.

And it must be monitored. You don’t set it up once and leave it alone.

Why ISPs Got Strict

ISPs are overwhelmed with spam. In fact, approximately 46% of email traffic consists of spam. Thus, ISPs are ruthless when it comes to filtering. And one of the first criteria is authentication.

If your email lacks SPF, DKIM, and DMARC authentication protocols, ISPs will instantly assume that you're a spammer. No "maybe" or "possibly." Assume. Because legitimate businesses always authenticate their messages. Professionals don't send unauthenticated emails. Spammers do.

When Google and Yahoo required authentication two years ago, they weren't being jerks. They were saying, "Look, we are overwhelmed with spam. If you want us to consider looking at your message, show us it isn't a scam."

Why ISPs Became a Bouncer

Approximately 46% of all email that is being sent at this very moment is spam. Yeah, about 46%. That's crazy!

Gmail receives 15 billion unsolicited emails EVERYDAY. Yes, you heard right. 15 BILLION!

That is why they decided to tell everyone that “Nobody can be trusted anymore. Everyone must show ID.”

Having SPF, DKIM and DMARC will mean that you are telling Gmail, “I’m here legally and I take security seriously.” Gmail listens to that.

Not having these three means that Gmail treats you as spam. Since only legitimate businesses authenticate emails.

The Death Spiral (This Is What Actually Happens)

1. You fail authentication -> ISPs won’t recognize you

2. ISPs won’t recognize you -> your emails go through filtering

3. Emails are filtered -> people ignore them -> ISPs see low user activity

4. ISPs see low user activity -> they’ll be stricter with filtering next time

5. You’re on the spam permanently -> nothing goes through anymore

And the worst part about it is that the recovery process is long. We’re talking about weeks or even months. You’re going to be struggling against Gmail and Yahoo to get off the spam blocklist. Your reputation is ruined. And even when you do fix the authentication, Gmail’s not going to trust you anytime soon.

But there’s no need for it at all. This is entirely preventable.

Real Talk

If you’re not positive that SPF, DKIM, and DMARC are configured, chances are good they’re not.

Check it right now. Seriously.

Look up “SPF DKIM DMARC checker,” type in your domain, and you’re done in five minutes. If there’s a problem, send an email to your email service provider ASAP. They’ll get it sorted out.

Not done setting them up. Better get started right now. Don’t wait. Do it today. Gmail and Yahoo aren’t playing games.

What You Need to Remember

Authentication is mandatory. This is true for Gmail and Yahoo, which will enforce it by 2026.

No authentication means automatic fraud. ISPs make no exceptions.

There are serious consequences for making mistakes. Loss of income. Reputational damage. Contractor expenses. Support costs. Loss of elections.

It takes time and money to rebuild your reputation. Preventative measures are less expensive than remedial ones.

You need SPF, DKIM, and DMARC, all three.

Next Section

Authentication is the first hurdle that ISPs put up for your emails. They need to confirm that your emails are authentic before looking at anything else.

But there's a second barrier: sender reputation.

Even when emails are perfectly authenticated, ISPs will still question if they should trust the sender by asking: “Are we sure about this sender?” The answer lies in various metrics such as how many users open your email, how often are you reported as spam, your history of sending, and whether you send to invalid email addresses.