Latest / The Email Marketing Podcast with Fexingo: Newsletters, Open Rates, and Subscriber Growth / How Email Authentication Boosts Deliverability
Transcript
- Lucas: So I was digging into our own email setups last week, checking why some of our newsletters were landing in spam, and I stumbled onto something that most marketers I talk to have never even heard of: email authentication. Luna: Email authentication — you mean like DMARC and all that? I always thought that was an IT thing, not a marketing thing. Lucas: That's exactly the problem. It's been treated as IT infrastructure for years, but after Google and Yahoo started enforcing their sender requirements back in 2024, authentication became a marketing issue. If you're sending bulk email to Gmail or Yahoo addresses and you haven't set up SPF, DKIM, and DMARC, your emails are more likely to get blocked or spam-foldered. Luna: Wait, I remember hearing something about that. They basically said you need to authenticate your email to keep your sender reputation in check, right? Lucas: Right. And the confusion is, a lot of smaller marketers think, 'We're not sending that much volume, we're fine.' But the rules apply to anyone sending more than five thousand emails a day to Gmail addresses. And even if you're under that, the principles still matter. Authentication is basically your email's ID card — it proves to the receiving server that you are who you say you are. Luna: So it's like a passport for your email. If you don't have it, you're less likely to get through customs, which in this case is the inbox. Lucas: Exactly. And the three protocols work together. SPF verifies that the sending server is authorized to send on behalf of your domain. DKIM adds a digital signature to each email. And DMARC ties them together, telling the receiving server what to do if the check fails — like quarantine or reject. Luna: Okay, so I'm already feeling a bit overwhelmed. How does this actually show up in your open rates or your revenue? Give me a concrete example. Lucas: Sure. There's a mid-sized e-commerce brand we profiled back in spring — they sell outdoor gear. They were seeing open rates around 28 percent, which isn't terrible, but they knew a lot of their emails were hitting spam. After they implemented DMARC correctly — not just a monitoring policy, but full enforcement — their open rates jumped to 40 percent within two months. That's a twelve-point improvement just from fixing authentication. Luna: That's a huge jump. But why would authentication alone make that big a difference? I'd expect it to be a smaller factor. Lucas: Because it's the foundation. If Gmail sees that your domain is properly authenticated, it trusts you more. And that trust compounds. Your sender reputation improves, which boosts your placement in the inbox, which improves your engagement rates. It's not just about avoiding spam — it's about building a better reputation over time. Luna: So what's the first step for a marketer who's never touched this stuff? Is it something you can do in an afternoon? Lucas: Honestly, the basic setup can be done in a couple of hours. First, check if your domain has SPF, DKIM, and DMARC records — you can use a free tool like MXToolbox. Then, if you're missing any, work with your IT or your email service provider to add the DNS records. Many email platforms like Mailchimp or Klaviyo have step-by-step instructions. Luna: But I've heard that DMARC can be scary because if you set it to reject before you're ready, you could block legitimate emails. Is that true? Lucas: Yes, that's a real risk. That's why the recommendation is to start with DMARC in monitoring mode, which sends you reports on emails that would fail, without actually blocking them. Once you've verified that your legitimate sends are passing, you can move from 'none' to 'quarantine' and then to 'reject'. Luna: That's a smart way to ease into it. So what kind of reporting does DMARC give you? I'm guessing it's not just a simple dashboard. Lucas: DMARC reports are XML files that tell you which of your emails failed authentication and why. They can be a bit technical, but services like dmarcian or Postmark can turn them into readable reports. And those reports are gold for spotting phishing attempts — if someone's spoofing your domain, you'll see it in the failures. Luna: So it's also a security thing. That makes it more of a must-do, not just a nice to have. Lucas: Exactly. And there's a nice side effect: when you set up DMARC with enforcement, you're telling the internet that you're serious about your domain. That can improve your sender reputation even beyond just deliverability. Luna: I want to go back to that e-commerce brand for a second. What specifically did they change? Did they switch email providers, or was it just adding DNS records? Lucas: They were already on a major ESP, but they'd never touched authentication. They had SPF from their old ESP, but it was too strict — it didn't include their new sending service. So some emails were failing SPF. And they had no DKIM at all, so Gmail couldn't verify the signature. When they aligned SPF and DKIM and set DMARC to reject, that's when the numbers improved. Luna: Interesting — so it's not just about having these records, it's about them being aligned with your actual sending setup. I bet a lot of listeners have no idea if they're aligned or not. Lucas: That's the key takeaway. You can't just set it and forget it. As you add new email providers, tools, or services, you need to update your SPF record and make sure your DKIM keys are active. A lot of companies have multiple SPF records, which invalidates them all. That's a common mistake. Luna: So the first step is really an audit. And it's something you can do yourself with a free tool, right? Lucas: Absolutely. And if you find issues, you can usually fix them with a few DNS changes. It's not glamorous, but it's the kind of thing that pays off immediately. Luna: I've been nodding along because this is something I've been meaning to do for our own list, and I have to say, listener support helps keep us free. If these marketing conversations have sparked something you've actually used, consider chipping in a few bucks a month at buy me a coffee dot com slash fexingo. It's what keeps us ad-free and able to dive into these nerdy topics. Lucas: Yeah, that's a good point. It's a small group of listeners who literally keeps this podcast going. And we appreciate every one of them. Now, where were we? Right — so after the audit, the next step is actually implementing the changes. But there's a common pitfall: you need to make sure your DMARC policy is set up correctly, or you might accidentally block your own sends. Luna: Wait, I just asked about that risk. So how do you avoid that mistake when you're ready to enforce? Lucas: Start in monitoring mode for at least a week. Look at the reports to see which of your emails are failing. You might find that some of your transactional emails — like order confirmations — are sent from a different subdomain or provider, and you need to make sure those are also authenticated. Once you're confident, then you move to quarantine, and eventually reject. Luna: So quarantine is like a middle ground — emails that fail go to spam instead of being rejected outright. That seems safer for testing. Lucas: Exactly. And you can see how Gmail and other providers handle it. Quarantine is a good place to be if you're still adjusting. But the ultimate goal, if you want the best deliverability, is to reach reject. That tells the receiving server, 'If it doesn't pass DMARC, don't even accept it.' That's the strongest signal you can send. Luna: So what's the timeline for seeing improvements? The e-commerce brand saw results in a couple of months. Is that typical? Lucas: It depends on your starting point and how bad your authentication was. If you were already in decent shape, you might see a small bump in a week or two. But if you were completely unauthenticated, it can take a few months to rebuild trust. The key is consistency — once you're set up, you need to maintain it. Luna: I've also heard that authentication can affect your ability to use certain email features, like click tracking or custom domains for links. Is that true? Lucas: Yeah, good point. Some email providers use a separate domain for tracking links, and if that domain doesn't have SPF or DKIM, it could hurt your deliverability. You need to make sure all your sending domains are authenticated, including any subdomains for tracking or images. Otherwise, you might be undermining your own efforts. Luna: So it's not just about your main domain. You need to think of your whole email ecosystem — including those third-party tracking links. Lucas: Right. And that's where a lot of surprises come from. You think you've set up DMARC, but then you see failures from your tracking domain, and you realize you've missed a piece. It's a process of continuous tuning. Luna: I feel like this is a topic that could save a lot of headaches down the line. So for a listener who wants to do this today, what's the one thing you'd tell them to do first? Lucas: Go to MXToolbox, run a DMARC check on your domain, and see what comes back. If it says 'No DMARC record' that's your starting point. If it says 'DMARC policy is none,' that's better, but you have work to do. It'll take you ten minutes, and it'll tell you exactly where you stand. Luna: And then what? Do you need to involve IT, or can a marketer handle it? Lucas: You'll likely need someone with access to your DNS, usually IT or whoever manages your domain. But you can prepare all the records yourself, and then send them over. Many ESPs have guides that make it easy. So it's collaborative, but you can be the driver. Luna: That's encouraging. I was afraid this would be a huge technical lift, but it sounds manageable if you break it down. Lucas: It's one of those things that seems intimidating at first, but once you do it, you'll wonder why you didn't do it sooner. And the payoff — better inbox placement, higher open rates, more revenue — is worth the couple of hours. Luna: I think this is one of those episodes that could save a lot of marketers from banging their heads against the wall when their campaigns underperform. Thanks for demystifying it, Lucas. Lucas: Glad to help. And if anyone wants to share their own authentication journey, we'd love to hear about it — you can find us on social media. But for now, go check your DMARC record.