Latest / The Email Marketing Podcast with Fexingo: Newsletters, Open Rates, and Subscriber Growth / How Email Deliverability Actually Works
Transcript
- Lucas: If you’ve ever sent an email that looked perfect in your draft, only to watch it vanish into the void of the spam folder or worse, never arrive at all, you’re not alone. It’s one of the most frustrating parts of digital marketing because it feels completely out of our control, yet it’s entirely within ours if we understand the mechanics. Luna: Right, and it’s especially annoying when you’re sending to warm leads who definitely want to hear from you, but the internet just decides they don’t. Lucas: Exactly. So today, we are pulling back the curtain on email deliverability, specifically focusing on the three pillars of authentication: SPF, DKIM, and DMARC. These aren’t just buzzwords; they are the actual ID cards your domain shows to Gmail, Outlook, and Yahoo before your message is even allowed to enter their system. Luna: I feel like most marketers skip this stuff because it sounds like IT homework, but it’s basically the foundation of trust. Lucas: It is, and the cost of ignoring it has gotten much higher. A few years ago, you could maybe get away with sloppy setup, but now, major ISPs are enforcing strict policies. If your domain doesn’t have these records correctly configured, your emails might not even hit the inbox; they might be rejected outright before the subscriber sees anything. Luna: So it’s less about the content and more about the envelope? Lucas: Precisely. Think of it like mailing a letter. You can write the most compelling letter in the world, but if the post office can’t verify your return address or if the seal looks tampered with, they might just throw it in the shredder. That’s what happens when authentication fails. Luna: Okay, so let’s start with SPF since that’s usually the first thing people hear about. Lucas: SPF stands for Sender Policy Framework, and it’s essentially a list of IP addresses that are authorized to send email on behalf of your domain. It’s a simple text record in your DNS settings. When an ISP receives an email claiming to be from your company, it checks this list to see if the IP address matches. Luna: And if it doesn’t match, what happens? Lucas: The ISP marks it as suspicious. If you’re using a third-party tool like Mailchimp or HubSpot to send your newsletters, those platforms use their own servers, not yours. If your SPF record doesn’t explicitly allow those specific IP ranges, every single email you send through them gets flagged. Luna: That sounds like a nightmare for agencies managing multiple clients. One wrong character in the DNS record and everything breaks. Lucas: It really is. And this is where I see a lot of small business owners trip up. They’ll hire a freelancer to set up their website, but they forget to mention that this site will also be sending transactional emails. The freelancer sets up the basic DNS, but misses the SPF extension for the email platform. Luna: So the email goes out, but it looks like it’s coming from a random server instead of the brand. Lucas: Exactly. Which brings us to the second pillar, DKIM, which stands for DomainKeys Identified Mail. If SPF verifies that the server is allowed to send the email, DKIM verifies that the content hasn’t been altered in transit. Luna: So it’s like a digital signature on the letter itself? Lucas: Yes, exactly. It adds a cryptographic hash to the header of your email. This hash proves that no one modified the subject line, the body text, or the links after the email left your server. If that signature is missing or broken, ISPs assume the email might have been tampered with by a hacker. Luna: That makes sense. Security is huge right now, especially with all the phishing going on. Lucas: It is. And then we have the boss level, DMARC. This protocol tells the ISP what to do if an email fails either the SPF or DKIM check. It’s the policy setting. Luna: What are the options there? Lucas: There are three main modes: none, quarantine, and reject. In none mode, the ISP just monitors the failures but lets the email through anyway. Quarantine sends it to spam. Reject blocks it entirely. Most experts recommend starting with none, monitoring the data for a few weeks, and then moving to quarantine or reject once you’re sure legitimate emails are passing authentication. Luna: So you’re saying you should treat DMARC as a safety net rather than a gatekeeper initially? Lucas: Precisely. If you go straight to reject mode without testing, you might accidentally block important emails from partners or vendors who don’t have proper authentication set up on their end. You want to catch those errors before you lock the door. Luna: That’s a good point. It’s better to be safe than sorry when you’re dealing with revenue-generating communications. Lucas: Before we dive deeper into the technical setup, I want to mention something quick. We keep this network running ad-free because a small group of listeners support us monthly through buy me a coffee dot com slash fexingo. It helps cover the costs of production and keeps the conversations focused on value rather than clicks. If you’ve found any of our deep dives useful, that’s the best way to help us keep doing this. Luna: Yeah, and honestly, it’s nice to know that the people listening are the ones keeping the lights on here. Lucas: Thanks for that. Now, back to the tech. Once you have SPF, DKIM, and DMARC set up, you still need to manage your sender reputation. Luna: Which is basically the score the ISPs give you based on how people interact with your emails. Lucas: Correct. It’s a combination of hard bounces, soft bounces, spam complaints, and engagement metrics like opens and clicks. If you suddenly start emailing a list of cold leads that haven’t opted in, your complaint rate spikes, and your reputation tanks. Luna: So authentication gets you in the door, but behavior keeps you there. Lucas: Exactly. And this is where the synergy happens. Even if your technical setup is perfect, if you’re sending irrelevant content, you’ll still land in spam because people will mark it as junk. The ISPs look at both signals. Luna: It’s interesting how many people try to game the system with subject lines instead of fixing the underlying infrastructure. Lucas: They do. But the infrastructure is non-negotiable. You can’t outrun a bad reputation with a clever headline. Let’s talk about how to actually check your status. Luna: I use tools like MX Toolbox or GlockApps to run diagnostics. Lucas: Those are great. I’d also recommend checking your DMARC report aggregator. Tools like Valimail or Postmark provide dashboards that show you exactly which IPs are trying to send email under your name, and whether they’re authenticating correctly. Luna: That sounds incredibly valuable for spotting spoofing attempts too. Lucas: Absolutely. It’s not just about deliverability; it’s about security. Hackers love to spoof domains because they know people trust the sender name. If you have a strong DMARC policy in place, you’re actively protecting your customers from phishing attacks disguised as your brand. Luna: That’s a powerful incentive to take the time to set this up properly. It’s not just about opening rates; it’s about brand safety. Lucas: 100 percent. And for smaller teams, I always suggest starting with your email service provider’s documentation. Most modern platforms like Klaviyo or ActiveCampaign have step-by-step guides for adding these records to your DNS. Luna: True. And if you’re not comfortable editing DNS records, most providers offer a managed service or can point you to a trusted partner. Lucas: Right. Don’t DIY it if you’re not confident. A broken DNS record can take hours to propagate, and during that time, your entire email communication stops. It’s worth paying for expertise if it saves you downtime. Luna: That’s practical advice. Downtime is expensive. Lucas: It is. Another common mistake is forgetting to update these records when you change email providers. If you move from one platform to another, the IP addresses change, and your old SPF record might block the new one. Luna: Oh, I didn’t think about that. So migration requires a manual audit of the auth records? Lucas: Always. Make it part of your migration checklist. Check SPF, DKIM, and DMARC before you flip the switch. It prevents that panic moment when you send the first test email and it bounces. Luna: Good to know. It seems like a lot of work for something so invisible. Lucas: It is invisible until it breaks. But when it works, it’s silent and seamless. Your emails just arrive. And in a world where attention is scarce, having your message actually seen is half the battle. Luna: I think a lot of marketers underestimate how much of a competitive advantage reliable delivery actually provides. Lucas: Definitely. While everyone else is chasing viral subject lines, you’re ensuring the message lands. That consistency builds long-term trust with your subscribers and the algorithms alike. Luna: So, is there a final tip for someone listening who wants to start fixing their deliverability today? Lucas: Start by auditing your current lists. Remove inactive subscribers who haven’t opened an email in six months. Then, run a diagnostic on your DNS records. Fix any errors you find, and monitor your DMARC reports weekly for a month. Luna: Simple steps, but they make a huge difference over time. Lucas: They do. It’s maintenance, not a one-time fix. Just like cleaning your house, you have to do it regularly to keep things running smoothly. Luna: I’ll leave it there. What do you think is the biggest misconception about email deliverability right now? Lucas: That it’s purely a technical problem. It’s not. It’s a mix of technical hygiene and genuine relationship building with your audience. Luna: Agreed. Thanks for breaking that down, Lucas. Lucas: Anytime. Next week, we’ll look at how to structure your welcome series to maximize initial engagement. Luna: Sounds like a plan. See you then.