Latest / The Email Marketing Podcast with Fexingo: Newsletters, Open Rates, and Subscriber Growth / Why Email Authentication Matters for Deliverability
Transcript
- Lucas: You spend hours crafting an email. You segment the list, you write a killer subject line, you test the preheader. You hit send. And then… nothing. Or worse — it lands in spam. Luna: It is the worst feeling. And most of the time, the problem isn't your copy. It's your authentication. Lucas: Exactly. Today we're talking about SPF, DKIM, and DMARC — the three protocols that tell email providers like Gmail and Outlook that your message is actually from you, and not a phishing attempt. Luna: It's one of those things that sounds super technical but is actually straightforward once you break it down. And if you skip it, you're basically asking to be filtered. Lucas: Right. So let's start with a concrete example. Back in 2025, there was a wave of phishing emails impersonating a major retail chain — let's call it RetailCo. They spoofed the domain, sent fake order confirmations, and a lot of people clicked. The real company had never set up DMARC. Luna: So they had no way to tell ISPs that only their official servers should be allowed to send email from that domain. Lucas: Exactly. And the result? Their legitimate newsletters started bouncing. Gmail flagged them as suspicious. Their open rates dropped by almost 30 percent in a month. It took them weeks to recover sender reputation. Luna: That's a nightmare. And it's avoidable. So let's walk through what each protocol does. Lucas: SPF — Sender Policy Framework — is basically a DNS record that lists which IP addresses are authorized to send email for your domain. You publish it, and receiving servers check it. Luna: But SPF alone has limits. It only checks the envelope sender, not the visible From address. So a clever spoof can still get through. Lucas: That's where DKIM comes in. DomainKeys Identified Mail adds a cryptographic signature to each email. The signature is tied to your domain, and the receiving server can verify it hasn't been tampered with. Luna: So even if someone tries to spoof your domain, they can't forge that signature — unless they have your private key. Lucas: Right. And then DMARC — Domain-based Message Authentication, Reporting, and Conformance — ties it all together. It tells the receiving server what to do if both SPF and DKIM fail. Do nothing? Quarantine? Reject? Luna: And it also gives you reports on who's sending email using your domain, which is super useful for spotting abuse. Lucas: Exactly. So the key takeaway: you need all three. SPF alone is not enough. DKIM alone is not enough. DMARC without the other two is useless. Luna: And the setup is not that hard. Most email service providers — Mailchimp, Constant Contact, Klaviyo — have guides. It's just DNS records. Lucas: Let's talk numbers. According to a 2025 report from Validity, domains with DMARC enforcement at quarantine or reject level saw inbox placement rates above 95 percent. Domains without DMARC — or with a p=none policy that does nothing — averaged below 80 percent. Luna: That's a 15-point swing. If you're sending to a list of 100,000, that's 15,000 more people seeing your email in the primary inbox. Lucas: And yet, the same report found that fewer than 40 percent of business domains have DMARC at a policy of quarantine or reject. Most are still at p=none, which is basically 'do nothing.' Luna: It's a huge opportunity for email marketers to get ahead. Especially as Gmail and Yahoo started enforcing stricter requirements in early 2024. Lucas: Right. If you're sending more than 5,000 messages a day to Gmail, you're required to have SPF, DKIM, and DMARC. And they're checking. If you fail, your mail gets bounced or sent to spam. Luna: So this isn't optional anymore. It's table stakes. Lucas: And honestly, the listener support that keeps this show ad-free — if these conversations have helped you with your email marketing, and you want to make sure we keep going, it's buy me a coffee dot com slash fexingo. Luna: Yeah, it makes a real difference. And we really appreciate it. Lucas: Okay, back to authentication. One thing that surprises people is that fixing authentication alone can improve deliverability even if your content hasn't changed. Luna: Yeah, I've seen that. A small ecommerce client of mine had open rates around 18 percent. They set up DMARC properly — moved from p=none to p=quarantine — and within two weeks open rates went up to 28 percent. Lucas: That's a 55 percent relative improvement, just from letting ISPs know you're legitimate. Luna: And the fix took about an hour. Their IT person added three DNS records. Lucas: Let's talk about some common mistakes. One: using a shared sending IP without proper authentication. If another sender on that IP has poor reputation, your mail suffers too. Luna: That's why dedicated IPs plus authentication is the gold standard for high-volume senders. Lucas: Two: forgetting to include all sending services in your SPF record. If you use Mailchimp and also send transactional emails via SendGrid, both need to be listed. Luna: Otherwise, one of those streams might fail SPF and cause the whole domain to look suspicious. Lucas: Three: not monitoring DMARC reports. DMARC generates XML reports that tell you who's sending email from your domain. You can spot unauthorized senders early. Luna: There are free tools like DMARCian and Postmark's DMARC report analyzer that make it easy to read those reports. Lucas: So here's a quick action plan. Step one: check if you have SPF, DKIM, and DMARC records. You can use a tool like MXToolbox or Google's Admin Toolbox. Luna: Step two: if your DMARC policy is p=none, plan a move to p=quarantine or p=reject over a few months. Monitor reports first to make sure no legitimate senders are being blocked. Lucas: Step three: align your DKIM signing domain with your From domain. That's called 100 percent alignment, and it's what Gmail prefers. Luna: And step four: set up a dedicated sending domain if you can. Instead of sending from your main domain, use something like mail.yourdomain.com. It isolates your sending reputation from your primary domain. Lucas: That's a pro tip. A lot of large senders do that to protect their brand domain in case of a deliverability issue. Luna: So to wrap it up: authentication is not optional. It's the foundation of email deliverability. Without it, your best content never gets seen. Lucas: And the great news is it's a one-time setup that keeps paying off. Check your records this week. Your inbox placement rate will thank you.