Latest / The Email Marketing Podcast with Fexingo: Newsletters, Open Rates, and Subscriber Growth / How Email Authentication Builds Subscriber Trust
Transcript
- Lucas: So I was talking to a friend who runs a mid-size e-commerce brand — about 50,000 subscribers — and she mentioned that their open rates had been slipping for months. They tried better subject lines, cleaner lists, even A/B tested send times. Nothing moved the needle. Luna: Sounds frustrating. What was the culprit? Lucas: Email authentication. Or rather, the lack of it. They had SPF set up, but DKIM was misconfigured, and they had no DMARC policy at all. Turns out, Gmail and Yahoo have been quietly tightening their authentication requirements since early 2025, and by February 2026, they started blocking or flagging a lot more unauthenticated mail. Luna: Wait — so just a technical setting in the background can tank your open rates? Lucas: Absolutely. Authentication is basically your email's ID card. Without it, the receiving server has no way to verify that your email actually came from you, not a spammer spoofing your domain. And with the new policies, Gmail and Yahoo are essentially saying: no valid ID, no inbox placement. Luna: Let's break down the three main protocols. SPF, DKIM, and DMARC. Lucas: Right. SPF — Sender Policy Framework — is a DNS record that lists which IP addresses are allowed to send email for your domain. It's the oldest and most basic. DKIM adds a cryptographic signature that proves the email hasn't been tampered with in transit. DMARC ties them together and tells the receiving server what to do if both checks fail — either quarantine the email or reject it outright. Luna: And the friend's brand only had SPF. What happened when they fixed DKIM and added DMARC? Lucas: Within two weeks, their open rate jumped from about 18 percent to just over 30 percent. That's a 12 percentage point increase. Deliverability issues were dragging them down, and they didn't even know it. Luna: That's huge. And it makes me think about a 2025 industry report I saw — by Email Sender & Provider Coalition — which found that 23 percent of marketing emails from small businesses still fail basic authentication checks. That's nearly one in four. Lucas: And those are the ones that get flagged. The report also noted that domains with a valid DMARC policy of 'reject' or 'quarantine' saw spam complaint rates drop by over 40 percent compared to those with no DMARC at all. Luna: So authentication doesn't just help with deliverability — it directly affects your sender reputation over time. Lucas: Exactly. Every time an email gets flagged as suspicious, even if it's not spam, it's a negative signal. Accumulate enough of those, and your domain gets a reputation hit that takes months to recover from. And the irony is, most marketers don't even think about authentication until something goes wrong. Luna: Let's talk about what 'something goes wrong' looks like. Maybe a sudden spike in bounce rate, or a flood of 'this message looks suspicious' warnings? Lucas: Or a complete mystery drop in open rates that you can't explain through content changes. I've seen cases where a brand's emails were going to spam for 60 percent of Gmail users, and they had no idea because their email service provider didn't surface those delivery stats clearly. Luna: So how does a non-technical marketer even start? Like, I know what DNS is, but I've never set a TXT record. Lucas: The good news is, most email service providers — Mailchimp, Klaviyo, Constant Contact — have step-by-step guides. You basically log into your domain registrar, find the DNS settings, and add the records they give you. For SPF, it's a single TXT record listing the IPs your ESP uses. For DKIM, your ESP generates a public key, and you add that as another TXT record. Luna: And DMARC? Lucas: DMARC is a policy record. You start with 'p=none' — which just monitors without blocking — then once you're confident everything's working, you move to 'p=quarantine' or 'p=reject'. The biggest mistake is going straight to 'reject' without testing, because if you have legitimate senders you forgot about — like a transactional email from your CRM — you'll block your own mail. Luna: That's a nightmare scenario. And it ties back to something we touched on in prior episodes about list hygiene — authentication is really the foundation. Without it, even a perfectly segmented, permission-based list can't reach the inbox. Lucas: Exactly. And it's not just Gmail and Yahoo anymore. Microsoft, Apple iCloud, and even smaller providers are adopting DMARC enforcement. The industry is moving toward a standard where unauthenticated email simply won't be delivered. Luna: I want to go back to that e-commerce brand. After they fixed authentication, did they see any change in subscriber complaints or unsubscribe rate? Lucas: Their unsubscribe rate actually dropped slightly — probably because fewer people were clicking 'report spam' out of confusion. And their complaint rate — the number of people marking email as spam — fell by more than half. That directly improves sender reputation. Luna: So authentication is a trust signal both for the email provider and for the recipient. If your email looks legit, providers let it through, and recipients see it in their primary inbox. Lucas: Right. And there's a secondary benefit: DMARC also gives you visibility into who's sending email using your domain. You get XML reports showing all sources — legitimate and fraudulent. Some brands discover that a third-party tool they forgot about is sending emails on their behalf without proper authentication. Luna: That's a rabbit hole. But for the average listener running a newsletter or e-commerce list, what's the one thing they should do this week? Lucas: Check your DMARC report. If you don't have a DMARC record, set one to 'p=none' first and start collecting data. Most ESPs have a DMARC setup wizard now. It takes about 15 minutes, and it's probably the highest roi technical change you can make for your email program. Luna: And if today's conversation saved you from ending up in spam for the next six months, that's worth something. If it was worth a coffee to you, the link is buy me a coffee dot com slash fexingo. Keeps the show ad-free and lets us dive into these deep technical topics. Lucas: Absolutely. And we genuinely appreciate it. Now, one more angle on authentication I want to touch on — BIMI, which stands for Brand Indicators for Message Identification. Luna: Oh, the logo thing? I've read a bit about that. Lucas: Yeah. BIMI lets you display your brand logo next to your email in Gmail and a few other clients — but only if you have strict DMARC enforcement, like 'p=reject'. It's a visual trust signal on top of the technical one. Early adopters saw a 10 percent lift in open rates just from the logo. Luna: So authentication doesn't just keep you out of spam — it can actually improve engagement. That's a compelling case for doing it right. Lucas: Exactly. And it's one of those rare things where the fix is simple, the cost is zero, and the payoff can be dramatic. So if you haven't looked at your authentication setup in the last year, take 15 minutes and do it. Luna: We'll put links to the setup guides in the show notes. For now, I think we've given everyone a solid checklist to work through. Lucas: Next episode, we're going to talk about a related topic that often gets confused with authentication — email list warming. That's a separate beast, but equally important for new domains. Luna: Looking forward to it. Until then, keep your records straight and your inbox clean.