Almost every business we meet that has an email problem thinks it has a content problem. They have rewritten the subject line six times. They have shortened it, lengthened it, taken the emoji out, put the emoji back. Nothing moves.
Sometimes it really is the writing. More often, on lists that used to perform and then quietly stopped, the mail is being filtered before anybody gets the chance to read the subject line at all. The good news is that this is the easier problem, because it has an actual answer rather than an opinion.
The five-minute test.
Open your last campaign in whatever you send from — Klaviyo, Mailchimp, Constant Contact, it does not matter — and split the opens by the recipient’s email domain. Most platforms will do this for you. If yours will not, export the openers and sort the column.
Then compare two groups:
- Gmail and Google Workspace. Usually the biggest slice of any consumer list.
- Yahoo, AOL, Verizon, Comcast, and the rest.
If both groups are low, you have a content problem, or a list-quality problem, and this article is not about that. If Gmail has fallen off a cliff while everyone else is normal, you have an authentication problem. There is no third explanation. Your writing does not know which mailbox provider it is being delivered to. The filters do.
Why Gmail first. Google enforces sender authentication harder than most, and it enforced it earlier. When something breaks in your DNS, Gmail is usually the first place you see it and the last place you get it back. Treat a Gmail-only collapse as a smoke alarm, not a mystery.
The three records, in plain English.
Email authentication is three DNS records that answer three questions about you. They live with whoever runs your domain’s DNS, which may not be whoever hosts your website and is almost certainly not your email platform.
- SPF says who is allowed to send as you. A list of the services permitted to put your domain in the From line. It has a hard limit of ten lookups, and going over it silently breaks the whole record.
- DKIM is a signature. Your sending platform signs each message with a private key, and a matching public key sits in your DNS so the receiver can check the signature was really yours and the message was not altered on the way.
- DMARC says what to do when the first two fail — ignore it, junk it, or refuse it — and, crucially, where to send the reports.
Alignment is the part everyone misses.
Here is the trap, and it catches businesses who have done nothing wrong.
Your email platform signs every message it sends. That signature is valid. It passes. But by default it passes for the platform, not for you: the key belongs to their domain, and the bounce address does too. Both checks technically succeed, and neither one aligns with the domain in the From line that your customer actually sees.
Mailbox providers score that gap hard, and they are right to. From the receiving end it looks like a business that has never vouched for its own mail. The fix is a dedicated sending domain — usually a subdomain such as send.yourbusiness.com — where your platform generates records that you add to your own DNS. After that, the signature is yours.
Use a subdomain rather than your main domain, so that marketing reputation stays separate from the mailbox you run the business out of. If a campaign ever goes badly, it should not poison the address you send invoices from.
The most common way this breaks.
Nobody wakes up and deletes their DKIM record. It goes missing during a move.
A business changes website platforms, or hosts, or finally gets off the builder they have outgrown. DNS is pointed somewhere new. Whoever does the move carefully re-creates the records that visibly matter — the website, and the mail records that keep staff email working, because everyone notices immediately if staff email breaks. The marketing platform’s records are not in either category. They are invisible until a campaign goes out weeks later and quietly under-performs, and by then nobody connects the two events.
We have watched this happen, and we have caused it. When we migrated a client’s DNS off an old website builder, their mailbox records came across and their email platform’s did not. Every send for the next two months went out unauthenticated. Nobody noticed until we split that campaign by domain and saw half a percent sitting next to twenty-four.
If you are moving your website this year. Before you cut over, export the full DNS zone from the old provider. After you cut over, compare it line by line against the new one. It takes twenty minutes, and it is the cheapest insurance in marketing.
Fix it in this order.
The order matters more than the speed. Tightening enforcement before the signatures exist will send your own legitimate mail to junk, including the mail your staff send by hand.
- Set up a dedicated sending domain in your email platform. It generates the records; you add them to your DNS exactly as given, then hit verify. This is the one that moves the open rate.
- Add DKIM for your mailbox provider too — Google Workspace or Microsoft 365 — so the mail your team types by hand is signed as well.
- Turn DMARC reporting on, still set to take no action. Nothing changes about how your mail is treated. You are only collecting evidence. Raw reports are unreadable XML, so point them at a free digest service that emails you a weekly summary.
- Read the reports for two or three weeks. They will show every source sending as your domain, including things nobody remembered was still switched on.
- Then tighten, slowly. Move to quarantine on a percentage of mail, raise it over a few weeks, and only then consider outright rejection. There is no prize for arriving early.
What to expect afterwards.
DNS changes take minutes to hours to spread, so a failed check right after you make a change usually means propagation rather than a mistake. Give it a day before you conclude anything.
Reputation, though, is slower than propagation. You are asking mailbox providers to revise an opinion they formed over months, and they will want a few clean sends before they do. Do not judge it on one campaign, and do not celebrate on one either.
One more thing, because it is the half of the job that authentication cannot do for you: once the records are right, stop mailing people who have not opened anything in a year. A tidy list protects the reputation you just rebuilt. Sending to everyone is what got a lot of these lists into trouble in the first place.
The short version.
Split your last send by mailbox provider. If Gmail is on the floor and everyone else is fine, put the subject line down and go and look at your DNS. It is not your writing.