Mastering Email Deliverability: The Crucial Changes You Must Make in 2024

0:08Hello and welcome to another episode of the duct tape marketing podcast. This is John Jantz. My guest today is JT Beckham. He is currently a senior manager of deliverability at ActiveCampaign, leading the deliverability team and collaborating with other teams across the organization. So, JT, welcome to the show. Thanks, John. Pleasure to be here. Now, deliverability is a hard word to say, actually, but that's what we're going to talk about is email deliverability. and we're going to talk about some technical things. I'm going to lean on JT to like not make it too crazy technical, but there's some things that you need to know.

0:47Email, still the best channel for most marketers today, or at least the best online channel today. So it's important that we get that email into the inboxes. Obviously, we know all the privacy and spam and issues that a lot of organizations will work on. It's kind of come to a forefront with Google and Yahoo in particular, introducing new email authentication requirements. So JT, and by the way, depending on when you're listening to those requirements, go into effect February 2024. So JT, could you just, is there a way to summarize what is going into effect in January 2024 that's important to people that maybe haven't paid attention?

1:24Yes, sir. There's three main things. With email authentication, we want to make sure that DCHEM, DNS records are defined for any from domain or from email address domain you're going to be using when you send out your emails. The next thing is DMARC. You need to have a basic DMARC record in place. Those are the two key things that have to be done for authentication. And then of course, there's two other parts of the requirements that are coming out. One that you can't use at gmail.com address unless you're sending email from their platform. and you need to watch your spam complaint rates at Google.

2:07So those are the three main areas. Okay, you nailed it. Those are the three main areas. Now 5 % of my listening audience knows what you were talking about. So we need to back up and say, what does all that mean? So when we talk about authentication, I mean, what we're essentially talking about is ways that, you know, because people are sending spoof things. We all get them all the time. You know, it's like I get an email that's supposedly from me, you know, from somebody out there, you know, who's trying to rip me off or something. I mean, so it's really just an effort to make sure that you are who you say you are, especially, and it's really focused on bulk senders, right?

2:41People that are sending five, 10 ,000, you know, person lists, right? Right. That's been the guidance that has been laid out by Googling Yahoo is the 5 ,000 limit. However, they have come back and said in other conversations, that's just like a soft number. Their basic guidelines is that if you're sending a single email to multiple recipients, then you are a bulk sender. So it's advised that everybody follows through and makes sure that you do what you can to make sure that the mailbox writers and ISPs out there in the world know that this email is from you and that you authorize it to be sent from certain IP addresses.

3:21And that when you do DKIM signing, you are basically adding a digital and encrypted signature to your emails, that if that gets damaged or broken along transit, then it fails the check when the ISPs and mailbox writers look at that and do a lookup on it. And so that would fail your authentication. So like you said, it's really key to make sure that you prove that you are the one sending the email. And that helps your recipients and your contacts that you're trying to reach, know for sure that it did get spoofed. And even if it's not being spoofed, you're not spamming. I mean, you have the ability to send to these records.

4:02The setting up of these DNS records are really how you prove that you are who you are. And if you don't prove you are who you are, then it's going to bounce, right? I mean, that's what's going to start happening. Your mails just won't go through, right? That's correct. They're going to start out slowly with like warning signals, letting people know or letting ESPs like ourselves know through the bounces coming back what would happen if they were to flip the switch and enable it. So they're, they say that they're going to slowly roll this out and, you know, starting February 1st is when they said.

4:40So a lot of interesting times ahead. All right. So you mentioned these, and I don't know, we can, I don't know if people need to know what these, you know, DKIM and DMARC stand for, Well, probably they don't because everybody just calls them DKIM and DMARC. But these are essentially records that are created in your DNS settings. So if your DNS is hosted by Google, that's where you make those changes. If it's hosted by Cloudflare, you know, that's where you make your changes. Some hosts, some actual domain hosts or website hosts, I should say, host DNS. So that's really the first place to go and look, right?

5:13That's absolutely true. All right. So tell me this. If I'm listening to this and I don't really know if I've got these records or if they're set up right, are there tools out there that I can take my domain and say, tell me if I need these things fixed? Yeah, there is. So there's third-party tools like DMartian, their website. They have a domain checker tool on their site. There's one called DNS Info. The MX Toolbox is a commonly used one that many people use. My team, we use several different ones just to make sure that if one is not reporting something correctly, we always have others that we go and check because sometimes these tools do have issues.

5:54But most of the time, they work very well. And you just define your domain and say, show me the records, and it'll tell you if it sees the DCM records or any other DNS records you might have. Right. So a couple scenarios. Let's say I'm using Google Workspace and it is a Gmail, but I'm using it on my domain. Are there any things I have to do? Because in my DNS records, you know, I'm using Google's MX records for sending. But is there anything that, you know, does Google actually tell me what my, you know, DMARC record needs to say or my domain key needs to say? If you have a problem, right, that your account is not there or it's failing at any point in time.

6:40One of the tools that Google has is a free tool to everyone is Google Postmaster Tools. And that's a tool that we in the deliverability space highly recommend every customer to take advantage of and sign up with their domain. You just define your domain. It will give you a text record that you need to add in to your DNS to authorize their system to be able to use your domain and pull data for it as they see data coming across their servers. So that will show you more insights on it. Yeah. And I love using Google tools because you're basically saying, here's what Google sees. And no matter if you have it all set up and you've hired a consultant to do everything, if Google doesn't see it right, then it doesn't matter, right?

7:27That's right. That's right. That's, again, another reason we like to use other tools, right? Yeah. And specifically, you know, if the mailbox provider has a tool for themselves like Google, we really strongly want you to use those tools. Now, let me give you another scenario. I use Google Workspace tools, but that's really more for individual emails than I'm sending out. I happen to be an ActiveCampaign customer, and we send out bulk emails to people that have opted in to receive those. And other people are using other email service providers. Are there any special things that you should be looking for if you're actually sending most of your bulk mail through a service like ActiveCampaign?

8:09Yeah, so whichever service you're using, DKIM keys, the DKIM records are unique to each service provider and their platform, right? So you couldn't take and put our DKIM key that we give you. You could put that in there and then send from our platform, right? And they'll sign it. If you try to use that key and send it off of Google or another different SaaS solution, the DKIM is not going to work. It's not going to pass. It's specific, like I said, to the mailing infrastructure of the BSP that you're using. Right. And essentially what it's saying is this email says it's coming from duct tape marketing in my case, but it's actually being sent by this company.

8:53And so you're essentially saying, I authorized this company to send on my behalf. That's essentially what's going on, right? So in that case, would you potentially have, let's say you're also, I don't know, you're using MailChimp for some other things too. So there's a third player. So would you have DKIMS from all three of those places? That is correct. Yeah. Any platform that you would be sending from MailChimp, into it, whatever it is, they're going to give you the same type of DNS record. It's basically just a long encrypted code, right, is what it amounts to. That's right. And it is unique, again, to that service provider.

9:30Yeah. And then underneath, like behind the scenes and stuff, that code is actually part of your email, right? It goes out in the header of your email. That's correct. So when you look at like you're looking at your Google mail and you say view source, then you can see your header information and absolutely see is DKIM signing or is it passing or failing? And again, I want to stress, you can have multiple DKIMs in here for any platform, right? As long as you've got it for each platform you're actually sending from, that's the key. And that's actually what you should do, right? Is have it for all the platforms you're sending from.

10:02Yeah. That's correct. And you should always make sure you maintain them, right? If you change platforms, for example, one of the things you really want to be diligent about is making sure you update these records and remove any platform you're not sending from anymore so that no one could potentially take advantage of that. Okay, so I think we've unpacked the understanding of what the DKIM record is. That's kind of the encrypted authorization. What does DMARC do? I understand the settings for it. What does it do? Yeah, so DMARC is another DNS record, and it's commonly referred to as a policy. What this basically does is it gives instructions to the mailbox providers or the ICPs on what to do if your email does not pass authentication.

10:50So there's a couple of parameters to it, right? There's a couple of different ways you can configure it to look at your DKIM key, for example, and enforce it in a strict mode or relaxed mode. This is going to be probably one of the most challenging areas for many people because you're not real sure how to set it up unless you've got DMARC experience and you understand what's going to happen when you implement a DMARC DNS record. There's usually an email address that's associated and defined in that record. So when you enable or define this record for a domain, every email that goes out and gets processed at every mailbox provider is going to report back.

11:31what happened. So if you're sending 500 emails, you're going to get 500 responses or reports into your email address that you specified. So we highly recommend working with a company like DMARC Digest to ingest that data. Oh, so it's sending it to their URI. Yes. Yeah, exactly. And it gives the users a much more user-friendly way to interpret what's happening and you can see very easily who is sending on your behalf using your domain. And if you are failing on DCHEM, if it's failing, you'll get a report. So you'll get reports back from those tools that will give you basically a health report on your deliverability.

12:16So in addition to that being a requirement, that sounds like a good best practice anyway. Absolutely. It is like the third step of authentication to help reduce the likelihood of being spoofed, having your email spoofed. So where does one turn to, and maybe the answer as well, it depends, and that there are multiple places, but where does somebody turn to find out like what should be in those records? Because there's syntax and things like all kind of coding things that have to be done right. How does somebody get that information? Yeah, the best site would be DMARC.org. That is the main site that defines what DMARC is, every parameter about it, how it works.

13:01It should answer any and all questions you have. However, you may find that you might be better off working with a consultant that specializes in implementing DMARC. I've worked with several companies in the past that are very large with multiple brands under them, their IT team gets involved and things like this. And putting a DMARC record in place in enforcement mode instead of reporting mode can be damaging if you don't do it correctly. We've had a plan that all of a sudden nobody was getting email. Yes, yes. I've seen that happen. Somebody thought that they were doing the record, setting the record up for their subdomain that they were using on their from addresses.

13:42in turn. But what actually happened was they implemented it for the root domain and that caused major headaches for a very short period of time until they fixed it. All right. So if you're still with us, listeners, I'm getting ready to confuse you a little deeper. So we've been talking about DMARC and one of the important parts of DMARC is it's going to check the DKIM to, you know, to see, you know, that's as part of its reporting. There's a sender policy framework. SPF is another element that's a record in DNS. We haven't talked about that yet, But is that part of these new requirements or is that just a good best practice to have that set up for the right servers?

14:18So great question. It is best practice to have that set up and defined. The SPF record is where you specify the IPs of the machines that are allowed to send your mail. Right. So most people will see like an include colon, you know, SPF underscore Google dot com or something to that effect. And again, you only have one SPF record for a domain. It's not like DKIM keys where you can have multiples. It's one record and you just have to add to it and update it. You just append it with... Yeah, correct. And so DMART does have an option, a parameter where you can say, look at the SPF record and make sure it passes.

14:59You can specify the DKIM, make sure it passes. You can say both of them have to pass. So it can get complicated when you're trying to implement that. But SPF, best practices, always make sure you're diligent again on making sure it's updated and doesn't have IPs or platforms defined that you're not longer sending a phone. That way you're making sure nobody's potentially using your phone domain. Now, I'm guessing most, certainly the bigger name, ESPs, ActiveCampaign certainly has this. I mean, I know when I set up my account, part of the setup was actually setting up these DNS records. And I suspect most people, most of their bulk email is being sent from somebody like an active campaign.

15:44Is that you want to talk about a little bit about how you all view that's part of the onboarding, right? As far as you're concerned, that's correct. We try to work very closely during the onboarding process to ensure that we help you get your account set up correctly. We help you check your SPF, your DMARC policies for you. And so it's critically important that we do this so that you can get started right away. We commonly have in the industry what we call a custom mail server domain. And the custom mail server domain allows you to brand your mail server that is sending the mail from our platform or any other platform.

16:25So you might see an email come into your inbox that says, you know, from John via sent by or sent via. Right. And then some unique name that doesn't make any sense. And that's where the SPF is checked on your DMARC policy. It's looking at that mail server's name and what that SPF record looks like. So many of the platforms like ours, we actually do this for you. we provide the SPF by default for that weird looking mail server name that's our name. That's our domain. Yeah. We do have the ability to help a customer set up a custom mail server domain and rebrand it. So then now your domain and your subdomains all align up.

17:08And so when that SPF check is done through the DMART policy, it will see, oh, okay, your SPF is there for your subdomain of your mail server that you're using. Yeah. Yeah. And I know subdomains and domain talk can get a little confusing too. Yeah, we'll stick to just domains right now. The one other thing that's not a DNS record, but I'm understanding it to be highly recommended by at least Google, and that is to have unsubscribe in your header. You know, a lot of, for years, you know, people would bury it down at the very bottom, maybe make it even hard to find. It's kind of goofy because then people just hit spam.

17:45But talk a little bit about that. I'm not even calling it a requirement. I think they're just suggesting it as a deliverability element and maybe how you guys address that. Yes, sir. So what they're referring to is one click unsubscribe and it has to be part of your header. We've had that as part of our platform for years. It is part of making sure your emails are RFC compliant. And so we want to make sure that everyone understands that it's usually already built in. And usually your provider that you're using can tell you pretty easily, yes, we already do it for you or no, here's how you need to enable it.

18:26This is a requirement. It's buried into the other parts of the documents. But they're not calling it out per se, other than you just have to make sure you're RFC compliant. And this is part of it. So when we talk about it in the header, I mean, it is still visible, but it's really, we've all probably seen those where you wanted to unsubscribe to something. It was right there, you know, almost in the subject line. And so that's what we're really talking about. And it's really, I still see, I still get emails from people that don't have an unsubscribe anywhere, you know, which is just amazing. I mean, those people will probably get swatted down pretty quickly, won't they?

19:02So it's a good, it's a good call out right there. So if you're doing transactional messaging where, you know, you, you asked for a mail to be sent to you, like, you know, password reset kind of thing, then those emails don't have to actually have an unsubscribe in it. It's, it's actually not required. So there are some types of emails you can send that will not be looked at or won't be scrutinized in that manner. Okay. But it is still a good practice, you know, to put them in every communication you send out just to make it so people don't mark you know say this is spam that's the worst thing we want we don't want that yeah i mean yeah absolutely yeah we want to make it easy as possible right and some with the unsubscribed there are some customers and users that would like to have like a preference center where you can choose which list you want to subscribe from right right that is not filling fulfilling that requirement in other words you can still do it but you have to have that one click unsubscribed so that you have it at the top.

20:03And that, and that unsubscribes from any list, right? Yes. Okay. So, so let's end up by, let's end this by scaring people. What happens if I just go, ah, that seems really hard. I'm not going to do it. What's, what's going to happen to, you know, let's say by summer, if you just ignore this. So if you ignore it, you are most likely going to start seeing most, if not all of your emails bounce and not be delivered. If you have your DMARC record in place by chance, you're going to start getting flooded with a lot of failures, right? But the bounce messages will be very clear that come back to your provider.

20:41They can see, we can look at the send logs and see the messaging and say, yep, you are bouncing because you don't have DKIMM plot implemented. You don't have SPF implemented. You haven't done anything. So, you know, you're going to see a major impact, especially Google and Yahoo. But we also know other mailbox writers are going to follow this example. Well, and I suspect you start having 50 % bounce rates, your ESP is going to, or somebody is going to start blacklisting your domain period, right? That's right. And ActiveCampaign, we actually have automated systems in place. We monitor that across all accounts.

21:18And if an account hits a certain threshold on their bounce rates for a particular campaign, we actually have a compliance team that will reach out proactively and say, hey, by the way, we've observed your bounce rate went a little higher than we were expecting. Let's have a chat and figure out what's going on and see how we can help you recover from that. Because this also has a risk of, if you don't do anything, damaging your domain reputation, which ultimately hinders your ability to deliver email. Yeah, period. And then we, so I guess we could also do a whole nother episode on list hygiene, but I know that's not your area of expertise, but we certainly, when you talk about the bounces, I know that, I know we routinely clean those bounces out because, you know, they're going to bounce again.

22:05And so they're just going to add up. JT, I appreciate you taking a moment to share info. Obviously, we didn't tell people exactly how to do this because it is a technical aspect, but hopefully we've given you enough information to go out and buy it done or to talk to your ESP or talk to your IT folks to get this done. So I appreciate you taking a few moments to stop by the Duct Tape Marketing Podcast.