The DNS Work Nobody Does Before a Big Email Send

The worst email failure is the one that does not bounce. The send completes, the platform reports delivered, and the messages quietly land in junk or vanish entirely. Nothing tells you. The report looks like a bad campaign instead of a broken one.

We caught this on a client days before a launch send to seventy-seven thousand people, and the fix took two DNS records.

The three records, in the order that matters

SPF lists which servers are allowed to send email as your domain.

DKIM signs each message cryptographically so the receiving server can prove it was not tampered with and did come from you.

DMARC is the instruction to the receiving server about what to do when a message fails the first two. This is the one that decides your fate.

A DMARC policy of p=none means monitor and deliver anyway. p=quarantine means put it in junk. p=reject means throw it away without telling anyone.

Here is the trap. A published DMARC policy of quarantine or reject is a good thing for a business. It is what stops people spoofing your domain. But it means that if you then start sending marketing mail through a platform that has not been authenticated against your domain, you have not created a spam risk. You have created a certainty. The receiving server checks, fails you, and follows your own published instruction.

Our client’s domain published quarantine. Sending their launch campaign from a company address through an unauthenticated platform would have junked the whole thing, silently, with no bounce and no error. The platform would have reported a successful send.

The SPF mistake that takes down your real email

This is the one that turns a marketing task into an outage.

A domain may have exactly one SPF record. Two SPF records do not add together. They invalidate each other, and now nothing you send passes SPF, including the everyday business email your company runs on.

When you add a sending platform, you do not add a second SPF record. You merge its include into the existing one.

Two related things worth knowing:

Many platforms no longer ask for an SPF change at all. Modern authentication is usually a verification token plus a DKIM key, both added as new TXT records that touch nothing existing. If a setup flow is telling you to paste in a whole SPF record, look carefully at whether you already have one.

Do not accept the “authenticate automatically” option blindly. That convenience button is exactly how a duplicate SPF record gets created on a domain that already had one.

And never paste a vendor’s suggested DMARC record without reading it. Setup wizards commonly suggest p=none. If your domain already publishes quarantine, pasting that suggestion downgrades your protection across every piece of mail your company sends, to make one marketing platform easier to configure.

The procedure we use, every time

Save a baseline first. Pull every existing record for the domain and save it to a file before touching anything. MX, SPF, DMARC, any platform verification records. If something breaks later you need to know what it looked like.

Add records additively. New TXT records for verification and DKIM. Do not edit or replace anything you did not come to change.

Re-verify the untouched records afterward, byte for byte. Specifically the MX records and any records tied to the company’s actual mailbox provider. This is a five-minute check that prevents a very bad afternoon.

Confirm inside the platform, then confirm from outside. The platform’s own green checkmark tells you it can see its records. Send a real test to an address on a different provider and read the raw headers. You want to see all three of SPF, DKIM, and DMARC pass.

New domain, new problem

If the plan involves sending from a brand-new domain, the DNS work is necessary and not sufficient.

A domain with no sending history has no reputation, and mailbox providers treat volume from a cold domain as suspicious by definition. Warming up means starting low, in the low hundreds a day, and building over roughly three weeks before you attempt real volume.

Which means the decision to send from a fresh brand domain is a calendar decision, not a preference. If the campaign runs in ten days, you send from the domain that already has a year of history at that volume, set the reply-to address to the brand, and build the new domain’s reputation in the background for next time.

That was exactly the call on our launch. The display name and reply-to carried the brand. The sending infrastructure carried the history. Nobody in the audience could tell, and the campaign landed.

Now the harder truth about your reports

Once the mail is landing, you will start reading the numbers. Most of them are wrong, and consistently wrong in the flattering direction.

Corporate security gateways open your email before the human does. They fetch the message, load the images, and follow the links to check them for malware. Your tracking pixel fires. Your link tracker records a click. Nobody has read anything.

How obvious does this get? On one client’s list, a campaign reported 3,220 opens and 9,691 clicks. Three times as many clicks as opens is not a great campaign. It is arithmetically impossible for humans. That is a scanner following every link in the email, several times over.

We found the same distortion in our own outreach tracking. The dashboard reported a fifty-seven percent open rate. When we filtered out every open that fired within two minutes of send, and particularly the ones that fired within five seconds, the real human rate was about thirty-one percent.

How to read email numbers honestly

Discard opens that fire within a couple of minutes of send. Nobody reads an email in four seconds. That is a machine.

On corporate or B2B lists, do not quote a click rate at all. It is contaminated beyond usefulness. Report opens and unsubscribes, and tell the client why.

Watch unsubscribe rate closely. It is the one metric that requires a human being to take a deliberate action, which makes it the most trustworthy signal on the report.

Judge the campaign on what happened after the click. Sessions, leads, sales. Your own analytics counts a session when a browser loads a page, which is a much higher bar than a pixel firing.

Thirty-one percent, honestly measured, is a good open rate. The point of correcting the number is not to feel worse. It is that a fifty-seven percent open rate with no replies looks like a mystery, while a thirty-one percent open rate with no replies looks like a copy problem, and only one of those is a diagnosis you can act on.

The order of operations

Authenticate the domain. Verify from outside. Warm up if the domain is new. Send. Then read the numbers with the machines subtracted.

Skip the first step and everything after it is measuring a campaign that never arrived.

If you want this handled properly before your next send, that is our email marketing work. If you want to know what happens to the people who do click, run a free audit on the pages they land on. And if you are on Shopify, the flows that actually earn are in the Klaviyo flows every Shopify store needs.

FAQ

What are SPF, DKIM, and DMARC in plain terms?

SPF lists which servers may send email using your domain. DKIM adds a cryptographic signature proving a message genuinely came from you and was not altered. DMARC tells receiving servers what to do when a message fails those checks, and whether to report failures back to you. All three are DNS records on your domain.

Why did my email campaign get delivered but land in spam with no bounce?

Almost always because your domain publishes a DMARC policy of quarantine or reject while your sending platform is not authenticated against that domain. The receiving server follows your own published instruction and junks the mail. Nothing bounces, so the platform reports a successful send. Authenticate the platform with DKIM before your next campaign.

Can I have two SPF records on one domain?

No. A second SPF record invalidates both, which breaks authentication for all mail from that domain including your normal business email. When you add a sending platform, merge its include into the single existing SPF record rather than creating a new one.

Why is my click rate higher than my open rate?

Corporate email security gateways scan messages before delivery. They load images, which fires your open pixel, and follow every link to check it, which fires your click tracking, often multiple times. On business lists this makes click rate meaningless. Report opens and unsubscribes instead, and evaluate the campaign on site sessions and conversions.

How long does it take to warm up a new sending domain?

Roughly three weeks of gradually increasing volume, starting in the low hundreds per day. A domain with no sending history has no reputation, so sudden volume looks like abuse. If your campaign is sooner than that, send from an established domain and set the reply-to address to the brand instead.

Check the plumbing before you turn on the tap

Three DNS records decide whether any of the rest of it matters. Save a baseline, add records additively, verify from outside your own system, and never let a setup wizard downgrade a DMARC policy your business depends on. Then read your reports with the robots subtracted.

Want us to audit your setup before the next send? Book a 15-minute call. No deck, no fluff. Strategy first. Tactics second. The work works.

Reliable PR & Marketing is a strategy-first marketing agency in Bakersfield, California. We run integrated SEO, PR, web, and content for founder-led companies across Kern County and nationwide. Strategy first. Execution always.