Your email has a passport problem.
There’s a specific kind of Monday this post is about. Your campaigns have been fine for months. Open rates hover where they always hover. Then, over a week or two, everything sags — opens down by a third, revenue per send down with them, and when you email yourself a test from a Gmail account, there it is: your beautiful campaign, sitting in the spam folder like it did something wrong.
Nine times out of ten, when this happens to a store that didn’t suddenly start blasting purchased lists, the cause is authentication. Not content, not “spammy words,” not the emoji in your subject line. Authentication — the technical identity layer underneath every email you send.
Most founders treat this layer as invisible plumbing. Then Gmail and Yahoo changed the rules in 2024 and made it mandatory plumbing, and a lot of previously-fine senders discovered their pipes were held together with tape.
Email is a border crossing
Here’s the metaphor that makes the whole system click, and I’ll lean on it for the rest of this post: every email you send is a traveller arriving at a border, and the inbox provider is passport control.
The traveller claims an identity: “I’m from yourbrand.com.” Passport control’s job is to decide whether to believe that claim. Anyone can say they’re from yourbrand.com — writing a from-address costs nothing, which is exactly how phishing works. So the receiving server checks documents.
There are three documents, and they’re the three acronyms you’ve been avoiding:
SPF is the list of approved carriers. It’s a DNS record on your domain that says “mail claiming to be from me is allowed to arrive via these servers.” When Klaviyo sends on your behalf, SPF is how Gmail confirms that Klaviyo’s servers were authorised couriers for your domain — like a country publishing which airlines are allowed to fly its citizens in.
DKIM is the tamper-proof passport itself. Your sending platform cryptographically signs each message with a private key; a public key published in your DNS lets any receiver verify the signature. A valid DKIM signature proves two things: the message really was authorised by the domain that signed it, and nobody modified it in transit. Forged or altered mail fails the check the way a doctored passport fails under the UV light.
DMARC is the border policy. SPF and DKIM verify documents; DMARC is the instruction sheet that tells passport control what to do with travellers whose documents don’t check out. It’s a DNS record with a policy value: p=none (“let them through, but log it”), p=quarantine (“send them to secondary inspection” — the spam folder), or p=reject (“turn them away at the gate”). It also tells receivers where to send reports, which is how you find out someone in another country is forging your passport.
Passing is not the same as aligned
Here’s the part that catches even technically comfortable people, and it’s the single most common authentication failure I find in audits: your mail can pass SPF and DKIM and still fail DMARC.
Back to the border. Imagine a traveller shows up with a perfectly genuine passport — but it’s someone else’s. The document itself verifies fine. The problem is that the identity on the document doesn’t match the identity the traveller is claiming. That mismatch is what DMARC calls an alignment failure.
Concretely: when Klaviyo sends without a branded sending domain, the DKIM signature comes from Klaviyo’s shared infrastructure — the passport says something like klaviyomail.com. Your from-address says hello@yourbrand.com. Both documents are genuine. Neither matches the claimed identity. Under the 2024 Gmail and Yahoo sender requirements, bulk senders must have DMARC, and DMARC requires that at least one of SPF or DKIM not only passes but aligns — the domain in the verified document must match the domain in your visible from-address.
This is why the fix for that sagging Monday is almost never “tweak the subject lines.” It’s a dedicated (branded) sending domain: a subdomain like send.yourbrand.com, delegated to Klaviyo, so that the DKIM signature and your from-address finally point at the same root identity. Traveller and passport agree. Alignment.
One sharp edge to know: alignment is checked against the root domain. If your branded sending domain is send.yourbrand.com, then hello@yourbrand.com aligns, because both share the root yourbrand.com. But if someone in marketing decides the from-address should be the agency’s domain, or an old .co variant of your brand, alignment breaks silently and deliverability follows a few weeks later. I’ve watched exactly this happen after an innocent “let’s freshen up the sender name” change.
The actual setup, in order
The mechanics take under an hour. The DNS propagation and the courage take a bit longer.
1. Set up the branded sending domain in Klaviyo. Klaviyo gives you a handful of DNS records — CNAMEs for DKIM, a TXT for SPF. You add them wherever your DNS lives. On Cloudflare, the one mistake to avoid: these records must be DNS-only, not proxied. The orange cloud breaks verification, and it’s the number-one reason the Klaviyo verification check spins forever.
2. Publish a DMARC record. A TXT record at _dmarc.yourbrand.com. Start with monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbrand.com
p=none doesn’t protect you yet — it just satisfies the minimum requirement and starts the reports flowing so you can see every source sending as your domain. Most brands are surprised by the list: the store platform, the helpdesk, the accounting tool, an old Mailchimp account nobody killed.
3. Fix every legitimate source, then tighten the policy. Once the reports show all your real senders passing and aligning, move to p=quarantine, and eventually p=reject. That’s the point where the border actually turns forgers away — which protects your customers from phishing and your domain’s reputation from being burned by someone else’s crimes.
4. Re-check alignment after any sender change. New from-address, new subdomain, new tool sending “on behalf of” the brand — each one is a new traveller whose papers need to match. Make it a standing checklist item, not a one-time project.
What this looked like in practice
A brand I work with — eCommerce, in a category where paid ads are restricted, so email carries most of the revenue weight — came to me with campaigns that had drifted into Gmail’s spam folder over about a month. List hygiene was fine. Content was fine. The authentication picture: SPF passing, DKIM passing on shared infrastructure, no DMARC record at all. Under the new requirements, that combination reads to Gmail as “unverifiable bulk sender,” and Gmail had started treating it accordingly.
The fix was the sequence above: branded sending domain on Cloudflare (DNS-only, after the proxied-records lesson), p=none DMARC, two weeks of watching reports, one forgotten transactional tool brought into alignment. Inbox placement recovered over the following sends — not instantly, because reputation heals slower than it breaks, but visibly week over week.
The take
Authentication is the least glamorous work in email and the highest-leverage hour you’ll spend on it. It doesn’t make any single campaign better; it decides whether your campaigns get seen at all. My rule for any brand doing meaningful email volume: branded sending domain, aligned DKIM, DMARC at p=none moving toward p=quarantine — before spending another minute on copy, design, or send-time optimisation. Passport first. Then worry about what you’ll say when you get through the border.