You spent time on your email. The design looks good, the copy feels right, and you hit send. Then the replies come in. Not from people engaging with your content, but from subscribers asking why your email landed in spam. Or no one says anything, and your open rates quietly tell the story.
When emails don’t reach the inbox, most people look at the email itself. The subject line, maybe. The images. But the design of your email is almost never the problem.
The problem is usually something invisible. A technical setting that tells Gmail, Outlook, and other email providers whether your email is safe to deliver.
That setting is called domain authentication. If it isn’t set up correctly in Flodesk, your emails are working against themselves before anyone even opens them.
This is the first stop in a summer check up I’m running through Flodesk Maven this year, working through the technical pieces that quietly affect deliverability before Q4 hits. If you’re catching this later in the series, you can find the rest on the blog.
What is domain authentication?
When you send an email through Flodesk, it doesn’t go straight from you to your subscriber’s inbox. First, it gets checked.
Email providers like Gmail and Outlook run automatic checks on every email they receive. These checks exist because spam and fake emails are extremely common. Providers need a way to decide whether your email is safe and genuine or should be blocked.
Domain authentication is how your emails prove they are genuine. It tells the receiving email server: This email from hello@yourbusiness.com was really sent by someone authorised to use that domain.
Without this proof, providers have no reason to trust your email. Even if the content is completely legitimate.
This matters more than ever right now. In 2024, Gmail and Yahoo made proper authentication a hard requirement. If you send emails to Gmail or Yahoo addresses, which almost certainly includes most of your list, your authentication setup is no longer optional.
The three parts of authentication: SPF, DKIM, and DMARC
Domain authentication is made up of three records. These records live in your domain settings and work together to prove your emails are legitimate. You don’t need to be technical to understand what each one does.
SPF tells receiving email servers which services are allowed to send email on behalf of your domain. When you send through Flodesk, Flodesk’s servers do the actual sending. SPF tells providers this is allowed. Without it, providers see an email coming from a server they don’t recognise.
DKIM adds a digital signature to every email you send. The receiving server uses this signature to confirm two things: the email genuinely came from your domain, and the content wasn’t changed after it was sent. Think of it like a tamper-proof seal on a package.
DMARC sits on top of SPF and DKIM and tells providers what to do if an email fails those checks. It also sends you reports about emails being sent using your domain, including any unauthorised use, if you configure this part (optional, by the way). DMARC is the part most often missing from DIY setups. And without it, your authentication is incomplete.
All three need to be in place.
Having two out of three is a common situation, and it still leaves your deliverability at risk.
How to complete domain authentication in Flodesk
Flodesk has a dedicated section for this, and it guides you through the process clearly. Here is what to do.
Go to Account Settings > Email setup in your Flodesk account. This is where you add your custom domain email address you want to send from. Use your actual business domain. The same one as your website.
If you are sending from a Gmail or other free email address, this is the moment to change that. Free email addresses hurt your deliverability, and Flodesk will prompt you to use a custom domain.You can add your custom domain email address by clicking the +Add sender button.
Once you add your domain email address in this section, Flodesk generates the DNS records you need. These are the SPF, DKIM, and DMARC values. You’ll find them under Account settings > Domain setup.
You add them to your domain registrar. The place where you manage your domain settings. This is usually somewhere like GoDaddy, Namecheap, Siteground, Squarespace, or Cloudflare.
After you add the records, Flodesk checks for them automatically. This can take a few minutes or up to 48 hours. The platform shows you a clear status for each record so you can see what has been verified and what is still pending.
If you are not sure where your domain settings are, or the process feels unfamiliar, that is completely normal. It is one of the most common things I help clients with.
What happens if authentication is not set up
The consequences are not always obvious at first. Your emails might still send. Some might still reach inboxes. But over time, several things go wrong.
Email providers treat unauthenticated emails with less trust. This means more emails landing in spam, lower open rates, and a sending reputation that gets harder to recover over time. Gmail in particular has become stricter, and senders without DMARC in place now face active rejection, not just filtering.
There is also a security risk. Without DMARC, someone could send emails pretending to be from your domain. There would be no system in place to catch or report it.
Every email you send without proper authentication affects your sending reputation. The longer it goes unaddressed, the more work it takes to fix.
What is domain warming and why does it matter?
If you are setting up a new sending domain, because you are new to Flodesk, switching from another platform, or moving to a custom domain, authentication alone is not enough. You also need to warm your domain.
Domain warming means building your sending reputation gradually. Email providers track the history of every domain. A brand new domain that sends to thousands of people on day one looks suspicious, no matter how good the email is. A domain that starts small, gets good engagement, and grows slowly over several weeks looks trustworthy.
In practice, this means sending to your most engaged subscribers first and increasing your send volume week by week. Watch your analytics during this time for anything that seems off.
If you recently switched platforms or set up a new domain and skipped this step, it is not too late to course-correct. It takes patience, but it works. Right now, before your list traffic ramps up for the holidays, is the easiest time to do this. Warming a domain in October while you’re also trying to run Black Friday campaigns is a much harder position to be in.
Not sure if your authentication is set up correctly?
Many small business owners are in this position: they think it is set up, but they are not completely sure. If that sounds familiar, it is worth checking. The gaps are invisible until they cause a real problem.
If you want someone to look at your account and confirm everything is in order, or find and fix what is not, I can help with both a 1:1 consultation session and as part of a Migration & Setup project.
A consultation session is the right fit if you want to go through your settings together and understand what you are looking at. A setup project is the right fit if you would rather hand it off and have it done correctly from the start.
If you want everything confirmed and working well before your list gets busy in October and November, this is the moment to check it, not after the first dropped campaign.
