Email Domain Authentication & Email Deliverability Best Practices

Email is one of the most valuable communication channels inside Shape, whether your team is sending one-to-one emails, automated follow-up, drip campaigns, or larger marketing campaigns.

Before you begin sending email at scale, however, it is important to make sure your organization’s sending domain is properly authenticated.

Shape typically handles email authentication as part of the onboarding process. Our team will help configure the sending environment, provide the DNS records your organization needs, verify the records once they are added, and complete the remaining setup.

Your team will need two things to complete this process:

• A business domain your organization owns or controls
• Access to the DNS settings for that domain

For example, Shape can authenticate a business domain such as yourcompany.com or an appropriate sending subdomain such as email.yourcompany.com.

A standard consumer address such as yourcompany@gmail.com cannot be authenticated in the same way because your organization does not control the gmail.com domain or its DNS.

Once authentication is complete, receiving email providers have a way to verify that Shape is authorized to send email on behalf of your organization.

Authentication provides an important technical foundation for email deliverability, sender reputation, and domain protection, but maintaining healthy email performance does not stop there.

This guide walks through both sides of the equation: getting your domain authenticated correctly and maintaining good sending practices once you begin using email in Shape.

What Is Email Domain Authentication?

When an email arrives in someone’s inbox, the receiving email provider needs to determine whether the message legitimately came from the domain it claims to represent.

Email authentication uses records published in your domain’s DNS to help establish that relationship.

The three technologies you will hear about most often are:

• SPF
• DKIM
• DMARC

Together, these standards give receiving email systems additional information they can use to validate the identity and authenticity of messages associated with your domain.

Why Email Authentication Matters

Email providers increasingly rely on authentication, sender reputation, recipient behavior, and other signals when deciding how to handle incoming messages.

Proper authentication helps establish that Shape is an authorized sender for your organization and gives your email a stronger technical foundation.

Establishes Your Sending Identity

Authentication helps receiving email systems verify that Shape has been authorized to send messages associated with your organization’s domain.

Without that relationship in place, receiving systems have less information available to distinguish legitimate business email from spoofed or suspicious messages.

Supports Email Deliverability

Authentication is an important part of modern email deliverability.

It does not guarantee that every message will reach the inbox, but it gives receiving providers stronger identity signals when evaluating your email.

Other factors still matter, including:

• Bounce rates
• Spam complaints
• Recipient engagement
• Sending reputation
• List quality
• Message content
• Sending volume
• Sending patterns

Think of authentication as the technical foundation. Your sending practices determine what you build on top of it.

Helps Protect Your Domain

Authentication can also make it more difficult for unauthorized systems to successfully impersonate your organization’s domain.

DKIM and DMARC, in particular, provide mechanisms that help validate messages and identify unauthorized use of a domain.

Supports Long-Term Sender Reputation

Consistently sending authenticated email from a well-maintained domain gives receiving providers more reliable identity and reputation signals over time.

That becomes increasingly important as your email program grows and your organization begins using features such as:

• Bulk Email Campaigns
• Drip Campaigns
• Automated Actions
• Marketing campaigns
• Large customer databases
• High-volume customer communication

Email Authentication During Shape Onboarding

Shape generally handles email domain authentication as part of the onboarding process.

You do not need to independently configure Shape’s sending infrastructure.

Our team coordinates the setup, provides the required DNS records, verifies that they have been added correctly, and completes the remaining configuration.

There are a few things we will need from your organization to make that possible.

What You Need Before We Can Authenticate Your Domain

1. A Domain Your Organization Controls

You need a business domain your organization owns or otherwise controls.

Examples include:

yourcompany.com

yourbrand.com

companyname.net

Depending on your configuration, Shape may use an appropriate sending subdomain, such as:

email.yourcompany.com

Using a dedicated sending subdomain can help keep Shape email sending organized separately from other email systems or services associated with your primary domain.

Your Shape onboarding team can help determine the appropriate configuration during setup.

2. Access to Your Domain’s DNS

Someone at your organization needs access to the authoritative DNS settings for the domain.

That may be:

• Your internal IT team
• Your website administrator
• Your managed IT provider
• Your domain administrator
• Your hosting provider
• Your web developer
• Another person or company that manages your DNS

Shape provides the DNS records that need to be added, but someone with the appropriate access to your domain needs to add those records.

Can Shape Authenticate Gmail or Outlook Addresses?

This is a common point of confusion because there is an important difference between where your email is hosted and who owns the domain.

Google Workspace or Microsoft 365 Business Email

Suppose your email address is:

jane@yourcompany.com

Your organization may use Google Workspace or Microsoft 365 to host that inbox.

That’s completely fine.

Your organization still controls yourcompany.com, so the domain can generally be authenticated as long as you have access to the appropriate DNS settings.

Consumer Gmail Addresses

Now consider an address such as:

yourcompany@gmail.com

That is different.

Google owns gmail.com, so your organization cannot publish Shape’s authentication records to the gmail.com DNS.

The same principle applies to other public consumer email domains your organization does not control.

If your organization currently relies on a consumer email address and wants authenticated business email through Shape, you will need a business domain your organization controls.

How Email Domain Authentication Works in Shape

The exact records can vary by configuration, but the onboarding process is generally straightforward.

DNS Changes Can Take Time

If Shape cannot immediately verify a record after you add it, don’t assume something is wrong.

DNS changes are not always visible immediately across the internet.

Some providers update relatively quickly, while others can take longer depending on the provider, record configuration, TTL settings, and DNS propagation.

For example, GoDaddy notes that DNS changes often update within an hour but may take up to 48 hours to propagate globally.

If you have recently added the records, Shape may simply need to check them again after propagation has had additional time to complete.

Understanding SPF, DKIM, and DMARC

You do not need to become a DNS expert to complete your Shape onboarding, but understanding the basics can make the process much less confusing.

SPF

SPF, or Sender Policy Framework, allows a domain to publish information about which mail systems are authorized to send email on its behalf.

Receiving mail providers can use that information as one signal when evaluating where a message came from.

DKIM

DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to outgoing email.

The receiving mail system can validate that signature against information published in DNS.

This helps verify that the message is associated with an authorized sending configuration and has not been improperly altered in transit.

DMARC

DMARC, or Domain-based Message Authentication, Reporting & Conformance, builds on SPF and DKIM.

DMARC allows a domain owner to publish a policy describing how receiving systems should handle messages that do not meet applicable authentication requirements. It can also provide reporting that helps domain administrators understand how their domain is being used for email.

If your organization already has DMARC configured, do not make unrelated changes to your existing DMARC policy simply to complete Shape authentication unless those changes have been reviewed by the appropriate person responsible for your organization’s email security.

Authentication Does Not Guarantee Inbox Placement

This distinction is important.

A successfully authenticated domain does not guarantee that every message sent through Shape will reach the recipient’s primary inbox.

Receiving email providers make their own delivery and filtering decisions.

Even authenticated messages can be filtered or rejected when other sending signals are poor.

Those signals can include:

• Bounce rates
• Spam complaints
• Unsubscribes
• Recipient engagement
• List quality
• Sending reputation
• Message content
• Sending volume
• Sending patterns

Authentication establishes who is sending.

Good email practices help establish whether recipients and email providers want to continue receiving what you’re sending.

Start With Healthy Email Data

One of the most effective ways to protect email performance is also one of the simplest: send to good data.

Review your email audiences periodically and pay particular attention to addresses that:

• Consistently bounce
• Are invalid or incorrectly formatted
• Are outdated
• Have unsubscribed
• Have not engaged for an extended period
• Came from old or questionable data sources

Repeatedly sending to addresses you know are invalid can negatively affect your sending reputation.

Consider Email Validation

Shape’s Email Validation tools can help identify whether an email address appears deliverable before you send to it.

Email Validation can be particularly valuable when:

• Importing an older database
• Preparing a large bulk email campaign
• Receiving third-party lead data
• Re-engaging older contacts
• Working with records where email quality is uncertain

The larger and older the audience, the more valuable it can be to understand the quality of the data before sending at scale.

Segment Your Audience

Just because you can email your entire CRM database does not necessarily mean you should.

Shape gives you the ability to build targeted audiences using CRM information such as:

• Status
• Source
• Assigned user
• Tags
• Dates
• Custom fields
• Engagement
• Other record information

Instead of sending one generic message to everyone, you can build audiences around the people for whom the message is actually relevant.

For example:

Past Customers + Specific Product

Active Leads + Selected Source

Records Created Within a Specific Timeframe

Engaged Contacts + Recent Activity

Better segmentation can improve relevance while reducing unnecessary sending volume, unsubscribes, complaints, and potential deliverability issues.

Consider Your Opt-In Strategy

Organizations should determine the appropriate consent and opt-in processes for their own business and communication strategy.

For organizations that want an additional confirmation step, confirmed or double opt-in workflows can help verify that the person submitting an email address actually controls that address.

Shape Lead Engine forms and other configured workflows can be incorporated into an organization’s lead-capture and consent strategy where appropriate.

Shape Automatically Supports Email Unsubscribes

Recipients need a clear way to stop receiving applicable marketing communications.

Shape automatically includes an unsubscribe option on applicable marketing and bulk emails.

When a recipient uses that option, Shape updates the applicable Email Unsubscribe preference within the CRM and prevents future eligible email communication.

This helps keep email preferences connected directly to the contact record instead of requiring your team to manually maintain a separate unsubscribe list.

Email Content Best Practices

Technical configuration is only one part of a healthy email program. What you send matters too.

Write Clear Subject Lines

Your subject line should accurately represent the email.

Avoid unnecessary use of:

• ALL CAPS
• Excessive punctuation
• Misleading statements
• Artificial urgency

The goal is to give recipients a legitimate reason to open the message, not trick them into opening it.

Personalize When It Makes Sense

Shape templates and merge fields can incorporate relevant CRM information into your emails.

Personalization is most effective when it makes the communication genuinely more useful or relevant to the recipient.

Balance Text and Images

Avoid building an email that depends entirely on images.

Some email clients block or delay images, so a recipient should still understand the purpose of your message if an image does not load.

Where supported, descriptive alt text can also provide additional context.

Make the Next Step Clear

If there is an action you want the recipient to take, make it easy to understand.

Depending on your industry and use case, that might be:

• Apply Now
• Schedule an Appointment
• View Your Account
• Learn More
• Complete Your Application

Try not to overwhelm the recipient with too many unrelated actions in the same email.

Design for Mobile

A significant portion of email is read from mobile devices.

Use:

• Shorter paragraphs
• Readable font sizes
• Simple layouts
• Clear spacing
• Mobile-friendly buttons

Always consider what your message will look like on a smaller screen.

Use Shape’s Email Reporting to Monitor Performance

Email shouldn’t be a “send it and forget it” channel.

Shape includes email reporting that can help your team understand what happens after messages are sent.

Depending on the email or campaign, reporting may include:

• Sent
• Delivered
• Failed
• Bounced
• Opens
• Clicks
• Unsubscribes
• Complaints
• Other applicable engagement information

Shape also provides record-level engagement information, including metrics such as Total Opened Emails and Total Clicked Emails where available.

Use this information to identify patterns over time.

If a particular audience has a significantly higher bounce rate, that’s worth investigating. If one type of campaign consistently receives stronger engagement, that can help inform future messaging.

The goal is not simply to send more email. It is to send useful email to the right audience and understand how that audience responds.

Understanding Email Bounces

A bounce occurs when an email cannot be successfully delivered to the intended address.

Bounces can happen for several reasons.

Some are permanent, such as:

• A nonexistent email address
• An invalid address
• A closed mailbox

Others can be temporary, such as a recipient mail server temporarily rejecting a message.

Regardless of the reason, bounce rate is an important signal in email reputation and deliverability.

Shape’s Bounce Rate Policies

Shape, like other platforms that provide email sending infrastructure and services, requires customers to maintain reasonable bounce rates.

This is important because sending reputation is not determined solely by whether your domain has been authenticated.

High bounce activity can indicate poor-quality sending data and can negatively affect email reputation and the reliability of the broader email delivery environment.

Shape monitors bounce rates and other applicable email metrics and may take action when sending activity exceeds acceptable thresholds.

Why Shape Monitors Bounce Rates

High bounce rates can indicate issues such as:

• Invalid email addresses
• Old or poorly maintained databases
• Low-quality imported data
• Poor lead-provider data
• Sending to contacts whose information has not been maintained
• Other list-quality problems

These issues can negatively affect sending reputation.

For that reason, Shape monitors email activity and may take reasonable steps to protect the reliability and reputation of the platform’s email sending infrastructure.

Managing Bounced Email

Shape receives applicable bounce information and provides email reporting that can help users identify affected addresses.

Depending on the situation, your team may choose to:

• Correct an inaccurate email address
• Validate questionable email addresses
• Remove invalid addresses from future campaign audiences
• Apply Email Unsubscribe when appropriate for your organization’s workflow
• Exclude problematic records from future campaigns
• Use Automated Actions to identify, tag, or otherwise manage bounced addresses for review

The important part is not continuing to repeatedly send to addresses that you know are problematic.

Monitoring and Alerts

Shape monitors bounce rates and other important email metrics.

If a customer’s sending activity or bounce rate exceeds acceptable thresholds, Shape may:

• Notify the customer
• Request that the sending audience or underlying data be reviewed
• Recommend corrective action
• Limit or pause applicable email sending when necessary to protect sending reputation and platform reliability

This is one of the reasons we strongly recommend paying close attention to list quality before sending to older, imported, purchased, third-party, or otherwise uncertain databases.

Segmentation Can Help Reduce Risk

Audience segmentation isn’t only useful for creating better marketing campaigns.

It can also help protect sending quality.

Sending to more relevant and better-qualified contacts instead of indiscriminately sending to every address in the CRM can help reduce:

• Bounces
• Complaints
• Unsubscribes
• Low engagement

It also gives your team much better information about which audiences are actually responding to your communication.

Be Careful With Large or Older Email Lists

Historical databases deserve additional attention.

A large list that has not been contacted recently may contain:

• Old email addresses
• Closed accounts
• Abandoned mailboxes
• Incorrectly entered addresses
• Contacts who no longer recognize your organization

Before sending a large campaign to an older database, consider:

1. Reviewing where the data came from and how old it is.
2. Segmenting the audience into manageable groups.
3. Running Email Validation where appropriate.
4. Starting with newer, higher-quality, or more engaged records.
5. Monitoring bounce and complaint rates.
6. Expanding the audience after reviewing the initial results.

This is particularly important when importing historical data into Shape.

A database containing thousands of records can be extremely valuable, but treating every email address as equally current and deliverable can create unnecessary risk.

Helpful DNS Articles for Common Domain Providers

If your team manages its own DNS, the resources below can help you locate the settings needed to add the DNS records provided by Shape.

The exact interface and terminology may vary depending on your provider and account configuration.

GoDaddy

GoDaddy: Add a Subdomain

Use this article if Shape has asked your team to create or configure a sending subdomain.

GoDaddy: Manage DNS Records

Use this article to locate the area where DNS records can be added or modified.

Bluehost

Bluehost: DNS Management, Add, Edit, or Delete DNS Entries

This covers accessing and managing DNS records for domains using Bluehost.

HostGator

HostGator: Make DNS Changes for a Domain Purchased Through HostGator

This covers DNS management for applicable domains managed through HostGator.

DreamHost

DreamHost: Adding Custom DNS Records

This covers adding custom DNS records through DreamHost’s DNS settings.

Not Sure Where Your DNS Is Managed?

The company where your domain was originally purchased is not necessarily the company currently managing its DNS.

If you’re unsure where the records need to be added, check with:

• Your internal IT team
• Your website administrator
• Your managed service provider
• Your web developer
• Your domain registrar

The records need to be added wherever the domain’s authoritative DNS is currently managed.

Once the records have been added, let your Shape onboarding or support contact know so our team can verify the configuration.

Troubleshooting Email Domain Authentication

Shape Can’t Verify the DNS Records

Start by checking:

• Was the correct domain updated?
• Does the Host or Name exactly match what Shape provided?
• Was the correct record type selected?
• Was the record Value copied exactly?
• Was the record successfully saved?
• Has enough time passed for the DNS change to propagate?

If everything appears correct and Shape still cannot verify the configuration, contact Shape Support.

I Don’t Have Access to Our DNS

Contact the person or company that manages your domain.

Shape can provide the necessary records and help verify the setup, but DNS changes must be made by someone with the appropriate access to your organization’s domain.

We Use Google Workspace

That’s fine.

If your address is something like user@yourcompany.com, it can still generally be authenticated as long as your organization controls yourcompany.com and has access to its DNS.

Google Workspace is simply hosting the email.

We Use Microsoft 365

That’s also fine.

The important requirement is that your organization controls the business domain and its DNS.

We Only Have a Gmail.com Address

A consumer @gmail.com address cannot be authenticated as your organization’s sending domain because your organization does not control the gmail.com DNS.

You’ll need a business domain your organization controls to complete domain authentication.

Our Domain Used to Be Authenticated but Now Shows as Unverified

DNS configurations can change after your initial Shape setup.

If authentication was previously working, consider whether:

• DNS records were recently edited
• Your DNS provider changed
• Your nameservers changed
• The domain was transferred
• Your organization completed an IT or website migration
• Existing authentication records were removed

Contact Shape Support if you need help determining which record is missing or no longer resolving correctly.

Frequently Asked Questions

Does Shape handle email domain authentication during onboarding?+

Yes. Domain authentication is normally completed as part of onboarding for organizations that will be sending email through Shape.

Shape provides the required records, verifies the configuration, and completes the applicable sending setup.

What do we need to authenticate our email?+

You need a business domain your organization controls and someone with access to its DNS settings.

Do we need to buy another domain specifically for Shape?+

Not necessarily.

Shape can typically authenticate an appropriate subdomain of your existing business domain.

Why might Shape use a subdomain?+

A sending subdomain can help keep Shape email sending organized separately from other services and systems associated with your primary domain.

Can Shape authenticate a Gmail.com address?+

No. Your organization does not control the gmail.com domain or its DNS.

What about Google Workspace?+

Yes. If Google Workspace hosts an address such as user@yourcompany.com, Shape can generally authenticate the applicable domain because your organization controls yourcompany.com.

What about Microsoft 365?+

The same principle applies. Microsoft can host your organization’s email while your organization still owns and controls the underlying domain.

Who needs to make the DNS changes?+

Anyone with appropriate access to your DNS can add the records.

That could be your IT administrator, domain administrator, website administrator, web developer, or managed service provider.

Does Shape make the DNS changes for us?+

Shape provides the required DNS records and verifies the configuration.

If Shape does not manage your domain, someone with access to your organization’s DNS needs to add the records.

How long does domain authentication take?+

Once the records are entered correctly, timing depends partly on DNS propagation.

Shape can finalize the applicable configuration once the required records are publicly visible and can be verified.

Does domain authentication guarantee that my email will reach the inbox?+

No.

Authentication is an important part of email deliverability, but receiving providers also consider factors such as sender reputation, bounce rates, spam complaints, recipient engagement, list quality, sending behavior, and message content.

Why does Shape monitor bounce rates?+

Bounce activity can affect sender reputation and the reliability of email delivery infrastructure.

Monitoring bounce rates helps Shape identify potential list-quality or sending issues and protect the reliability and reputation of its sending environment.

What happens if our bounce rate gets too high?+

Shape may contact your organization, request corrective action, recommend reviewing your audience or underlying data, or limit applicable email sending when necessary to protect sending reputation and platform reliability.

How can we reduce our bounce rate?+

Start with the quality of your data.

Common steps include:

• Cleaning outdated data
• Correcting invalid addresses
• Running Email Validation
• Segmenting your audiences
• Avoiding large sends to old or unverified databases
• Monitoring bounce reporting
• Reviewing data received from third-party sources

Should we use Email Validation before a large campaign?+

It can be especially useful when sending to older, imported, third-party, or otherwise uncertain email data.

Does Shape provide email reporting?+

Yes. Shape includes reporting for applicable email delivery and engagement activity, including sends, delivery, failures, bounces, opens, clicks, unsubscribes, bulk campaigns, and other email activity.

Does Shape automatically handle email unsubscribes?+

Shape automatically includes an unsubscribe option on applicable marketing and bulk emails.

When a recipient unsubscribes, Shape updates the corresponding email preference so future eligible email communication is blocked.

What happens if we change domains?+

Contact Shape before beginning to send from the new domain.

The new domain or applicable sending subdomain will need to be authenticated before it is used for applicable Shape email sending.

Build a Healthy Email Sending Foundation

Shape takes care of much of the technical work required to prepare your organization for authenticated email sending.

During onboarding, our team helps establish the sending configuration, provides the required DNS records, verifies the setup, and gets your organization ready to send through Shape.

From there, the quality of your email program depends heavily on how you use it.

Keep your database clean. Validate questionable addresses. Segment your audiences. Respect unsubscribes. Monitor engagement. Pay attention to bounces and complaints. Take additional care with older and imported data.

With the technical foundation and good sending practices working together, your team can get much more value out of Shape’s one-to-one email, automation, drip campaigns, bulk campaigns, and email reporting while protecting the sender reputation you’ve worked to build.