Email Horror Stories, part 2 of 3

A cold sender that suddenly sends big looks exactly like the thing the filters were built to catch.

Last week was about the dead addresses on your list. This week is about the sender. Picture a domain or IP with no history that goes from a trickle to a flood overnight because someone senior decided the deadline was tonight. A mailbox provider can't tell that apart from a spammer who just bought a new domain.

I'm skipping the warm-up how-to, since you've read it already. What follows is what providers do when the spike lands, and which numbers decide whether you come out the other side.

The creature awakens

Email Horror Stories, part 1 of 3

Your list isn't an asset. It's a graveyard, and mailbox providers are the ones who dig things up.

Every program has one: the file nobody wants to touch. The 2019 petition drive. The rented "likely donors" list a vendor swore was clean. The event sign-ins from a conference three cycles ago. It sits in the ESP, it makes the total look big, and the day someone needs volume, it gets mailed.

Then the bounces show up. This post is about why, and what to do before the next send.

The crypt keeper's ledger

DAY 5 · SEPTEMBER 4, 2026

Track signups, ticket sales, and event revenue automatically—and share progress publicly when momentum is part of the message.

Campaign goals often begin with a number: 1,000 petition signatures, 500 event registrations, 200 VIP signups, or $25,000 in ticket revenue. The harder part is keeping that number current and making progress visible to the people who need to act on it.

Goal Tracking brings targets and live progress into Nucleus so your team can spend less time updating spreadsheets and more time moving the campaign forward.

Connect a target to real campaign activity

Create a numeric goal and connect it to a landing page or event. Nucleus can track total form submissions, total event registrations, VIP signups, paid tickets sold, or ticket revenue.

A goal can follow one specific form or event, or it can track every item in that section. Use an All Events goal to measure registrations across a tour, for example, or an All Landing Pages goal to follow total acquisition across a coordinated campaign.

See progress at a glance

The Goals area includes both grid and table views. Goal cards show the current total against the target, percent complete, target date, public-display status, and a direct link to the connected form or event.

The table view adds search, filtering, and sorting across the details your team needs to manage. Goals automatically move to Completed when the current total reaches the target, helping active priorities remain easy to find.

Turn progress into public momentum

When progress itself can motivate supporters, turn on public display to add a progress bar to the connected landing page or event page. The same option is available for event signup pages, VIP forms, and credentialing forms.

A visible goal can create social proof, reinforce urgency, and show supporters that each signup or ticket moves the campaign closer to a shared result.

Start counting from the moment the goal is created

Goal Tracking is forward-looking. Every new goal begins at zero and counts activity that occurs after the goal is created; it does not backfill earlier submissions, registrations, ticket sales, or revenue.

Each goal displays a Counting since date so your team always knows the measurement window. For the clearest reporting, create the goal before launching the campaign or promotion you want to measure.

Make every target visible and actionable

Goal Tracking connects the number your team is working toward with the activity happening across your forms and events. Whether the progress stays internal or appears publicly, everyone can see what has been achieved and what remains.

Goal Tracking arrives September 4 as the final release of Nucleus Release Week. 

Texting is one of the highest-converting channels a campaign has — but only if your messages actually reach a phone. Before you send a single text, you need to register your sending number with the carriers, and campaigns have two main paths to choose from: shortcode and 10DLC. Picking the wrong one can mean delayed launches, throttled messages, or texts that never arrive at all.

Here's how the two compare, and how to figure out which one fits your campaign.

What Is a Shortcode?

A shortcode is a 5-6 digit number (think " 12345") leased directly from the carriers through a shortcode aggregator. It's built for high-volume, one-to-many messaging — the kind of blast you'd send to a large list all at once.

Pros:

• Very high throughput — shortcodes can send tens of thousands of messages per minute
• Strong deliverability once approved, since carriers pre-vet the use case
• Recognizable format that people associate with legitimate bulk sending

Cons:

• Expensive — leasing a shortcode typically runs several thousand dollars a month, plus setup fees
• Slow to launch — carrier approval (via CTIA/aggregator vetting) can take 8-12 weeks
• Overkill for smaller lists or peer-to-peer style outreach

What Is 10DLC?

10DLC stands for "10-Digit Long Code" — essentially a standard-looking phone number that's registered for business (in this case, campaign) messaging through The Campaign Registry (TCR). It's become the default path for most political texting programs.

Pros:

• Much faster to stand up — registration can be approved in days rather than months
• Lower cost — no shortcode lease fees, just registration and per-message carrier fees
• Works well for both mass texting and more personal, conversational or peer-to-peer programs
• Flexible: campaigns can register multiple 10DLC numbers under one brand for different purposes (fundraising, GOTV, volunteer recruitment)

Cons:

• Lower throughput than a shortcode — carriers cap messages-per-second, so very large blasts take longer to send
• Requires ongoing attention to trust scores and campaign-use-case registration to avoid carrier filtering

The Real Difference: Volume vs. Speed to Launch

The decision usually comes down to two questions:

1. How big is your list, and how fast do you need to reach it? If you're sending to hundreds of thousands of contacts on a tight timeline, shortcode's throughput matters.
2. How soon do you need to be live, and what's your budget? If you're launching mid-cycle and need to be texting within days, 10DLC is almost always the practical answer.

For most campaigns — especially state and local races, or federal campaigns still ramping up — 10DLC hits the sweet spot: fast approval, reasonable cost, and enough throughput for most GOTV and fundraising pushes.

Don't Forget TCPA Compliance

Regardless of which path you choose, registration is only half the equation. Every campaign texting program needs to be built around TCPA (Telephone Consumer Protection Act) compliance:

• Clear, documented opt-in for every number on your list
• Easy opt-out language (STOP/HELP) honored immediately
• Accurate campaign-use-case registration that matches what you're actually sending
• Careful monitoring of complaint and filtering rates, since carriers can throttle or block traffic that looks non-compliant

Getting the registration type right gets your messages eligible to be delivered. Compliance is what keeps them actually landing in inboxes cycle after cycle.

Bottom Line

If your campaign needs to move fast, keep costs manageable, and run a flexible mix of mass and peer-to-peer texting, 10DLC is usually the right call. If you're running a massive, single-purpose blast program at national scale and have months of lead time, a shortcode may be worth the investment.

Series Edition: Section 2 - Authentication Protocols “Your Emails' Identity Crisis”

Your Emails Need an ID Card

SPF, DKIM, DMARC Explained (Without the Jargon)

Here’s an example: You write the ideal email. It has everything. You have a good copy and good design. You send it to 50,000 recipients. Gmail blocks your email.

Why?

Because you didn’t verify your identity.

This is called authentication, and you must do it.

The Trust Problem

These days, ISPs (Internet Service Providers: Gmail, Yahoo, Outlook, et al.) do not trust anything by default. The first thing they want to ask about an incoming email is whether it is legitimate and whether it really came from whoever the sender claims to be.

And why do they do that? Because spammers are sneaky. They use fake domain names, masquerade as your bank, clone organizations, and send you emails which are supposedly sent "from: [email protected]," whereas they were sent from some shady server located in Russia.

To establish authenticity, ISPs designed a special mechanism that we refer to as an email's ID card and authentication protocols!

But here's how things are different: In February 2024, just two years ago, Gmail and Yahoo implemented this rule. If you're not authenticated, and you're trying to send 5,000 emails per day, they will not be accepted or moved to the junk folder without any consideration for the content. You'll be rejected. And today, in 2026, there are even more severe measures in place. There are no temporary warnings from ISPs anymore. Your emails get immediately rejected.

So if you haven't set this up yet, you have a serious problem right now.

The Three Protocols

There are three authentication systems. They work together like a security team. SPF is your basic ID check. DKIM is your certified signature. DMARC is the enforcement layer.

SPF: The Clipboard

SPF stands for Sender Policy Framework. Here's the simple version: SPF is a whitelist.

You make a list of the servers that are allowed to send emails using your domain name. The email will be passed by Gmail if the email comes from any of those servers. Otherwise, the email will fail.

Imagine a bouncer with a list at the entrance of a nightclub. "Names on the list, come in. Not on the list? Then you can stay outside!"

Now here’s the downside: SPF checks the source only. However, a smart attacker can spoof an email if they know the right server. Yet it is crucial. Every domain need SPF.

DKIM: The Wax Seal

DKIM, which stands for DomainKeys Identified Mail, is tougher to spoof than SPF. This involves digitally signing your message, like stamping a wax seal on an envelope.

Here's how it works: Whenever you send an email, DKIM digitally signs it (this is done automatically by your email provider). Once the recipient gets your email, they authenticate this digital signature and ensure two things: (1) that it is genuinely from you, and (2) that it hasn’t been tampered with since sending.

ISPs consider DKIM very important when evaluating emails. If your email has been DKIM-signed, the ISPs give it priority. On the other hand, if it is unsigned, they are suspicious of it.

Good news: Your email provider takes care of DKIM signing automatically.

DMARC: The Boss

DMARC stands for Domain-based Message Authentication, Reporting & Conformance. It's the boss of the group. It combines SPF and DKIM and tells ISPs what to do when something goes wrong.

DMARC has two functions:

1. Enforcement: You inform ISPs about what should happen if an email fails SPF and/or DKIM. Should they reject the email? Quarantine it? Or should they simply monitor it?

2. Visibility: Reports come in that will let you know exactly what's going on in your authentication process.

Here's where you have some serious control and insight.

How They Work Together

SPF checks: Is this coming from an authorized server?

DKIM checks: Is this properly signed digitally?

DMARC policy: If either fails, this is your response.

All three work together to create a castle. Basically, you're saying, "Email security is important to me. IISPs can rely on my emails."

If one of them is missing, there is a vulnerability. The ISPs will take advantage of this by using more filtering.

And it must be monitored. You don’t set it up once and leave it alone.

Why ISPs Got Strict

ISPs are overwhelmed with spam. In fact, approximately 46% of email traffic consists of spam. Thus, ISPs are ruthless when it comes to filtering. And one of the first criteria is authentication.

If your email lacks SPF, DKIM, and DMARC authentication protocols, ISPs will instantly assume that you're a spammer. No "maybe" or "possibly." Assume. Because legitimate businesses always authenticate their messages. Professionals don't send unauthenticated emails. Spammers do.

When Google and Yahoo required authentication two years ago, they weren't being jerks. They were saying, "Look, we are overwhelmed with spam. If you want us to consider looking at your message, show us it isn't a scam."

Why ISPs Became a Bouncer

Approximately 46% of all email that is being sent at this very moment is spam. Yeah, about 46%. That's crazy!

Gmail receives 15 billion unsolicited emails EVERYDAY. Yes, you heard right. 15 BILLION!

That is why they decided to tell everyone that “Nobody can be trusted anymore. Everyone must show ID.”

Having SPF, DKIM and DMARC will mean that you are telling Gmail, “I’m here legally and I take security seriously.” Gmail listens to that.

Not having these three means that Gmail treats you as spam. Since only legitimate businesses authenticate emails.

The Death Spiral (This Is What Actually Happens)

1. You fail authentication -> ISPs won’t recognize you

2. ISPs won’t recognize you -> your emails go through filtering

3. Emails are filtered -> people ignore them -> ISPs see low user activity

4. ISPs see low user activity -> they’ll be stricter with filtering next time

5. You’re on the spam permanently -> nothing goes through anymore

And the worst part about it is that the recovery process is long. We’re talking about weeks or even months. You’re going to be struggling against Gmail and Yahoo to get off the spam blocklist. Your reputation is ruined. And even when you do fix the authentication, Gmail’s not going to trust you anytime soon.

But there’s no need for it at all. This is entirely preventable.

Real Talk

If you’re not positive that SPF, DKIM, and DMARC are configured, chances are good they’re not.

Check it right now. Seriously.

Look up “SPF DKIM DMARC checker,” type in your domain, and you’re done in five minutes. If there’s a problem, send an email to your email service provider ASAP. They’ll get it sorted out.

Not done setting them up. Better get started right now. Don’t wait. Do it today. Gmail and Yahoo aren’t playing games.

What You Need to Remember

Authentication is mandatory. This is true for Gmail and Yahoo, which will enforce it by 2026.

No authentication means automatic fraud. ISPs make no exceptions.

There are serious consequences for making mistakes. Loss of income. Reputational damage. Contractor expenses. Support costs. Loss of elections.

It takes time and money to rebuild your reputation. Preventative measures are less expensive than remedial ones.

You need SPF, DKIM, and DMARC, all three.

Next Section

Authentication is the first hurdle that ISPs put up for your emails. They need to confirm that your emails are authentic before looking at anything else.

But there's a second barrier: sender reputation.

Even when emails are perfectly authenticated, ISPs will still question if they should trust the sender by asking: “Are we sure about this sender?” The answer lies in various metrics such as how many users open your email, how often are you reported as spam, your history of sending, and whether you send to invalid email addresses.

Organizations today are overwhelmed with disconnected systems, delayed reporting, spreadsheets, and manual workflows that slow down decision-making and limit operational visibility.

The new Nucleus MCP Server changes that completely.

Designed to connect AI directly to organizational operations, the Nucleus MCP Server allows teams to interact with their CRM, supporter records, engagement activity, audiences, events, and operational data in real time through conversational AI and intelligent automation.

Ask questions. Get answers. Take action — instantly.

No exports. No disconnected dashboards. No waiting on reports.

One Interface. Full Nucleus Context.

The MCP Server gives organizations direct AI-powered access to the data they already manage inside the Nucleus platform.

Teams can now:

• Pull live reporting and operational insights instantly
• Access CRM, supporter, donor, and engagement data in real time
• Analyze campaign performance without manual exports
• Build smarter audiences and workflows using first-party data
• Surface actionable intelligence faster across teams and departments
• Connect AI directly into organizational workflows and operations

This creates a significantly more intelligent and operationally connected way to work with campaign and organizational data.

Ask Questions. Get Real Answers.

Organizations can interact with their Nucleus environment conversationally using natural language prompts.

Examples include:

• “How many inactive donors opened an email in the last 90 days?”
• “Which supporter segments are most active right now?”
• “Which campaigns drove the highest engagement this month?”
• “What events generated the most volunteer signups?”
• “What does our high-engagement audience universe look like?”
• “Show the full activity history for this supporter.”

Instead of spending time building reports manually, teams can move directly from question → insight → action.

Powered by First-Party Data

The MCP Server is built around the power of an organization’s own data — not disconnected third-party datasets.

Connected data sources include:

• CRM and supporter records
• Email engagement and subscriptions
• Events and registrations
• Audience universes and segmentation
• Donations, memberships, and supporter actions
• Internal operational workflows

Every interaction stays connected directly inside the Nucleus ecosystem for stronger visibility, faster access, and smarter operational intelligence.

Key Capabilities

Conversational Reporting
Use natural language to access reporting, operational insights, and engagement analytics instantly.

AI-Powered Operational Intelligence
Surface actionable insights across campaigns, communications, fundraising, events, and supporter activity in real time.

Real-Time Data Access
Access live organizational data without relying on delayed exports, spreadsheets, or disconnected reporting systems.

Workflow Integration
Connect AI directly into existing organizational operations and workflows managed inside Nucleus.

Smarter Decision Making
Enable leadership, fundraising, digital, communications, and field teams to make faster, more informed decisions using live first-party data.

Why MCP Server Matters

Most organizations still operate across fragmented reporting systems and disconnected operational tools. MCP Server changes that by connecting AI directly to the operational heart of the Nucleus platform.

For campaigns, nonprofits, advocacy groups, PACs, and enterprise communication teams, this means:

• Faster reporting
• Better operational visibility
• Reduced manual work
• Smarter audience insights
• More connected workflows
• Faster organizational decision-making

This is more than an AI integration. It’s a foundational shift toward AI-powered organizational operations built directly around real workflows and first-party data.

Built for Modern Organizations

MCP Server was designed for campaigns, advocacy organizations, nonprofits, PACs, political organizations, membership organizations, and enterprise communication teams looking to operationalize AI using the data they already manage inside Nucleus.

Interested in MCP Server?

Political campaigns don’t have time for disconnected systems, clunky workflows, or software that only solves one part of the job.

A lot of political campaign software forces teams to piece together multiple tools just to manage basic operations—one for CRM, one for email, one for events, one for landing pages, one for automations, and another to try to make sense of the data after the fact.

That’s not efficient, and it’s definitely not built for the pace of a real campaign.

Campaign Nucleus brings it all together in one connected platform.

From supporter data and outreach to websites, events, automations, and reporting, Nucleus is built to help campaigns move faster, stay organized, and operate from a single source of truth.

Built for Real Campaign Operations

Campaign Nucleus gives political campaigns the tools to actually run the full operation—not just one slice of it.

That includes:

• CRM and supporter profiles • email and outreach • websites and landing pages • event registration and management • automations and follow-up • audience segmentation • reporting and analytics

Instead of stitching together disconnected tools, your team can manage communications, engagement, and campaign activity in one place.

That means less manual work, cleaner data, and a much better workflow across the board.

Better Than the Typical Political Tech Stack

A lot of organizations don’t realize they’re not actually comparing one platform to another—they’re comparing one connected system to a stack of tools that were never really designed to work together.

That’s where Campaign Nucleus stands apart.

Instead of relying on multiple disconnected vendors to manage your campaign, Nucleus gives your team one platform built to support the full operation—from outreach and websites to events, data, and automation.

How Campaign Nucleus Compares

One Platform. Better Execution.

Campaign Nucleus helps campaigns simplify their tech stack and operate more effectively across the full campaign lifecycle.

Instead of bouncing between disconnected systems, your team gets one platform built to support:

• smarter outreach • cleaner data • stronger event execution • faster launches • more connected operations

That’s what makes Nucleus more than just another political campaign software option.

It’s what makes it the better one.

Ready for a Better Political Campaign Platform?

If your current setup feels fragmented, limited, or like it’s creating more work than it should, it’s probably time for something better.

Campaign Nucleus gives political campaigns a more connected, more capable, and more scalable way to operate.