Google has announced ( Email sender guidelines ) that starting February 2024, Gmail will require email authentication to be in place when sending messages to Gmail accounts.
Yahoo is also rolling out similar requirements. The company announced that it will require strong email authentication to be in place by early 2024 to help stem the flow of malicious messages and reduce the amount of low value emails cluttering users’ inboxes.
Are you ready? If you are not sure these are the requirements:
Applicable to all senders:
- Email authentication. This is a critical measure to help prevent threat actors from sending email under the pretence of being from your organisation. This tactic is referred to as domain spoofing and, if left unprotected, allows cyber criminals to weaponise sending domains for malicious cyber-attacks.
- SPF is an email authentication protocol designed to prevent email spoofing, a common technique used in phishing attacks and email spam. As an integral part of email cybersecurity, SPF enables the receiving mail server to check whether incoming email comes from an IP address authorised by that domain’s administrator.
- DKIM is a protocol that allows an organisation to take responsibility for transmitting a message by signing it in a way that mailbox providers can verify. DKIM record verification is made possible through cryptographic authentication.
- Low spam rates. If recipients report your messages as spam at a rate that exceeds the new .3% requirement, your messages could be blocked or sent directly to a spam Folder.
Requirements for senders of more than 5,000 messages per day:
- SPF and DKIM must be in place. Companies that send to Gmail or Yahoo must have Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) authentication methods implemented.
- Companies must have a DMARC policy in place. DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, is an email authentication standard that provides domain-level protection of the email channel.
- DMARC authentication detects and prevents email spoofing techniques used in phishing, business email compromise (BEC) and other email-based attacks.
- DMARC builds on the existing standards of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). It is the first and only widely deployed technology that can make the header “from” domain trustworthy. The domain owner can publish a DMARC record in the Domain Name System (DNS) and create a policy to tell receivers what to do with emails that fail authentication.
- Messages must pass DMARC alignment. This means that the sending Envelope From domain is the same as the Header From domain, or that the DKIM domain is the same as the Header From domain.
- Messages must include one-click unsubscribe. For subscribed messages, messages must contain List-Unsubscribe message headers and a clearly visible unsubscribe link in the message body that can be initiated with a single click (one-click unsubscribe). Unsubscribe actions must be taken for a requesting user within two days.
Google requirements summary:
Requirements for Senders <5,000 per day
Requirements for Senders >5,000 per day
What happens if you miss the deadline?
If your company relies on email to communicate with your customers and you don’t implement email authentication, these changes are going to significantly impact the deliverability of your messages to customers with Gmail and Yahoo accounts.
If you send over 5,000 emails to these accounts daily and fail to have SPF and DKIM, or don’t have a DMARC policy implemented, these non-deliveries will have an even greater impact on your business.
The Cloud Consultancy can help
Contact The Cloud Consultancy and we can review your current configuration, provide feedback and implement SPF, DKIM and DMARC on your behalf.