Google and Yahoo Updated Email Authentication Requirements for 2024
Google and Yahoo have introduced a brand new set of email authentication requirements for bulk message senders (those who send > 5000 emails per day), instructing them to deploy email authentication protocols like SPF, DKIM, and DMARC, enable easy unsubscription, and focus on message relevance.
Google has been the pioneer in encouraging, exercising, and enforcing stringent privacy policies regarding email transactions and communication, to ensure end-to-end protection of information. The new email authentication requirements aim to reduce email fraud and take a stricter approach towards spam reduction in 2024.
New Gmail Email Authentication Requirements
In their latest announcement, Google notified that starting in the first quarter of 2024, domain owners who send bulk messages to Gmail addresses would be required to authenticate their emails. This, in turn, would ensure that receivers can easily unsubscribe from receiving emails that do not interest them and maintain a less spammy inbox.
White Gmail’s AI-powered defensive measures that are already integrated into their email systems stop spam, phishing, and other forms of email fraud by 99.9% – restricting nearly 15 billion undesired emails daily. They are keen on taking it one step further by making it mandatory for senders sending more than 5000 messages to Gmail inboxes per day to validate their emails.
Yahoo Follows Suit in Establishing Strong Email Authentication
Yahoo isn’t far behind either as they described their key objective to provide an optimal emailing experience to ensure receivers only receive messages that might be of interest to them, filtering out the rest.
To meet this objective, Yahoo in their latest announcement declared that in 2024 bulk message senders would be required to authenticate their emails against popular email authentication standards, enable one-click unsubscription options, and send emails that are of value to Yahoo users.
New Email Authentication Requirements for Bulk Email Senders
1. Authenticate Your Emails with SPF, DKIM, and DMARC
Both Google and Yahoo have declared that it is required for all bulk senders to implement email authentication protocols SPF, DKIM, and DMARC correctly for all their email domains. This would make sure threat actors can’t impersonate legitimate domain names to send spam messages to their user base.
Sender Policy Framework, or SPF will allow bulk email senders to authorize your legitimate senders by allowing only permitted sending domains and IPs to send emails on behalf of their domain – thereby reducing spam complaints.
DomainKeys Identified Mail (DKIM) helps protect your email’s content from being altered while in transit by adding digital signatures to message headers.
DMARC binds it all together by aligning messages against SPF and/or DKIM checkpoints and setting up instructions for receiving servers to accept, quarantine, or reject misaligned emails. It helps protect your email messages against phishing attacks, spoofing, business email compromise, and more email-based attacks.
2. Easy One-click Unsubscription
Email users should be able to unsubscribe from receiving emails from a particular sender with just one click! One-click unsubscribe mechanism is another bulk email requirement declared by Google and Yahoo to make it easier for receivers to opt out of receiving messages that do not interest them and maintain a spam-free inbox.
3. Stay Under the Spam Rate Threshold
While Google uses several technical measures to block out spam messages from reaching their users, to make the experience even better and more efficient they would be pioneering a clear threshold for spam that needs to be maintained, ideally below 0.1%, thereby ensuring that their receivers can further avoid receiving unwanted or potentially malicious messages. By all means, the spam rate shouldn’t be equal to or exceed 0.3%.
Yahoo recommends keeping the spam rate below 0.3% as well.
General Gmail Email Sender Requirements
While the above-mentioned set of new Google sender requirements has been recently introduced to further reduce spam for users, Google has been urging users to follow safe sender practices for a long time. Here are a few general email sender requirements that were in place before:
- Email Senders must authenticate their emails against SPF or DKIM
Note: In general, DMARC requires either SPF or DKIM domains to align for compliance, however, Google specifically mentions the requirements for both SPF and DKIM alignment for only bulk senders. Bulk-sending sources that have no DKIM signature enabled, but are DMARC compliant via SPF, will still be subject to disqualification.
- Sending domains and IP addresses must have valid PTR records
- Your message’s spam rate must be below 0.3% (Google recommends using Google Postmaster tools for running your spam rate check)
- Your message format should adhere to the IMF specifications as mentioned under RFC 5322
- Owing Gmail’s adoption of DMARC quarantine policy, impersonating Gmail From: headers can now land you into trouble and reduce your mail delivery rates
- The domain in the sender’s “From:” header must match the domain in either the return-path header (for SPF) or the DKIM signature header
- Forwarded emails must be signed with ARC
Learn more about these requirements in Google’s document.
General Yahoo Email Sender Requirements
General email senders for Yahoo must adhere to the following requirements:
- Senders must enable SPF or DKIM email authentication
- Keep spam rate below 0.3%
- Have a valid forward and reverse DNS record for your sending IPs
- Follow RFCs 5321 and 5322
A Gradual but Progressive Approach to Email Sender Requirement Enforcement
Yahoo and Google are making constant updates and changes to their email authentication requirements, hinting at the fact that the enforcement will be gradual but progressive. Here are the latest timelines of enforcement:
- Google has informed that enforcement for bulk senders for most guidelines would start from February 2024, where non-compliant senders may expect to see temporary and sporadic delays in message delivery and communication. With time the delays may transform into outright rejections at full enforcement, with a steady increase in the number of emails identified as non-compliant. The deadline for the one-click unsubscription feature has been extended to June 2024.
- Yahoo has informed that enforcement for most guidelines and requirements including email authentication (DMARC, SPF and DKIM) mandates will start from February 2024, apart from the one-click unsubscription feature, the deadline for which has been extended to June 2024.
It is important to note that the timelines and requirements may keep changing as Google and Yahoo add new mandates and extend deadlines for enforcement to ensure every sender has adequate time to maintain the highest standards of email sending practices. We will keep updating this blog for interested readers to return to from time to time and monitor the latest updates!
PowerDMARC Helps You Adhere to These New Requirements
Click here to book a FREE Discovery Call with a Fidelitech Solutions team member and get a free Domain Compliance Checkup and Save on PowerDMARC.
Enabling email authentication protocols requires strong technical knowledge and a deep understanding of the validation process. PowerDMARC is formed by a team of experts that help you activate DMARC, SPF, and DKIM easily for your emails with hosted services that enable monitoring and reporting on a single cloud interface.
We help you take simple and actionable steps:
- Understand email authentication and DMARC policies
- Set up DMARC, SPF, and DKIM
- Check the correctness of your setups with a single click
- Monitor your authentication results and deliverability
- Gain access to a range of other tools for advanced email protection
We also provide 24/7 assistance with a commitment toward customer satisfaction and one-on-one support to ensure a smooth transition to enforced policies without the risk of email deliverability issues. Contact us today to get started!
In addition to this, it is important to enable a one-click unsubscribe header and keep your spam rate to a minimum to ensure that you’re adhering to Google and Yahoo’s latest requirements before 2024.
Click here to book a FREE Discovery Call with a Fidelitech Solutions team member and get a free Domain Compliance Checkup and Save on PowerDMARC.
