If you have a domain name that you use for business emails – you need to be aware of upcoming changes that will affect your ability to send “bulk” email.
From 1st February, Google, Yahoo and others will no longer deliver emails from domain names where DMARC, SPM & DKIM settings are not correctly configured. This could prevent you from sending emails from accounting systems like Xero, marketing emails from Mailchimp, or e-commerce systems like Shopify (they’ve already put out a warning about this).
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email-validation system designed to protect your domain name from being used for email spoofing, phishing scams, and other cybercrimes.
It allows you to set policies that validate the authenticity of the sender of an email, ensuring that the sender’s domain name matches the domain in the email address. If an email fails this check, DMARC helps decide what should be done with it, like rejecting it or putting it into the spam folder.
It’s not something that is setup out of the box when you register a domain name – you need to ensure this has been properly configured by your IT department / support provider.
Incorrectly configured settings can also leave you wide open to impersonation / spoofing attacks that can lead to scams – and losing money.
What are the new criteria that need to be met?
As of February 2024, Google will start to require that bulk senders:
- Configure SPF & DKIM correctly: These are technical controls that effectively stamp a mark of approval on emails that you send as being legitimate. If these aren’t configured correctly, emails that you send will likely get caught as spam, or not be delivered at all. Whenever you start using a new system to send emails, it’s important that SPF & DKIM are updated so that these emails get through.
- Authenticate their email with DMARC: You shouldn’t need to worry about the intricacies of email security standards, but you should be able to confidently rely on an email’s source. Google are requiring those who send significant volumes (currently 5,000 a day) to strongly authenticate their emails following well-established best practices. Ultimately, this will close loopholes exploited by attackers that threaten everyone who uses email.
- Enable easy unsubscribe: You shouldn’t have to jump through hoops to stop receiving unwanted messages from a particular email sender. It should take one click. Google are requiring that large senders give Gmail recipients the ability to unsubscribe from commercial email in one click, and that they process requests within two days. They’ve built these requirements on open standards so that once senders implement them, everyone who uses email benefits.
- Ensure they’re sending wanted email: Nobody likes spam, and Gmail and other providers already include many tools that keep unwanted messages out of your inbox. To add yet another protection, moving forward, they will enforce a clear spam rate threshold (0.3%) that senders must stay under to ensure Gmail recipients aren’t bombarded with unwanted messages.
These are the criteria that Google have set out – but Microsoft and other email providers are also getting tough on this.
It’s not all bad news
The good news is that it is fairly easy to setup – and will result in emails that you send being more likely to hit your recipient’s inboxes (rather than being marked as spam).
As a result of these changes, we will all receive less spam in our inboxes – who wouldn’t want that?!
Need help managing your email security?
Looking after complex email settings such as SPF, DKIM & DMARC for our customers is just one of the services included in our comprehensive support packages – get in touch if you’d like to know more.
