Important Enhancements to Yahoo & Gmail Email Security for 2024

Yahoo & Gmail are have implemeted crucial changes in their email authentication protocols for 2024, this is an overall enhancement to inbox security.

Both platforms now require additional verification measures such as domain-based message authentication, reporting and conformance (such as DMARC policies, DKIM's [Domainkeys Identified Mail] and signatures). These policies are for bulk senders that send 5,000 or more messages a day. 

Why is this happening?
Phishing and SPAM email continues to represent a huge problem. Google figures state that Gmail blocks nearly 15 billion unwanted emails every day! Also, according to a Proofpoint survey, there has been a 1265% increase in phishing attempts since the end of 2022. This is why Google and Yahoo have joined forces to make email authentication mandatory. 

The changes are aiming to bolster email security, by ensuring that any incoming emails are properly authenticated, thus reducing the risk of SPAM, phishing attempts and any other malicious activities. The aim is to ultimately improve the delivery of actual legitimate emails to a user's inbox. The changes also focus on better authentication, email relevance, paving the way for new mailbox standards that require senders everywhere to make the necessary improvements.

How the changes will impact you?

Ultimately, failure to implement these authentication changes, will have an overall impact on your delivery rates and struggle to reach the inbox of your target audience. The three key changes are as follows: 

1: Authentication
New requirements involve the following protocols: SPF, DKIM and DMARC - as a bulk sender (sending 5,000 emails a day or more), you will need to adopt all 3 authentication protocols. Use of these 3 policies together will stop email spoofing. 

2: One-click unsubscribes
Senders need to make it easy for any subscribers to opt-out of marketing (including prospecting) emails. This must be a visible link within the email body.

3: The Threshold for spam complaint rates
Senders will be required to consistently keep SPAM rates below 0.1%. That equates to 1 for every 1,000 emails sent. Temporary spikes in the SPAM rate should not reach of exceed 0.3%. Senders need to also monitor their Google Postmaster account (https://www.gmail.com/postmaster/) and only send emails that users want to read.

The journey of an email
Email doesn't travel directly from your server to your recipient. It goes through several checks. It can be different for different ESP's (Email Service Providers). If your email passes these checks, it will be passed to your subscribers inbox. If the recipient email address determines that the email looks suspicious, but isn't obvious SPAM then it might be filtered into the JUNK folder. 

The basics of Sender Policy Framework (SPF)
SPF is an authentication method that lists the IP address of the mailserver and a domain name authorised to send on your behalf. The incoming mail server will check the email header for the return path [reverse path, email FROM and the sender]. The mail server will then verify that the email has originated from one of the IP addresses listed in the DNS text record. Authentication of the sender identity will then be confirmed on IP address verification.

What may an SPF record look like?
TXT @
Value: v=spf1 include:_spf.google.com -all

The Basics of DomainKeys Identified Mail (DKIM)
This is an important layer of authentication and security. It gives users a way to effectively 'digitally sign' their emails. It confirms that the message originates from the server that created the message. It also avoids the message to be intercepted or altered in any way in transit. Therefore it helps stop spammers from spoofing your domain (tricking your recipients with fake messages, appearing to originate from you).

The Basics of Domain-based Message Authentication, Reporting and Conformance (DMARC)
DMARC is also an authentication method and it's designed to stop impersonation attacks, impersonating your brand and impacting your reputation. DMARC defines a policy that tells the receiving server how authentication failures should be handled. Mailbox providers will check the SPF and DKIM records and then refer to the DMARC policy.

What may an DMARC record look like?
TXT @ _dmarc
Value: v=DMARC1; p=none; pct=100; rua=mailto:[email protected]

The Unsubscribe Experience
This should be a user-friendly process, quick and easy. Users tend to mark unwanted messages as SPAM. Therefore, you need to make it easy and simple for them to unsubscribe. When a user unsubscribes, they are simply opting out of receiving future messages, and they will be removed from your list accordingly, thus no longer receiving future emails. There will be no damage to your IP address or your domain reputation. 

However when a GMAIL or Yahoo user marks your message as SPAM, they will stay on your mailing list and continue to receive future emails, but the ISP will re-direct any future emails to the SPAM folder, this will have a negative impact on your sender reputation.

Best practice for email delivery
List hygiene is incredibly important, especially with Google's account deactivation plans. It is always best practice to remove invalid or dormant data. If you send an email message to an unengaged, unresponsive subscriber or customer or an invalid email address, it will severely impact your engagement and delivery rates will be reported as very low.

If you continually send these messages your sender reputation will decrease, to a point where your emails are automatically marked as junk or in the worst case scenario your IP address will be blacklisted. Implementing a list cleaning policy is therefore essential.