{"id":17364,"date":"2023-10-12T15:23:32","date_gmt":"2023-10-12T19:23:32","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=17364"},"modified":"2023-10-31T13:10:24","modified_gmt":"2023-10-31T17:10:24","slug":"google-yahoo-to-roll-out-new-email-authentication-spam-prevention-requirements-in-february-2024","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/google-yahoo-to-roll-out-new-email-authentication-spam-prevention-requirements-in-february-2024\/","title":{"rendered":"Google & Yahoo to Roll Out New Email Authentication & Spam Prevention Requirements in February 2024"},"content":{"rendered":"\n

Starting early next year, new digital identity validation and spam-prevention requirements for bulk email senders will kick into effect. Are you ready?<\/h2>\n\n\n\n

Does your organization send out emails to subscribers, customers, or prospects? Does that list include email addresses that end in \u201c@gmail.com,\u201d \u201c@googlemail.com\u201d or \u201c@yahoo.com\u201d? How about Google Workspace email accounts (i.e., those that don\u2019t end in the traditional @gmail.com\u201d)?<\/p>\n\n\n\n

If you answered yes to any of those inquiries, then you should probably be aware of email security changes coming down the pike. Google and Yahoo have teamed up to start rolling out new email authentication and user rights requirements for bulk mail senders who send messages to Gmail account users.<\/p>\n\n\n\n

But what do these changes mean for your organization?<\/p>\n\n\n\n

Let\u2019s hash it out.<\/span><\/p>\n\n\n\n

What to Know About the New Requirements<\/h2>\n\n\n\n

Google announced<\/a> it would be implementing new bulk email protections for Gmail users starting in February 2024. The requirements span from enhancing message authentication to improving unsubscription capabilities. It\u2019s part of the company\u2019s continuing efforts to fight spam, which is greatly needed when you consider that it reports blocking \u201c15 billion unwanted emails per day<\/a>.\u201d <\/p>\n\n\n\n

This Effort Extends Beyond Google and Is Poised to Impact the Email Community at Large<\/h3>\n\n\n\n

That\u2019s right \u2014 Google isn\u2019t alone in this initiative. According to the company\u2019s official statement: \u201cKeeping email more secure, user friendly and spam-free requires constant collaboration and vigilance from the entire email community.\u201d The announcement shares that other industry partners, including Yahoo, have committed to instituting new policies as well. Yahoo also announced the initiative separately as well on its own blog<\/a>.<\/p>\n\n\n\n

Since Gmail is a part of Google Workspace<\/a>, which has more than 3 billion users, it\u2019s easy to see the potential reach of these changes. Because these requirements are built upon open standards, they\u2019re poised to benefit most email recipients \u2014 even those using other email service providers \u2014 when senders implement the necessary changes.<\/p>\n\n\n\n

Who the New Requirements Will Apply To<\/h2>\n\n\n\n

New requirements apply to all senders who send messages to Gmail account holders<\/a>. If you\u2019re sending 5,000 or more messages to Yahoo or Gmail email addresses in a day<\/a>, then heads up \u2014 there are additional new requirements that will apply to you.<\/p>\n\n\n\n

What the Three New Email Security Requirements Entail<\/h2>\n\n\n\n

The new changes boil down to three salient points for email senders:<\/p>\n\n\n\n

1. Enable Email Authentication<\/h3>\n\n\n\n

Sending authenticated messages enables email security systems to successfully identify and block billions of scam and malicious emails and eliminate inbox clutter. Google states that for your emails to be trusted, senders must follow email security best practices. This involves implementing the traditional trifecta of authenticated email delivery:<\/p>\n\n\n\n

    \n
  1. Sender policy framework (SPF)<\/a> prevents unauthorized users from sending messages from your domain.<\/li>\n\n\n\n
  2. Domainkeys identified mail (DKIM)<\/a> enables recipient servers to check whether messages received from your domain actually came from your organization, and<\/li>\n\n\n\n
  3. Domain message authentication reporting (DMARC)<\/a> provides instructions for what to do with messages that fail SPF and DKIM.<\/li>\n<\/ol>\n\n\n\n

    Not sure whether your domain has any of these email security measures enabled? Check your domain using a DNS record-checking tool. For example, here\u2019s what it looks like when we ran a check on TheSSLStore.com\u2019s DNS txt records:<\/p>\n\n\n\n

    \"An
    Image caption: An example screenshot we captured when checking TheSSLstore.com\u2019s SPF, DKIM, and DMARC records using DMARCian.<\/em><\/figcaption><\/figure>\n\n\n\n

    Pro Tip: Don\u2019t Just Implement SPF, DKIM and DMARC\u2026 Use BIMI and VMCs, Too!<\/h4>\n\n\n
    \n
    \"An<\/figure>\n<\/div>\n\n\n

    Do you know what would be a great addition to this list of authentication and email security measures? Using brand indicators for message identification (BIMI) and verified mark certificates (VMCs)<\/a>. This potent combination enables organizations to display their verified logos in recipients\u2019 inboxes so users can verify the authenticity of a message before clicking on it.<\/p>\n\n\n\n

    This would be especially fitting when you consider that Google announced its support of BIMI and VMCs<\/a> for greater email authentication and brand trust.<\/p>\n\n\n\n

    Now, we won\u2019t get into all of the details about those security tools here, but you can read more about them in our other blog posts:<\/p>\n\n\n\n