Month: May 2024

In February 2024, Gmail and Yahoo Mail initiated the enforcement of new policies aimed at safeguarding email recipients and enhancing the security of their inboxes against spam.

These regulations mandate that all email senders follow particular guidelines to guarantee successful email delivery.

This detailed guide outlines the new requirements and their implications for your business.

We will discuss:

• New Email Sending Requirements from Google & Yahoo
• Introduction to SPF, DKIM, and DMARC
  • SPF
  • DKIM
  • DMARC
• Examples of Email Verification
  • Emails Failing to Reach Recipients
  • Successful Email Compliance
• Utilizing Verification Tools
  • Verifying SPF, DKIM & DMARC
  • Checking PTR
• Recommended Practices for Email Senders
• Further Points and Helpful Information
  • Tips for Bulk Emailing
  • Common Misunderstandings About SPF
  • Common Misunderstandings About DKIM

Updated Email Sending Requirements from Google & Yahoo

In October 2023, Neil Kumaran, Google’s Security & Trust Group Product Manager, revealed on Google’s blog that starting February 2024 email senders would have to authenticate their emails, provide a straightforward unsubscribe option (for bulk senders), and remain under a specified spam threshold for emails to be accepted by Gmail.

With these requirements now active, disregarding them could result in your mail being automatically declined or redirected to the spam folder of the recipient.

Neil noted that while Gmail’s filtration systems block 99.9% of spam, phishing, and malware, and prevent nearly 15 billion unwanted emails daily, it is now encountering increasingly intricate threats compared to when it was launched in April 2004.

As Neil mentions on Google’s blog…

“As simple as it may seem, it can still be challenging to ascertain the sender of an email due to the outdated and inconsistent systems available on the internet.”

The new email sending regulations are aimed at helping users maintain a more secure and spam-free inbox.

This initiative, which imposes stricter requirements on email senders to combat fraudulent or spammy emails, is not solely a Google initiative. Other industry partners, such as Yahoo, are collaborating with Google and the wider email community to establish these new requirements as industry norms and essential email hygiene practices.

Yahoo’s best practices for email senders offer recommendations similar to those of Google, along with a link to a detailed guide on Senders Best Common Practices from the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG), an organization dedicated to assisting industries in fighting and preventing online abuse.

This document targets individuals involved in the delivery and compliance of electronic communications, including marketing and management personnel. It’s recommended for download as it encompasses the latest and most effective practices for sending commercial electronic messages.

So, what do these new requirements entail and how do they influence your business?

In essence, the primary requirements can be summarized as follows:

• Your spam complaint rate must remain below 0.3%.
• Authentication with SPF, DKIM, and DMARC (for bulk email senders) is now necessary.
• You must implement a one-click unsubscribe feature and promptly remove individuals who request to unsubscribe from your list within 1-2 days (for bulk email senders).

<pFurther requirements for all email senders include:

• Verifying that sending domains or IPs possess valid forward and reverse DNS records, also known as PTR records.
• Utilizing a TLS connection for sending emails.
• Format messages compliant with the Internet Message Format standard, RFC 5322

There are additional obligations for bulk email senders.

You can read Neil Kumaran’s post here and refer to Google’s email sender guidelines and Yahoo’s best practices for email senders to find out how to effectively send emails to personal Gmail and YahooMail accounts.

Introduction to SPF, DKIM, and DMARC

Implementing SPF, DKIM, and DMARC protocols boosts email deliverability, protects sender reputation, and ensures secure delivery of emails to recipients’ inboxes.

If you are unfamiliar with SPF, DKIM, and DMARC, here’s a brief overview:

SPF

SPF (Sender Policy Framework) is a protocol that authenticates senders by verifying if an email was sent from an authorized server.

It validates the authenticity of email senders by corroborating the sender’s IP address with a specified list of authorized sending IP addresses found in the DNS record.

DNS records function as a directory that links domain names to their corresponding IP addresses and can contain instructions on how to manage requests for that domain.

By verifying the sender’s identity against the list of authorized sending IP addresses within the DNS record, SPF helps prevent email spoofing and enhances deliverability by decreasing the chances of emails being blacklisted or labeled as spam.

Here are the steps to create an SPF record for email authentication:

1. Collect Information: Gather the IP addresses of all servers authorized to send emails for your domain. This encompasses your own mail servers, third-party email service providers, and any other servers used for sending emails.

2. Identify Sending Domains: Create a comprehensive list of all domains utilized for sending emails, even if dormant. This helps avert domain spoofing.

3. Construct SPF Record Syntax:

• • Begin with the version tag: v=spf1
  • Add authorized IP addresses: e.g. ip4:192.0.2.0
  • Include third-party senders: include:thirdparty.com
  • Specify SPF policy: -all (hard fail) or ~all (soft fail).

Post completion of the above steps, your SPF record may appear as follows:

v=spf1 ip4:192.0.2.0 include:thirdparty.com -all

Note: SPF records should not exceed 255 characters and be limited to ten include statements at most.

4. Publish SPF Record to DNS: Access your DNS management panel offered by your domain registrar or hosting provider, create a new TXT record for your domain’s hostname alongside the SPF record syntax, and apply the changes.

5. Verify SPF Record: Utilize SPF checking tools (e.g. EasyDMARC’s SPF Record Checker) to verify whether the SPF record exists and confirm that all legitimate sending IP addresses are accurately formatted.

DKIM

DKIM (DomainKeys Identified Mail) is an email authentication mechanism that incorporates a digital signature into outgoing emails.

This signature is confirmed by the recipient’s mail server, ensuring both the integrity and authenticity of the email. DKIM thwarts email tampering and enhances deliverability by decreasing the likelihood of emails being classified as spam or phishing.

DKIM serves as an email’s digital signature, enabling the sender (you) to validate their identity and confirm that the email remains unchanged during its transit.

A DKIM Signature Header typically includes several elements represented as tag=value pairs.

Here’s an example depicting crucial components for email authentication via DKIM:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.com; s=dkim1; h=From:To:Subject:Date; bh=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX; b=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY

Explanation of each component:

• v=1: Indicates the version of the DKIM specification utilized.
• a=rsa-sha256: The cryptographic algorithm used to produce the signature.
• c=relaxed/relaxed: Canonicalization methods employed for both header and body of the email.
• d=example.com: The domain holding the DKIM key pair.
• s=dkim1: The DKIM selector, signifying the specific key employed for signing.
• h=From:To:Subject:Date: A compilation of header fields included in the signature.
• bh=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX: The hash encapsulating the content of the email body.
• b=YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY: The digital signature produced using the private key associated with the selector.

Here are the steps involved in generating a DKIM record:

1. Generate DKIM Keys: Utilize a DKIM key generator tool provided by your email service provider or an external service (see the list below). This process generates a pair of public and private keys.

2. Publish the Public Key to DNS:

• • Login to your DNS management panel from your domain registrar or hosting provider.
  • Navigate to your domain’s DNS settings.
  • Create a new TXT record using the DKIM selector as the subdomain name and the public key as the record value. The selector is typically provided by your email service provider and is specific to your DKIM arrangement.

Example DKIM record:

selector._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2h9gFo3... (extended string)"

3. Verify DKIM Record: After applying the DKIM record, check its accuracy using DNS lookup tools to ensure the TXT record contains the correct DKIM selector and public key.

4. Test DKIM: Send test emails using your domain and ensure they successfully pass DKIM authentication checks with email authentication validation tools.

Here’s a list of tools available for DKIM key generation:

• DKIMCORE.org
• DKIM Record Generator by EasyDMARC
• DKIM Generator Wizard by SocketLabs

DMARC

DMARC (Domain-based Message Authentication, Reporting, and Conformance) serves to protect email domains from being exploited for phishing, spoofing, and other harmful actions, enhancing SPF and DKIM to provide greater email authentication and reporting functionality.

DMARC works to ensure that the emails sent are indeed from you. If an attempt is made to spoof your email address, DMARC provides measures to block those fraudulent messages from reaching others, thus preserving your email reputation.

DMARC:

• Enhances email deliverability by allowing senders to monitor and enforce email authentication policies.
• Enables domain owners to designate a handling policy for emails that fail SPF and DKIM checks, enhancing transparency and security, and mitigating spoofing and phishing attempts.
• Permits domain owners to receive notifications when unauthorized entities misuse their domain for email spoofing, thus protecting their brand reputation.

For an email to pass DMARC’s requirements, SPF and DKIM must be accurately configured for the email’s From domain. The From domain must subsequently align with the authenticated domain by SPF or DKIM.

Steps to implement DMARC

1. Establish DMARC Policy: Determine the DMARC policy you want to enact. DMARC presents three policy options:

• • None: Monitoring mode only; no actions are taken if an email does not meet DMARC.
  • Quarantine: Suspicious emails are routed to the spam or junk folder.
  • Reject: Dubious emails are outright rejected.

2. Generate DMARC Record: Create a DMARC TXT record reflecting your chosen policy. Use the following syntax:

_dmarc.example.com. IN TXT "v=DMARC1; p=none; rua=mailto:your@email.com; ruf=mailto:your@email.com"

• • Substitute example.com with your domain name.
  • v=DMARC1: Represents the version of DMARC in use.
  • p=none/quarantine/reject: Specifies the policy.
  • rua: Designates the email address for aggregate reports.
  • ruf: Designates the email address for forensic reports.

3. Publish DMARC Record to DNS: Log in to your DNS provider’s dashboard.

• • Navigate to your domain’s DNS management section.
  • Add a new TXT record with the host _dmarc and the value as the DMARC record you created.

4. Verify DMARC Record: Use DNS lookup tools to ensure the DMARC record is correctly published and propagated.

5. Monitor Reports: Regularly review the aggregate and forensic reports sent to the specified email addresses in the DMARC record. These reports provide insights into email authentication failures and help fine-tune your DMARC policy.

Notes:

• Exercise caution when creating a DMARC record, as any misconfiguration can adversely affect email delivery. It is advisable to follow these guidelines from Google when initiating DMARC.
• Ensure that SPF and DKIM are authenticating emails for at least 48 hours PRIOR to enabling DMARC.

Here are some no-cost tools for creating, verifying, and validating DMARC records:

• DMARC Tools by dmarcian.
• DMARC Record Lookup and Checker by EasyDMARC
• DMARC Digests – If you set up a DMARC reporting address, using your personal or business address is discouraged, as your inbox will become inundated with nonsensical emails. Instead, consider registering for a DMARC reporting tool to ensure proper authentication for all tools you employ to send email.

Examples of Email Verification

Now that we have clarified what SPF, DKIM, and DMARC entail, let’s examine some concrete examples of these protocols functioning to better understand why your emails may or may not reach their designated recipients.

Emails that Do Not Reach Recipients

To begin, we’ll examine a clear spam email sent to a Gmail address, illustrating how Gmail and other providers automatically screen out spam emails.

Here’s an email dispatched to my personal Gmail account that failed to arrive in my inbox. Gmail intercepted it and sent it straight to my SPAM folder.

Let’s overlook the fact that this is an evident spam email and instead inspect the email header to understand why Gmail’s automated systems identified and flagged it as such.

To accomplish this, view the email in your Gmail account (avoid clicking on any links in the email, of course!), click the vertical ellipsis icon, and select Show original from the dropdown menu…

As illustrated, this email did not meet Gmail’s DKIM policy criteria.

Compliant Emails

In contrast, here’s the header of an email sent to my business Gmail account from a compliant sender. It’s evident that this company has satisfied all of Gmail’s stipulations regarding secure email delivery.

Utilizing Verification Tools

As aforementioned, various excellent tools are available to examine and/or troubleshoot whether your email domain (or that of a client or third-party service) complies with the required sending guidelines.

Verifying SPF, DKIM & DMARC

In this section’s examples, we will utilize the complimentary tools provided by dmarcian.com.

Navigate to dmarcian’s free tools section, and select their Domain Checker tool…

Insert the email domain name into the input field (only the domain, excluding address@) and click Check Domain…

The tool conducts checks similar to those performed by mailbox providers like Google, Yahoo, and Microsoft, and it displays results indicating whether the email domain’s records comply with SPF, DKIM, and DMARC requirements.

If an email domain does not pass the checks, you will receive a result resembling the one shown below.

Occasionally, a message may appear as depicted below. This message suggests that your emails meet the verification criteria and will still be delivered, yet you might want to utilize the company’s services to achieve full compliance.

Here’s one additional beneficial tip to remember if you conduct a test on your email domains and receive a DKIM check result as illustrated below…

In the aforementioned check, the tool was unable to locate DKIM records for the email domain due to the absence of a selector. A selector is generally included in the DKIM record upon sending a compliant email.

To determine the selector needed to complete this check, follow these steps:

1. Access your email account and locate an email sent by the domain you are investigating. In this case, we’ll use Gmail.
2. Click the vertical ellipsis icon, and select Show original from the dropdown menu.
3. Scroll down past the Internet headers section until you reach the block of code.
4. Look for the s= segment within the DKIM Signature Header. This represents your selector.

Copy the selector part and paste it into the DKIM checking tool, then click the Inspect DKIM button.

This should resolve the issue and allow your email to pass the DKIM check.

Click the Details link for further insights into the results.

Checking PTR

A DNS pointer record, or PTR, connects an IP address with its relevant domain name. In contrast to the ‘A’ record, which relates domain names to IP addresses, the PTR record serves the reverse purpose by linking IP addresses to domain names.

To verify that sending domains or IPs possess valid forward and reverse DNS records as necessitated, first find and copy the sending email domain’s IP address in the email header…

Then paste it into a Reverse DNS lookup tool, such as MXToolbox.com to verify if the PTR exists and is valid…

While the above checks will yield accurate information, we also suggest testing your email for spam-like characteristics. This can help ensure optimal deliverability for your messages.

We recommend utilizing a service like Mail Tester (they also offer an SPF & DKIM checking tool).

We hope this guide has provided you with a fundamental understanding of SPF, DKIM, and DMARC and how to leverage tools to validate email domains and troubleshoot potential complications.

If you utilize (or intend to use) WPMU DEV’s Webmail or Email Hosting services, be sure to consult our guide on optimizing email deliverability using WPMU DEV’s email services.

Recommended Practices for Email Senders

If you are planning to conduct any form of bulk mailing, here’s a quick overview of key email sending practices to adhere to in order to remain compliant with the new guidelines:

• Subscriptions: Only send emails to recipients who have opted in. If you qualify as a bulk email sender, you can make use of a free tool like Google’s Postmaster Tools to prevent spam markings and routinely access data and diagnostics related to Gmail delivery issues, spam reports, feedback loops, and other insights to ensure complaint rates stay below 0.3%.
• Subscription Management: Enable a one-click unsubscribe option to facilitate easy opt-outs. Allow recipients to review and unsubscribe from specific mailing lists.
• Message Formatting: Structure emails according to RFC 5322 and HTML standards. Avoid concealing content and ensure transparent sender information.
• Sending Guidelines: Authenticate emails using SPF and DKIM. Maintain consistent sending IPs and categorize messages. Utilize a TLS connection when sending emails.
• Practices to Avoid: Avoid mixing different content types, impersonating others, or purchasing email lists.
• Gradually Increase Sending Volume: Slowly augment volume and keep an eye on delivery metrics.
• Special Considerations: Confirm compliance with guidelines, particularly regarding third-party providers.
• Affiliate Marketing & Phishing Exercises: Regularly supervise affiliates and abstain from sending test phishing emails.

For more comprehensive email sender guidelines, consult: Google Help: Email Sender Guidelines

Further Points and Helpful Information

Covering every aspect of email deliverability exceeds the confines of this article. Nevertheless, we have included additional useful information here to save you extensive research time.

Bulk Emailing

Here are some considerations if you intend to engage in bulk emailing:

• Spoofed emails contribute to the bulk sender limit of 5,000. According to Yahoo, “Spoofed emails will count against the total mail we review for enforcement. If spoofing issues arise, you should be enforcing a DMARC policy (p=quarantine or p=reject) regardless.”
• Subdomains are subject to the requirements as well. Non-compliant emails originating from a subdomain of an organizational-level domain subject to DMARC validation will be affected.

Common Misunderstandings About SPF (Sender Policy Framework)

Understanding the role SPF plays in email authentication is vital, but the protocol has its limitations as well. Below are some frequently encountered misconceptions concerning SPF:

• SPF will completely secure my domain from spoofing: SPF does not entirely safeguard the sender’s address visible to the recipient. It certifies the domain’s authorization but does not protect the sender’s address. Employ DMARC to secure visible domain names from spoofing.
• Implementing SPF is adequate to prevent all spoofing and phishing attempts: While SPF is fundamental, it is not a foolproof solution against spoofing and phishing. Other email authentication methods (e.g., DMARC) are essential for comprehensive protection.
• Including a company’s SPF record in emails guarantees proper authentication: Companies may mistakenly ask customers to add their SPF record. However, this may not effectively authenticate emails and could lead to misconfigurations.

Common Misunderstandings About DKIM (DomainKeys Identified Mail)

Just as with SPF, understanding DKIM’s function in email sending and delivery is crucial, but there are also misconceptions to be aware of:

• Misconception Regarding Encryption: Contrary to popular belief, DKIM does not encrypt emails. Rather, it focuses on confirming message integrity through hashes under the “bh” and “b” tags, providing protection against modification and replay attacks, albeit only partially safeguarding against identity theft and forgery. A successful DKIM verification substantiates the sender’s authorization and assures message content integrity during transmission.
• Forged Email Fallacy: There’s a common myth that DKIM signatures can be forged since their details are publicly accessible in DNS records. Nonetheless, DKIM relies on a Public Key Infrastructure (PKI) consisting of a public and private key pair. While the public key is available in DNS records, the private key remains securely on the email service provider’s server, guaranteeing message authenticity. Thus, DKIM signatures cannot be falsified as the private key is kept confidential and utilized solely for message signing.
• Spam Prevention Illusion: While DKIM helps verify sender authorization and message integrity, it does not offer a guaranteed solution to spam. Even though it decreases the chances of spammers using forged or stolen email addresses, it doesn’t stop them from acquiring domains and establishing DKIM records to persist in their actions. Consequently, this could inadvertently legitimize spam to an extent. Nevertheless, authentic domain usage can enhance protection against phishing attacks, elevating email security against malicious endeavors, such as fraudulent emails posing as communications from legitimate companies.

For the most recent updates regarding Google’s email sending guidelines for personal Gmail accounts and bulk emailing requirements, refer to Google’s Email Sender Guidelines FAQ

Have You Got The Message Yet?

As the increasingly complex and ongoing battle against email spam and phishing from sophisticated malicious actors continues to escalate, major providers like Google, Yahoo, Microsoft, and others have begun enforcing stringent email sending requirements for all users to ensure the safe delivery of emails to intended recipients.

Hopefully, this article has equipped you with all the necessary information to understand and adhere to all guidelines and requirements for dispatching emails that will successfully reach your recipients’ inboxes.

Refer to our guide on optimizing email deliverability using WPMU DEV’s email services to discover how your business can seamlessly comply with these new email sending regulations.

Read More