Source: Google Email Sender Guidelines
In an era where fraud and cyberattacks via email are reaching an uncontrollable point, companies face the challenge of strengthening their defenses and adapting to changing regulations. Starting in February 2024, Google and Yahoo will begin implementing stricter standards for sending emails, specifically for those senders who handle a significant volume of messages (+5000 per day). These changes have important implications for businesses that rely on email as a key communication channel. This guide details the new requirements and how DANAconnect makes compliance easier.
Requirement 1: DMARC Authentication
- Email Authentication: Both Google and Yahoo are now requiring stronger authentication for emails. Companies must self-authenticate and publish a DMARC policy for their domain. This is crucial to comply with the new requirements and ensure that emails are not treated as suspicious by mailbox providers. This includes the implementation of policies SPF, DKIM and DMARC.
- What are these SPF, DKIM and DMARC policies?
Sender Policy Framework (SPF), DomainKey in Mail (DKIM) and Domain-based Message Authentication, Reporting & Conformance (DMARC) are policies that describe how emails from your domain should be handled. These policies are publicly detailed in Domain Name Server (DNS) logs, the same place where the domain name record is stored. They are essential for verifying the authenticity of emails and preventing phishing, spoofing, and phishing. - What does your company need to do and who is responsible? Your company needs to have the SPF, DKIM and DMARC policies published in the DNS to be able to send email. Your IT department or network administrator should take care of this. An important note is that, misconfiguration of DMARC can stop 100% of your email sending. Since these configurations are done infrequently, your technical team does not necessarily have the required expertise. You may be interested in this article: Challenges and Best Practices when implementing DMARC without losing deliverability.
- How does DANAconnect facilitate compliance?: DANAconnect advises its clients on implementation of SPF, DKIM and DMARC and offers a monitoring tool, called DMARC Reporter, which allows companies to view the daily reports delivered by Google and Yahoo, among other providers, and thus be able to comply with these authentication standards, but without losing the deliverability of any of their email sending sources.
Requirement 2: Use of TLS for Email Transmission
- TLS (Transport Layer Security) connection: It is now a requirement to use TLS to encrypt and protect emails during transmission. This helps prevent unauthorized access and message interception.
- What does your company need to do and who is responsible? Your technology and security department should ensure that your sending platform complies with email transmission using TLS.
- How does DANAconnect facilitate compliance?: By using DANAconnect, businesses can rest assured that their email communications are protected using TLS, providing an additional layer of security and meeting this crucial requirement.
Requirement 3: Maintaining Low Spam Complaint Rates
- Spam Rates: Spam complaint rates should be kept below 0.3% of the total shipment to ensure good deliverability.
- What does your company need to do and who is responsible? All departments that send emails to clients must review their contact lists, clean and validate the mailboxes. Likewise, all departments must review the spam score of the email templates so that for technical reasons, due to semantics in the texts or due to problems with the html, their emails are not marked as spam or, due to bad practices that lead to a bad perception, users mark it as spam.
- How does DANAconnect facilitate compliance?: DANAconnect helps keep spam rates low through efficient mailing list management, automatic creation of “do not email” lists, template spam score verification tools, and the possibility of validating mailboxes before sending. Likewise, at the time of sending, DANAconnect has a SPAM WARNING and spam complaint verification. DANAconnect also offers managed list cleaning services.
Requirement 4: RFC Compliance
- RFC regulations: It is essential to comply with RFC 5321 and 5322 regulations on email protocols and formats, to avoid penalties and blocks.
- What does your company need to do and who is responsible? Your technology and security department should ensure that your sending platform meets the minimum standards of IMF format regulations and standard email protocols. Not all providers do this.
- How does DANAconnect facilitate compliance?: By using DANAconnect you are in line with these important regulations.
Requirement 5: Implementation of an Opt-In Process for Subscriptions
- Opt-In for Subscriptions: Companies must use a CAN-SPAM Act-compliant opt-in method to confirm subscriptions and improve the quality of their mailing lists.
- What does your company need to do and who is responsible? All departments that send email to clients must ensure that they are sending legitimate company email lists, never third-party or purchased contact lists. Additionally, they must have a subscription mechanism that saves historical records.
- How does DANAconnect facilitate compliance? DANAconnect makes it easy to implement opt-in processes to ensure that recipients give explicit consent.
Requirement 6: Unsubscribe link
- Unsubscription Process: There must be a clear and visible unsubscription process that does not require users to log in, and the request must be processed within two days at most.
- What does your company need to do and who is responsible? Your technology and security department should ensure that your shipping platform meets minimum technical requirements.
- How does DANAconnect facilitate compliance? With DANAconnect, the unsubscribe process is a single step, and the unsubscribe link is automatically added to all emails. Subscription cancellation takes place immediately.
Requirement 7: Publication of Reverse DNS Records (PTR)
- Reverse DNS Records: Publishing valid reverse DNS records for all sending IPs is now a key requirement for server verification.
- What does your company need to do and who is responsible? Your IT department and purchasing committee should take this into account when choosing a bulk email provider.
- How does DANAconnect facilitate compliance? By using DANAconnect, companies can be assured that these standards are met.
Google and Yahoo recommendations:
Accompanying the new requirements, Google and Yahoo make recommendations so that compliance with the requirements is in accordance with the best practices in the industry:
Recommendation 1: Management of Inactive Recipients and Bounces
- Inactive Recipients and Bounces: Actively managing inactive recipients and bounces is crucial to maintaining a healthy email list.
- What does your company need to do and who is responsible? All departments must verify that their lists do not contain invalid emails before sending.
- How does DANAconnect facilitate compliance? In the DANAconnect platform, bounce management is handled automatically, avoiding sending to inactive and bounced recipients. It also offers tools for real-time mailbox validation, which allow lists to be verified before sending, ensuring the validity, relevance and quality of the recipients.
Recommendation 2: IP Segregation of Email Types
- Segregation by Function: In order to comply with mandatory sending regulations while meeting new requirements, Yahoo and Google recommend not sending commercial or promotional emails from the same IPs used for transactional emails, notifications or alerts.
- What does your company need to do and who is responsible? Your sending platform must be able to make the distinction between email types so that alerts and notifications are sent priority and without problems. Your IT department and purchasing committee should take this into account when choosing an email delivery provider.
- How does DANAconnect facilitate compliance? DANAconnect enables effective segregation of email types, ensuring that sender reputation remains intact.
Recommendation 3: Control the Flow of Outgoing Emails
- Flow Control: It is important to limit messages sent per connection and reestablish connections as necessary.
- What does your company need to do and who is responsible? Your IT department and purchasing committee should take this into account when choosing a bulk email provider.
- How does DANAconnect facilitate compliance? DANAconnect efficiently balances the flow of outgoing emails, avoiding saturation and maintaining a constant sending rate.
Application schedule of the new requirements for sending email to Google:
The schedule for the implementation of the sending guidelines will be gradual and progressive:
- In February 2024: Bulk senders (+5000 emails per day) who do not meet the sender requirements will begin to receive temporary errors (with error codes 4.0.X) from Google mail servers on a small percentage of their non-compliant email traffic. These temporary errors are intended to help senders identify email traffic that does not comply with our guidelines so that they can resolve the issues that result in the noncompliance. DANAconnect can help you create bounced email reports, including the error codes from Google and other servers.
- In April 2024: Google will begin rejecting a percentage of non-compliant email traffic (with 5.0.X error codes), gradually increasing the rejection rate. For example, if 75% of a sender’s traffic is compliant, Google will begin rejecting a percentage of the remaining 25% of non-compliant traffic.
- By June 2024: Bulk senders have this date to implement one-click unsubscribe on all commercial and promotional messages. Going forward, Google will prioritize technical support for email delivery cases from bulk senders that meet all the requirements described in the Google Email Sender Guidelines.
Consequences of Failure to Comply with the New Email Requirements for Businesses
Compliance with Google and Yahoo’s new email requirements is crucial for businesses, especially at the enterprise level. Non-compliance can have several negative consequences, which can significantly affect your operations and reputation. Some of these consequences are detailed below:
Deliverability Rate Reduction
- Progressive Inability to Reach Recipients: If authentication standards such as SPF, DKIM, and DMARC are not met, there is a high risk that emails will be marked as spam or even blocked by Gmail, Yahoo, and other ISPs, significantly reducing the deliverability rate.
Damage to the Reputation of the Sending Domain
- Eventual loss of sending capacity: Failure to comply with regulations can lead to a company’s emails being considered untrustworthy or spam, damaging the reputation of the sending domain and falling on blacklists.
Legal Issues and Fines
- Penalties for Non-Compliance: Failure to comply with the CAN-SPAM Act and RFC regulations may result in legal action, fines and penalties, which represents significant legal and financial risk.
Impact on Marketing Efficiency
- Lower Effectiveness of Email Campaigns: Lack of compliance can lead to low effectiveness in email marketing campaigns, affecting open rates, clicks, and conversions.
Loss of Customers and Reduced Revenue
- Decreased Customer Base: Poor mailing list management and spamming can lead to a loss of subscribers and, consequently, a reduction in revenue.
Security and Privacy Issues
- Risk of Cyber Attacks: Without proper authentication, businesses become more vulnerable to phishing attacks and other cyber threats, putting the security and privacy of customer data at risk.
Difficulties in the Customer-Company Relationship
- Damage to Customer Relationships: Poor subscription management and the lack of a clear cancellation process, sending emails perceived as spam, can deteriorate the relationship with customers, affecting loyalty and satisfaction.
Preparing for the Future of Email Security
In short, Google and Yahoo’s new email requirements represent a significant step toward a more secure and reliable digital environment. However, for businesses, especially those in the financial sector, adapting to these changes is more than a compliance need; It is an opportunity to strengthen security, improve the reliability of communications and protect both the company and its customers from cyber threats.
DANAconnect emerges as a comprehensive solution that not only facilitates compliance with these new requirements but also improves the overall effectiveness of email communication.
Is your company prepared for the email security challenges that 2024 brings?
Contact us for a demo session of our DMARC Reporter, and on how DANAconnect can strengthen your digital communication strategies and help you meet the new requirements of Google and Yahoo.
