Improved Email Security: A Guide to the New Requirements from Google & Yahoo

Google and Yahoo have announced an increased focus on email security. Consequently, anyone sending more than 5,000 emails daily must authenticate, ensure easy unsubscription, and maintain a spam complaint rate below 0.3 percent.

What does this mean?

Easy unsubscription → Anyone sending newsletters and other mass mailings must provide Gmail users with a one-click option to unsubscribe from commercial emails. Senders must also ensure that unsubscribes take effect within two days.

Note: As a Make customer, you do not need to worry about this because it is built into Make and has been operational for several years.

Reducing spam → To ensure Gmail users receive fewer unwanted emails, Google is setting a clear spam rate limit that senders must respect. The goal is cleaner inboxes free of spam, and the limit is set at 0.3 percent spam complaints. That means only 3 spam complaints per 1,000 emails sent.

Make also helps you here. Anyone who unsubscribes is automatically removed from your email lists. People who click the spam button in Gmail are also automatically unsubscribed. However, it is important that you send relevant campaigns and newsletters.

Email authentication → When sending mass emails, senders must authenticate their emails. This is done using three standards: SPF, DKIM, and DMARC.

If you are, or wish to become, a customer of Make, this is something we go through in an onboarding meeting. The vast majority of our customers already have SPF and DKIM set up. The next step is to add DMARC.

What is DMARC?

Domain-based Message Authentication, Reporting & Conformance (DMARC) is a technical standard and protocol for email authentication developed to improve email security and protect against email spoofing and phishing attacks.

Imagine we deliver food to customers where mustard (SPF) and ketchup (DKIM) must always be included with the meal. If we forget to include the mustard or ketchup, DMARC specifies what we recommend the customer does with the food. We can encourage the customer to eat the food as usual (p=none), throw the food in the bin (p=quarantine), or refuse to accept the food (p=reject).

Translating this to email, DMARC allows you to tell the recipient's server what should happen to the email if SPF or DKIM fails.

DMARC Host/Name: _dmarc.domain.no
Type: TXT
Value: v=DMARC1; p=none;

DMARC works alongside SPF and DKIM – two fundamental methods for email authentication.

Read a detailed explanation of SPF and DKIM
Read about warming up your domain and contacts

Why DMARC is important

DMARC is an effective tool that ensures the emails you send are perceived as secure. DMARC acts as a seal of trust and credibility. From our perspective, this is a very positive change.