Gmail’s efforts to target the challenges of spam and phishing with new, strict regulations for bulk email distributors are kicking in this week as the most popular email provider in the world turns 20 years old.
As these changes take effect in April 2024, the aim is clear: to enhance the safety of its users, particularly those with business accounts, and to provide a more organized and less cluttered inbox experience.
At the heart of this initiative are stringent authentication standards, more rigorous spam filtering, and the compulsory inclusion of a simple one-click option to unsubscribe.
New Security Measures for Bulk Email Senders
To combat the ever-present threats of phishing and spam, Gmail now mandates bulk senders — defined as those dispatching over 5,000 messages daily to Gmail addresses — to authenticate their emails.
“Many bulk senders don’t appropriately secure and configure their systems, allowing attackers to easily hide in their midst,” Google said last year announcing their plans. “To help fix that, we’ve focused on a crucial aspect of email security: the validation that a sender is who they claim to be.”
They do this by implementing SPF/DKIM and DMARC email authentication protocols for their domains.
- SPF: Sender Policy Framework
- DKIM: DomainKeys Identified Mail
- DMARC: Domain-based Message Authentication, Reporting, and Conformance
This authentication trifecta is pivotal in verifying the sender’s identity, ensuring that emails are not only secure but also genuinely from the claimed source.
Moreover, Gmail insists on maintaining spam rates below the 0.3% threshold, a move aimed at preserving the sanctity of users’ inboxes.
Unsolicited or unwanted messages are strictly prohibited, with a strong push for a user-friendly experience via the incorporation of a one-click unsubscribe option.
Addressing Non-Compliance
Non-compliance with these guidelines won’t go unnoticed. “Bulk senders who don’t meet our sender requirements will start getting temporary errors with error codes on a small portion of messages that don’t meet the requirements,” Gmail advises in a FAQ. These temporary errors serve as a nudge for senders to identify and rectify compliance issues.
Starting in April 2024, the phase of rejecting non-compliant traffic begins, according to the FAQ. This process is set to be gradual, affecting only the traffic that fails to meet Gmail’s updated standards.
The aim is to encourage senders to utilize the temporary failure enforcement period to adjust and adhere to the compliance requirements, thereby avoiding disruptions in email delivery.
Why Strengthen Email Security?
These enhancements are aimed at closing loopholes exploited by attackers, thus protecting all email users, Google said. Neil Kumaran, Group Product Manager for Gmail Security & Trust, said last year in the Oct. 2023 Google blog post: “You shouldn’t need to worry about the intricacies of email security standards, but you should be able to confidently rely on an email’s source.”
To benefit from Gmail’s enhanced security measures, users are advised to keep an eye on the official updates and ensure their accounts comply with the new guidelines.
It’s important for all email senders, not just bulk senders, to adhere to these security practices. According to Google’s guidelines, this includes setting up SPF or DKIM email authentication for your sending domains and ensuring that sending domains or IPs have valid forward and reverse DNS records.
For businesses and bulk email senders, adapting to these new requirements is crucial for maintaining effective communication channels and protecting their emails from being marked as spam or phishing attempts.
Also, last year, Google’s flagship email service upped its security by starting to delete inactive and potentially dangerous Gmail accounts. Furthermore, the email service announced in May 2023 that it is adding a free dark web monitoring feature.
For more news, follow us on X (Twitter), Threads, and Mastodon!
