The new Gmail and Yahoo rules are live: check your DMARC

Since early February 2024, Gmail and Yahoo have been introducing stricter rules for email. They want less spam and phishing in the inbox. If you send email without proper sender checks, you risk your messages landing in the spam folder or not arriving at all. The rules are being introduced in stages, so a problem is not always visible straight away.

Have your open or click rates suddenly dropped? Then your authentication is the first thing to check. It takes about five minutes. In this article you will read what is changing, how to test it yourself and how to set up DMARC safely.

What has changed at Gmail and Yahoo?

The strictest requirements apply to bulk senders. Gmail defines this as more than 5,000 emails per day to Gmail addresses. But even if you send fewer, it is wise to follow the rules. Mailbox providers are looking ever more closely at every sender.

These are the main requirements at a glance:

• SPF and DKIM are set up correctly for your sending domain.
• DMARC is in place, at minimum with a policy of none.
• The domain in your sender address matches the domain used by SPF or DKIM. This is known as alignment.
• People can unsubscribe with a single click. Gmail and Yahoo have announced that this will become mandatory during 2024.
• The number of spam complaints stays low. Google sets 0.3 per cent as the upper limit. That is roughly three complaints for every thousand emails.

A short explanation of the technical terms. SPF is a list of servers that are allowed to send email on behalf of your domain. DKIM is a digital signature on your email, so the recipient can see that the content has not been altered. DMARC determines what happens if SPF or DKIM fails, and sends you reports.

A quick self-test in five minutes

You do not need technical knowledge for a first check. You can do it with an ordinary Gmail address.

1. Send a newsletter or test email from your usual tool to your own Gmail address.
2. Open the email and click the three dots at the top right.
3. Choose Show original.
4. At the top you will see three lines: SPF, DKIM and DMARC.
5. All three should show PASS.

Does it say FAIL, SOFTFAIL or NEUTRAL? Then something is not set up correctly. Also test emails from other systems, such as your web shop or your accounting package. Each system can have its own result.

DMARC step by step

DMARC sounds heavy, but you can build it up gradually. You set it up as a DNS record. DNS is the address book of your domain. You usually manage this with your domain registrar or hosting provider.

A safe first record looks like this: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The address after rua is where the reports are sent.

Here is how to approach it:

1. Start with a policy of none. You receive reports, but no email is rejected.
2. Read the reports. They are technical and arrive as XML files. Use a tool that makes them readable.
3. Check who is sending email on behalf of your domain. You will often find services you had forgotten about.
4. Fix anything that is wrong. Add those services to SPF or set up DKIM with them.
5. Tighten the policy. Move to quarantine, where unclear email ends up in spam. Later you can move to reject, where that email is refused.

Take your time with this. A few weeks of simply monitoring is not wasted time. It prevents genuine email from being blocked by mistake.

Do not forget your other systems

Most problems are not in the newsletter tool. That is often already set up properly. Things go wrong with systems you do not immediately think of.

Consider these sources:

• Invoices from your accounting package.
• Order confirmations and shipping emails from your web shop.
• Emails from your CRM or customer portal.
• Notifications from your website, such as contact forms.
• Email from your helpdesk or appointment system.

Everything that sends on behalf of your domain must be covered by your SPF and DKIM. Otherwise the recipient will see your email as suspicious. With a stricter DMARC policy, that email may even be rejected.

A common scenario: a business owner sends newsletters through an email tool that shows PASS. But the web shop sends order confirmations through the hosting provider’s own server. That server is not in SPF and has no DKIM. As long as DMARC is set to none, nobody notices. As soon as the policy becomes stricter, confirmations end up in spam. Customers call asking where their order is. The cause is a single missing record, but you will only find it if you have read the DMARC reports.

More than technology: unsubscribing and complaints

Good authentication is necessary, but not enough. Gmail and Yahoo also look at how recipients respond to your email. A high number of spam complaints weighs heavily, even if your technical setup is correct.

A few rules of thumb to keep your complaints low:

• Only email people who have given their consent.
• Make unsubscribing easy. Do not hide the link in small print.
• Remove people who have not opened anything for a long time.
• Keep your sending frequency and subject lines clear and honest.
• Build up new sending volumes gradually.

Also check whether your email tool supports one-click unsubscribing. Many tools already have this setting or will add it during the year. Ask your supplier, so you are not caught by surprise.

Frequently asked questions

Does this also apply if I only have a small list?

The strictest requirements apply to bulk senders. But SPF and DKIM are also important for smaller senders. Without these checks, your email is more likely to end up in spam. Setting up DMARC with a policy of none takes little effort and gives you insight.

Can I set DMARC to reject straight away?

We advise against it. You do not yet know which systems send email on behalf of your domain. One forgotten service can cause genuine email to be rejected. Start with none, read the reports and only tighten the policy once everything is correct.

How long should I leave DMARC on none?

That differs from business to business. A few weeks is often a good start, so that you can see all your sending sources. If you have many systems or a large organisation, it may take longer. What matters is that you know and have checked all legitimate sources.

Free 30-minute introductory meeting

Would you like to know whether your email meets the new requirements? Or would you like help setting up SPF, DKIM and DMARC? Book a free 30-minute introductory meeting with Adventio Marketing in Amersfoort. Together we will look at your situation, go through the key points and tell you what to tackle first. That way you will know where you stand and what is needed to get your email safely into the inbox.