DMARC for Bulk Senders: New Google and Yahoo Rules

Google's announcement says that "by February" Gmail will require bulk senders, defined as those who send more than 5,000 messages to Gmail addresses in one day, to do three things: authenticate their email, make unsubscribing easy, and keep spam complaints under a set limit. The announcement also quotes a Yahoo product leader, who said all users deserve the safest experience and that Yahoo looks forward to working with Google on the new standard.

Google's sender guidelines page gives the detail. Starting February 1, every sender to Gmail must set up SPF or DKIM, have valid forward and reverse DNS records for sending servers, and keep the spam rate shown in Google Postmaster Tools below 0.3%. Senders of 5,000 or more messages a day face a stricter list, covered next.

Volume grows, so plan for the bulk rules before you reach them, not just for today's numbers.

Sources: Google, "New Gmail protections for a safer, less spammy inbox," October 3, 2023; Google Workspace Admin Help, "Email sender guidelines"

DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is a record you publish in your domain's DNS. It tells mailbox providers what to do with a message that claims to come from your domain but fails your authentication checks.

The specification, RFC 7489, was published in 2015. It describes three policy choices:

• none: take no special action. Providers still send you reports.
• quarantine: treat failing mail as suspicious, for example by sending it to spam.
• reject: refuse failing mail.

DMARC also asks providers to send you reports about mail that uses your domain. Those reports show who is sending as you, including systems you forgot about and people trying to spoof you.

Sources: RFC 7489, "Domain-based Message Authentication, Reporting, and Conformance (DMARC)," Abstract and policy tag definitions; Yahoo Sender Hub, "Sender Best Practices"

For anyone sending 5,000 or more messages a day to Gmail accounts, Google lists these requirements:

• Set up SPF and DKIM for the sending domain. Both, not just one.
• Set up DMARC. The policy may be set to none. You do not need to block anything on day one.
• Align the From domain. For direct mail, the domain in the From header must match the SPF domain or the DKIM domain. This is called DMARC alignment.
• Offer one-click unsubscribe for subscribed messages, and put a clear unsubscribe link in the message body. Google's announcement says unsubscribe requests must be processed within two days.
• Keep spam complaints low. Stay below 0.3% in Postmaster Tools.
• Use valid reverse DNS on the servers that send your mail.

The fact that p=none is allowed matters. The rule is about having a working DMARC record that passes alignment. It does not yet force a strict policy. Yahoo's own guidance already urges senders to publish a DMARC policy for each domain that sends mail.

Sources: Google Workspace Admin Help, "Email sender guidelines"; Google, "New Gmail protections for a safer, less spammy inbox," October 3, 2023; Yahoo Sender Hub, "Sender Best Practices"

1. List every system that sends as you. Include your email platform, CRM, billing tool, help desk and any agency. Each one needs to authenticate.
2. Check SPF and DKIM. Send a test message to a Gmail account, open the message, and choose "Show original." Gmail displays PASS or FAIL for SPF, DKIM and DMARC.
3. Look up your DMARC record. It is a TXT record at _dmarc followed by your domain. If nothing comes back, you have no record.
4. Publish a starter record. A common first version is v=DMARC1; p=none; rua=mailto:[email protected]. The rua part says where to send summary reports.
5. Read the reports for a few weeks. Fix any legitimate sender that fails. Then think about moving to quarantine.
6. Watch your spam rate. Sign up for Google Postmaster Tools and keep the rate under 0.3%.

Most email platforms have a help page showing how to turn on DKIM for your own domain. Ask your vendor for it. Do this first, because DMARC passes only when SPF or DKIM passes and aligns with your From domain.

Sources: Google Workspace Admin Help, "Email sender guidelines"; RFC 7489, sections on policy records and reporting

• Jumping straight to reject. If a real sender is not yet set up, its mail will be refused. Start with none, read the reports, then tighten.
• Forgetting third-party senders. Marketing tools often send with their own domain in the From or Return-Path. The domain must align with yours.
• Ignoring unsubscribes. A hard-to-find unsubscribe link pushes people to hit the spam button, and that raises your complaint rate.
• Buying lists or keeping dead addresses. Yahoo's guidance tells senders not to purchase mailing lists and to remove invalid recipients promptly.
• Treating it as a one-time job. Each new tool you add must be checked.

For the legal side of commercial email in the United States, see our guide to the CAN-SPAM rules. Those rules are separate from the new provider requirements, and you need to meet both.

Sources: Yahoo Sender Hub, "Sender Best Practices"; Google Workspace Admin Help, "Email sender guidelines"

1. Google, "New Gmail protections for a safer, less spammy inbox," October 3, 2023. blog.google
2. Google Workspace Admin Help, "Email sender guidelines." support.google.com/a/answer/81126
3. RFC 7489, "Domain-based Message Authentication, Reporting, and Conformance (DMARC)," 2015. rfc-editor.org/rfc/rfc7489
4. Yahoo Sender Hub, "Sender Best Practices." senders.yahooinc.com/best-practices