January 2, 2024 Prepare your business for Google and Yahoo's 2024 Email Changes

The digital world is ever-evolving, and email communication is no exception. In 2024, significant changes are slated to impact how we use and interact with email, particularly for businesses using email for marketing purposes. Google and Yahoo, two of the world's leading email providers, are set to enforce significant changes to how many companies can prospect with cold emails beginning in February 2024. 

In the following, I break down what this means for you and how you need to evolve your email practices to successfully communicate with prospects, customers, and internal staff. 

How did we get here, and why is this happening?

It's no secret that email engagement rates have plummeted over the past few years. Companies have seen email as a catch-all for reaching prospects and pitching services. Tools such as rocketreach zoominfo ,  hunter.io , and others have made finding contact information for prospecting easier than ever. At the same time, tradeshows and events eagerly sell attendee lists to sponsors of all levels. The upcoming changes from Google and Yahoo aim to end the lazy sales and marketing practices that indiscriminately email companies and individuals who have demonstrated zero interest in a product or service. Individuals I like to refer to as "innocent bystanders."

"We firmly believe that users worldwide deserve a more secure email environment, with fewer unwanted messages for an improved overall experience."

- Neil Kumaran, Group Product Manager, Gmail Security & Trust

The forthcoming changes are designed to require best practices in email communication, elevating them from mere recommendations to mandatory requirements. The primary focus is email authentication, but additional measures around consent and engagement will also be enforced. The underlying goal is to increase credibility and trust in email as a communication tool, providing a more secure environment for both senders and recipients and reducing undesired messages clogging up inboxes. 

Let's break down the technical and non-technical requirements for businesses to remain compliant and avoid email purgatory.

Technical Requirements: Email Authentication

Email authentication will play a vital role in the new landscape of email communication. Both Google and Yahoo are set to require senders to implement SPF, DKIM, and DMARC - three primary methodologies of email authentication. Also, if emails are often forwarded, ARC authentication should be implemented. These measures ensure the sender's legitimacy, making it harder for spammers and hackers to exploit the system. As a general rule, you should always use the same domain for email authentication and hosting your public website. 

SPF (Sender Policy Framework)

Sender Policy Framework (SPF) is an email authentication protocol that helps prevent email spoofing and phishing by allowing domain owners to specify which mail servers are authorized to send emails on behalf of their domain. SPF achieves this by publishing a DNS record listing approved mail servers for a particular domain. When an email is received, the recipient's mail server checks the SPF record of the sender's domain to verify whether the originating server is authorized to send emails on behalf of that domain. If the check fails, the recipient's server may mark the email as suspicious or reject it altogether. SPF is essential to email security, validating the sender's authenticity and reducing the risk of fraudulent emails.

DKIM (DomainKeys Identified Mail)

DomainKeys Identified Mail (DKIM) is an email authentication method that helps verify the integrity and authenticity of email messages. It allows the sender to digitally sign the email using a private key, and the recipient can then verify the signature using a public key published in the sender's DNS records. This cryptographic verification ensures that the email has not been tampered with during transit and originates from the claimed sender. DKIM is a critical component of email security, as it helps mitigate phishing and email spoofing attacks by providing a mechanism for recipients to verify the legitimacy of the sender and the message's content.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC works with SPF and DKIM to provide an extra layer of security. It allows senders to define how email receivers should handle unauthenticated mail, offering a robust defense against email spoofing and phishing attacks.

ARC

Authentication, Reporting, and Conformance (ARC) is an email authentication protocol designed to address the challenges associated with email forwarding. Messages often lose their original authentication information in the typical email forwarding scenario, leading to potential phishing and spoofing risks. ARC works by preserving and validating the original authentication results as an email traverses through intermediaries, such as mailing lists or forwarding services. It achieves this by creating a cryptographic "seal" that encapsulates the original authentication information, allowing the recipient's email system to verify the message's authenticity even after it has been forwarded.

ARC provides a standardized framework for email authentication, enhancing the security and integrity of messages as they pass through various stages of forwarding. By enabling the validation of the email's origin at each hop in the forwarding chain, ARC helps prevent the loss of authentication information, reducing the likelihood of false positives and negatives in email security. It offers a more robust solution for organizations seeking to maintain trust in their email communication and combat the growing threat of phishing attacks.

How to implement authentication

While implementing email authentication sounds tedious, the good news is that anyone with experience managing Domain Name Servers (DNS) should be able to confirm that your email authentication is set correctly.

Implementing SPF, DKIM, and DMARC involves configuring DNS records for your domain to enhance email security and authentication. Here's a step-by-step guide:

1. SPF (Sender Policy Framework):

• Create SPF Record:  Add a TXT record to your domain's DNS with the list of authorized mail servers. For example, v=spf1 include:_spf.yourdomain.com ~all.

1. DKIM (DomainKeys Identified Mail):

• Generate DKIM Key Pair:  Create a public-private key pair. The private key signs outgoing emails, and the public key is published in your domain's DNS.
• Publish DKIM Public Key:  Add a TXT record to your domain's DNS with the DKIM public key. For example, v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQE....

1. DMARC (Domain-based Message Authentication, Reporting, and Conformance):

• Create DMARC Record: Add a TXT record to your domain's DNS specifying your DMARC policy. For example, v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com.

• Monitor and Enforce:  Start with a monitoring-only (p=none) policy to gather data, then move to an enforcement policy (p=quarantine or p=reject).

Determining if email servers support Authenticated Received Chain (ARC) requires checking the documentation and specifications of the email servers in use. ARC is a protocol designed to address email authentication challenges in forwarding scenarios. Consult your email service provider as soon as possible to confirm ARC support. 

Not part of your IT department? Take these steps to remain compliant with Google and Yahoo email. 

Actively Manage Email Subscriptions

Besides technical requirements for email authentication, marketing and sales teams need to carefully consider how they use email to communicate. When actively managing your email subscriptions, make sure to include the following steps:

1) Review your email subscriptions to send them only to individuals who want to receive messages. In fact,  Google states explicitly :

• "Don't purchase email addresses from other companies," and 
• "Don't send messages to people who didn't sign up to get messages from you."

2) Confirm each recipient's email address using double opt-in. After an initial subscription request, promptly send a clear and concise confirmation message explaining the benefits of subscribing and what the subscriber can expect. Doing so you will reduce the risk of spam and incorrect email addresses in your CRM. Implementing a double opt-in automated workflow is also a great fail-safe to ensure compliance within your organization and prevent rogue actors from loading thousands of emails. (I'm looking at you, rogue sales team member, with your list of 6000 contacts in Excel.)

3) Periodically send messages to confirm that recipients want to stay subscribed.

An example email could be as simple as: