Did you know that Gmail and Yahoo are enforcing new sending rules effective February 2024? If you send 5000 or more emails per day from your domain, it’s important for you to adapt and review quickly, to ensure your emails will be able to continue to reach your customers, considering that these email services (particularly Gmail) are commonly used email services by customers to this day.

You can review the official announcements from Google and Yahoo respectively below:

• Google: https://blog.google/products/gmail/gmail-security-authentication-spam-protection/
• Yahoo: https://blog.postmaster.yahooinc.com/post/730172167494483968/more-secure-less-spam

To summarize, starting February 2024 – Gmail and Yahoo will be mandating DMARC for email senders (if you send 5000 or more emails per day). In this tutorial, we will go over what DMARC is, go into greater detail on what Gmail and Yahoo are requiring, and how to set up a DMARC record in under a few minutes.

What is DMARC?

DMARC (which stands for Domain-based Message Authentication, Reporting & Conformance) is an email validation system designed to protect your domain from unauthorized use, such as phishing scams and spoofing. It builds on two existing frameworks – SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) – to enhance email security. In simple terms, DMARC allows domain owners to specify how email from their domain is authenticated and how email providers should handle emails that fail these checks.

Why is DMARC Important?

With Gmail and Yahoo now making DMARC a requirement, not having a DMARC policy could mean your emails to customers using these services might not reach their inboxes. This change is critical for businesses to maintain effective communication with their clients.

Setting Up a Basic DMARC Record

It’s important to note that while Gmail and Yahoo will now require a DMARC record, it doesn’t need to be set at enforcement (p=reject or p=quarantine) for now. This flexibility acknowledges the complexity of DMARC at scale. So, if you’re cautious, setting your policy to p=none is a safe start.

Here’s a step-by-step guide to get you going:

STEP #1 – Check Existing SPF and DKIM Records

Before setting up DMARC, ensure that SPF and DKIM are properly configured for your domain. These are prerequisites for DMARC to function correctly.

STEP #2 – Create Your DMARC Record

A DMARC policy is communicated via a DNS TXT record. Here’s an example of a basic DMARC record:

v=DMARC1; p=none; rua=mailto:your_email@yourdomain.com

In this record, as you can see we are using p=none as a safe start (as mentioned earlier). This ensures you meet the requirement of having a DMARC record setup, while not dramatically impacting your normal operations. The rua=mailto tag specifies where aggregate reports of DMARC failures will be sent. Gmail and Yahoo have not specified any deadline or requirement to utilize p=quarantine or p=reject, so at the time of writing this tutorial, p=none is OK to use and is considered the safest option.

STEP #3 – Publish the DMARC Record in DNS

Log in to your DNS provider’s management console. Add a new TXT record with the name _dmarc.yourdomain.com. and the value as the DMARC record you created.

STEP #4 – Test Your DMARC Record

After publishing, use online tools like MXToolBox to verify that your DMARC record is correctly set up.

STEP #5 – Monitor and Adjust

Initially, with p=none, DMARC is in a monitoring phase. As mentioned earlier, this is all that is required, at least for now. You’ll receive reports that help you understand your email flow and authentication status. Gradually, you can move to a more restrictive policy like p=quarantine or p=reject as you gain confidence in your email authentication setup.

Conclusion

By following these steps, you can ensure that your emails continue to reach your Gmail and Yahoo users, especially with these upcoming changes.