New Email Authentication Rules: Google and Yahoo

At the start of 2024, the email challenge for businesses in 2023 is not only to combat phishing attacks continually but also to adapt to the reinforced requirements of Google and Yahoo regarding authentication. Emails are a complex process but essential for email security in the future.

In 2021, 319.6 billion emails were in circulation every day. Used en masse by companies — both internally and to communicate with their customer and partner ecosystems, this number should reach 376.4 billion by 2025. Having become a preferred vector for threat actors, they do not hesitate to exploit this universal tool to deploy their email phishing campaigns. Therefore, protecting mailboxes is a vital issue for companies wishing to communicate securely with their customers.

Faced with this threat, Google and Yahoo are responding with new requirements for email authentication designed to prevent cybercriminals from abusing it. While this major change is excellent news for consumers, there is little time left for businesses to prepare since these new requirements will be applicable during the first quarter of 2024. 

Email authentication has been a security best practice for several years now. The DMARC protocol (for Domain-based Message Authentication Reporting and Conformance), free of charge for around ten years, constitutes the reference standard for protection against email fraud, a key technique in BEC attacks. (business email compromise) and phishing.

Yet many businesses still need to implement it, a gap they will need to quickly make up for if they want to be able to send emails to Gmail and Yahoo addresses. An adaptation that can, however, prove difficult since it requires a series of technical steps and ongoing maintenance. To meet the requirements within the set deadlines, they must, therefore, have the internal resources or the necessary knowledge, which is different.

What these new requirements mean for businesses

Phishing and email compromise pose significant threats to businesses across all industries. By 2023, 84% of organizations will have faced at least one successful phishing attack.

Dubbed the “$26 billion scam” by the FBI, these attacks result in colossal financial losses for victims. With this growing threat, domain name authentication offers protection by breaking the email attack chain.

DMARC and its associated authentication mechanisms—the Sender Policy Framework ( SPF ) and Domain Key Identified Mail ( DKIM )—work together to secure email and prevent techniques such as email spoofing. , a common tactic in phishing attacks. The SPF protocol, for example, allows the receiving mail server to check whether the incoming email comes from an IP address authorized by the company. Once this verification is done, the cybercriminal cannot usurp the company’s identity, thus protecting employees and customers.

For businesses that communicate with their customers through Gmail and Yahoo services, registering as DMARC today presents two challenges: time and maintenance. Implementing each protocol (DMARC, SPF, and DKIM) involves several steps, which can prove delicate, especially when several domain names are involved. Protocols must then be maintained over time. 

However, this process can be simplified and streamlined by exploring tools that integrate with existing workflows. Additionally, working with a security partner provides access to experienced resources that are typically unavailable in-house.

Prepare well for the requirements of Google and Yahoo. 

There are some subtleties between the requirements imposed by Google and Yahoo. Indeed, Google also provides additional conditions for organizations that send mass emails (5,000 or more per day). However, it remains advisable to implement email authentication best practices regardless of this additional condition to strengthen the company’s security posture and thus reduce the risks associated with email. 

Although the timelines are very short, adopting this practice will help protect staff, teams, and stakeholders across an organization. While Google and Yahoo want to protect their users above all, these new requirements will be just as beneficial for businesses. The impact of harmful emails will reach far beyond customers, so they should, therefore, be seen more as a catalyst to strengthen overall defenses against email-related threats.

With a trusted security partner, authentication experts can guide businesses through the implementation process and help simplify it. They will also help to complete the technical steps and ensure compliance with best practices for optimal and global defense.

Strengthening these defenses with the right technology

Even today, humans are the weak link in the attack chain, and human error is the leading cause of cyber incidents. While user awareness and education significantly reinforce this vulnerability, technical controls such as DMARC protect the entire ecosystem against phishing.

Like any security tool, DMARC is not a silver bullet but a free tool for businesses; it adds an extra layer of protection to strengthen overall defenses. Google and Yahoo’s email requirements present an excellent opportunity for organizations to close their security gaps with expert support and resources available. You don’t have to face this journey alone — leverage the experts and resources to ensure you address email threats holistically.

Also Read : How To Know If Your Email Has Been Read