6 ms·

This change was necessary and long overdue. Requiring domain owners who send significant volumes of email to properly sign their messages allows receivers to mo

by ttul 3y ago

This change was necessary and long overdue. Requiring domain owners who send significant volumes of email to properly sign their messages allows receivers to more clearly delineate good from bad based on domain reputation rather than IP address reputation. As more domains send email through shared IP space on transactional and marketing services, having the ability to attach reputation reliably to the sender domain is incredibly helpful in reducing abuse.

xoneill 3y ago
Agreed, this is the upside for sure. Despite frustrations, I'm hoping this cleans things up.
adrian_b 3y ago
The condition about "significant volumes" is not true. Google states that the new requirements are mandatory only when you send at least 5000 messages per day. This is a lie. I send at most a few messages per day and usually less than one per day was towards a gmail account and I had implemented a part of the requirements, but not all of them. Nevertheless, Google has started to reject my messages, so I was forced to waste time with the implementation of all requirements, even if they are somewhat redundant.
- skrause 3y ago
  Maybe someone else sent 5000 mails to Gmail users using your unauthenticated domain.
  - b112 3y ago
    http://139.177.194.177/bah.png http://139.177.194.177/bah.png
  - adrian_b 3y ago
    That would not have been possible, with the already existing checks. While the individual messages were not yet signed, Gmail should have already rejected any message claiming to be from my domain that was not sent by my own server.
- denton-scratch 3y ago
  My domain also sends no more than 10 messages a day. The domain is correctly-configured with SPF, DKIM and DMARC. At the beginning of March, I started getting temporary rejections from gmail. Not all of my outgoing messages, maybe 1 in 10. Most of these messages were to one individual, to whom I've been sending for years. My domain has existed continously since 2002, and has never sent spam. The rejection message was startling: words to the effect of "Your message has been rejected because of the awful reputation of the sending domain". The reputation of my domain is spotless, according to various testing tools. There have been no new rejections in the last two weeks. According to TFA, Google started rejecting a proportion of mail from bulk senders in February. I wonder if I got caught up in some half-baked roll-out of this new (old) policy.
  - drdebug 3y ago
    Same here with 20+ years old mail service on the same domain that has never sent spam with correctly configured DNS SPF DKIM DMARC, getting gmail rejections. I noticed a significant improvement after linking the domain to my google account https://support.google.com/mail/answer/9981691 https://support.google.com/mail/answer/9981691
  - jeromegv 3y ago
    Did you link your domain to Google Webmaster tools? It will let you know what your domain reputation is.
    - denton-scratch 3y ago
      No, I did not. I barely ever use Google services of any kind. My "domain reputation" should mean something like "the consensus of multiple reputation services", where those reputation services are reasonably open about how they score. It shouldn't mean "the completely opaque opinion of a single, hyper-dominant, secretive provider with all kinds of conflicts of interest".
- janosdebugs 3y ago
  I can confirm this, I have a mail server with extremely low, non-bulk mail traffic and without SPF/DKIM/DMARC nothing works. Even with, Gmail started rejecting mail (probably noisy neighbor), so the only way around that was to use the little-advertized relay service in the paid Google Workspace when sending towards gmail or workspace domains.
- sdfhbdf 3y ago
  It also says that you only need to hit this limit once and you’re forever on that list. Also domain is considered as the canonical domain, the part right before the TLD. Subdomains are counted together with the apex domain.
- ttul 3y ago
  The 5,000 message limit adds _extra_ requirements for senders; ALL senders, regardless of volume, must adhere to these standards: Starting February 1, 2024, all email senders who send email to Gmail accounts must meet the requirements in this section. - Set up SPF or DKIM email authentication for your sending domains. - Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. Learn more - Use a TLS connection for transmitting email. For steps to set up TLS in Google Workspace, visit Require a secure connection for email. - Keep spam rates reported in Postmaster Tools below 0.3%. Learn more about spam rates - Format messages according to the Internet Message Format standard, RFC 5322. - Don’t impersonate Gmail From: headers. Gmail will begin using a DMARC quarantine enforcement policy, and impersonating Gmail From: headers might impact your email delivery. - If you manage a forwarding service, including mailing lists or inbound gateways, add ARC headers to outgoing email. ARC headers indicate the message was forwarded and identify you as the forwarder. Mailing list senders should also add a List-id: header, which specifies the mailing list, to outgoing messages. https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F81126%3Fhl%3Den&assistant_id=generic-unu&product_context=81126&product_name=UnuFlow&trigger_context=a https://apps.google.com/supportwidget/articlehome?hl=en&arti...
cj 3y ago
As a sys admin, what do you do when you see 5% of your email hitting spam because the recipient’s Office365 mail server is misconfigured? Agreed it’s a net positive, but it kills me when the reason emails land in spam is misconfiguration at the recipient’s end. (Like forwarding emails which breaks SPF)
- brightball 3y ago
  As long as DKIM is configured correctly, it shouldn't matter.
- BeFlatXIII 3y ago
  My employer has had massive issues with this recently. Lots of office chatter from HR about needing to call candidates b/c the response rate is down this year due to spam folders eating the offers.
ozim 3y ago
We also slowly but surely are moving towards IPv6 which will make reputation based on IP somewhat useless when I can have as many new IP addresses as I want. They would have to make all newly seen IPv6 addresses not trusted by default when bad actor could send each email from different IPv6 address.

by ttul 3y ago

xoneill 3y ago

Agreed, this is the upside for sure. Despite frustrations, I'm hoping this cleans things up.

adrian_b 3y ago

The condition about "significant volumes" is not true. Google states that the new requirements are mandatory only when you send at least 5000 messages per day. This is a lie. I send at most a few messages per day and usually less than one per day was towards a gmail account and I had implemented a part of the requirements, but not all of them. Nevertheless, Google has started to reject my messages, so I was forced to waste time with the implementation of all requirements, even if they are somewhat redundant.

skrause 3y ago
Maybe someone else sent 5000 mails to Gmail users using your unauthenticated domain.
- b112 3y ago
  http://139.177.194.177/bah.png http://139.177.194.177/bah.png
- adrian_b 3y ago
  That would not have been possible, with the already existing checks. While the individual messages were not yet signed, Gmail should have already rejected any message claiming to be from my domain that was not sent by my own server.
denton-scratch 3y ago
My domain also sends no more than 10 messages a day. The domain is correctly-configured with SPF, DKIM and DMARC. At the beginning of March, I started getting temporary rejections from gmail. Not all of my outgoing messages, maybe 1 in 10. Most of these messages were to one individual, to whom I've been sending for years. My domain has existed continously since 2002, and has never sent spam. The rejection message was startling: words to the effect of "Your message has been rejected because of the awful reputation of the sending domain". The reputation of my domain is spotless, according to various testing tools. There have been no new rejections in the last two weeks. According to TFA, Google started rejecting a proportion of mail from bulk senders in February. I wonder if I got caught up in some half-baked roll-out of this new (old) policy.
- drdebug 3y ago
  Same here with 20+ years old mail service on the same domain that has never sent spam with correctly configured DNS SPF DKIM DMARC, getting gmail rejections. I noticed a significant improvement after linking the domain to my google account https://support.google.com/mail/answer/9981691 https://support.google.com/mail/answer/9981691
- jeromegv 3y ago
  Did you link your domain to Google Webmaster tools? It will let you know what your domain reputation is.
  - denton-scratch 3y ago
    No, I did not. I barely ever use Google services of any kind. My "domain reputation" should mean something like "the consensus of multiple reputation services", where those reputation services are reasonably open about how they score. It shouldn't mean "the completely opaque opinion of a single, hyper-dominant, secretive provider with all kinds of conflicts of interest".
janosdebugs 3y ago
I can confirm this, I have a mail server with extremely low, non-bulk mail traffic and without SPF/DKIM/DMARC nothing works. Even with, Gmail started rejecting mail (probably noisy neighbor), so the only way around that was to use the little-advertized relay service in the paid Google Workspace when sending towards gmail or workspace domains.
sdfhbdf 3y ago
It also says that you only need to hit this limit once and you’re forever on that list. Also domain is considered as the canonical domain, the part right before the TLD. Subdomains are counted together with the apex domain.
ttul 3y ago
The 5,000 message limit adds _extra_ requirements for senders; ALL senders, regardless of volume, must adhere to these standards: Starting February 1, 2024, all email senders who send email to Gmail accounts must meet the requirements in this section. - Set up SPF or DKIM email authentication for your sending domains. - Ensure that sending domains or IPs have valid forward and reverse DNS records, also referred to as PTR records. Learn more - Use a TLS connection for transmitting email. For steps to set up TLS in Google Workspace, visit Require a secure connection for email. - Keep spam rates reported in Postmaster Tools below 0.3%. Learn more about spam rates - Format messages according to the Internet Message Format standard, RFC 5322. - Don’t impersonate Gmail From: headers. Gmail will begin using a DMARC quarantine enforcement policy, and impersonating Gmail From: headers might impact your email delivery. - If you manage a forwarding service, including mailing lists or inbound gateways, add ARC headers to outgoing email. ARC headers indicate the message was forwarded and identify you as the forwarder. Mailing list senders should also add a List-id: header, which specifies the mailing list, to outgoing messages. https://apps.google.com/supportwidget/articlehome?hl=en&article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F81126%3Fhl%3Den&assistant_id=generic-unu&product_context=81126&product_name=UnuFlow&trigger_context=a https://apps.google.com/supportwidget/articlehome?hl=en&arti...

cj 3y ago

As a sys admin, what do you do when you see 5% of your email hitting spam because the recipient’s Office365 mail server is misconfigured? Agreed it’s a net positive, but it kills me when the reason emails land in spam is misconfiguration at the recipient’s end. (Like forwarding emails which breaks SPF)

brightball 3y ago
As long as DKIM is configured correctly, it shouldn't matter.
BeFlatXIII 3y ago
My employer has had massive issues with this recently. Lots of office chatter from HR about needing to call candidates b/c the response rate is down this year due to spam folders eating the offers.

ozim 3y ago

We also slowly but surely are moving towards IPv6 which will make reputation based on IP somewhat useless when I can have as many new IP addresses as I want. They would have to make all newly seen IPv6 addresses not trusted by default when bad actor could send each email from different IPv6 address.