If you use email marketing services to send newsletters, you need to know the DMARC protocol!
From February 2024, Google and Yahoo will apply new requirements to e-mail messages, especially bulk messages (newsletters).
The goal is to protect its users’ mailboxes from SPAM and/or fraudulent emails, particularly phishing and spoofing.
The protection standard adopted is not new, the DMARC protocol. It has existed for several years and until now had never been made mandatory however highly recommended.
Those who do not comply with these requirements risk having their emails and newsletters rejected from all Google (Gmail, GoogleMail, Google Workspace etc) and Yahoo email addresses as of February 2024.
It is also not difficult to predict, following this initiative by the largest mail service provider, that the same requirements will soon be demanded by many other providers as well.
Do you use email marketing platforms or email marketing software? Don’t wait do a DMARC protocol setup check now!
What is phishing?
Phishing is a form of online scam in which attackers try to obtain personal information, such as passwords, credit card numbers or bank details, by pretending to be a trustworthy person or organization.
Usually, attackers send e-mails or messages that appear to come from financial institutions, e-commerce companies, or other legitimate online services in order to trick people into revealing their personal information.
These e-mails or messages usually contain fraudulent links leading to counterfeit websites where people are tricked into providing their sensitive information.
Therefore, it is important to be aware of phishing and pay attention to the warning signs.
Some of these signs are:
- Spelling or grammatical errors in e-mails
- Requests for personal or financial information through unsecured e-mails
- Requests for urgent or threatening action.
What is spoofing?
Spoofing is a technique used by cyber attackers to falsify the identity of an e-mail sender. Basically, attackers send e-mail messages that appear to come from a legitimate sender, but in reality have been manipulated to hide their true origin.
The purpose of spoofing is to deceive the recipient into believing that the message is from a trusted source in order to obtain sensitive personal or financial information or to spread malware.
The DMARC protocol, discussed in the article, is a tool to help prevent spoofing and authenticate the origin of e-mail messages.
The DMARC service, explained simply
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an outbound message authentication system that relies on 2 other protocols, DKIM and/or SPF (best to use both).
This is a quick but important dialogue between the email sending server and the recipient’s server.
The receiving server verifies the digital signature of the e-mail message (DKIM). It compares it with the one contained in the DNS of the sender domain, also verifies the presence
DMARC performs a check on the digital signatures of the mail through DKIM (DomainKeys Identified Mail) and verifies the origin through SPF (Sender Policy Framework)
If the e-mail message passes the check, the destination server delivers the message to the recipient’s mailbox.
If, however, the requirements are not passed, DMARC tells the destination server what to do with the message, whether to quarantine it or reject it directly.
How to activate DMARC on your own domain
DMARC is a free service, as are DKIM and SPF, and is activated by appropriately configuring the DNS of the domain used for sending messages, which of course must match the sender’s domain.
Generally, if domain and e-mail are on the same provider’s server, it is possible that DKIM and SPF are already set up.
If this is not the case, or if you use different providers for mail and domain, you need to check the capabilities of the mail system provider. It is essential to receive the DKIM key to be included in the domain DNS. The record to be used is of type TXT.
If you use different services for sending emails, for example, for newsletters, you need to retrieve DKIM keys from each provider (e.g., Brevo, Mailchimp etc.) and insert them into as many DNS records.
Easier to set up, SPF also requires that all the details of the services authorized to send e-mail for the domain be entered.
A domain can have multiple DKIM keys, one for each service used, but only one SPF record that contains all the instructions.
Why is it important to use DMARC controls for your email marketing services?
The main objective of email marketing campaigns is to establish direct communication with the target audience(Buyer Persona) to:
- Promote products or services
- Provide useful information to the user also from, for example, technical support, customer care etc.
- Building trust with email recipients.
Keep your email marketing strategy effective, check now to make sure your newsletters are not being blocked by email servers. All the more so if the number of contacts in your database is large.
Not only that, customer care and technical support emails could also be compromised.
All the more so if you have implemented a marketing automation strategy. The emails you planned to send to your users to turn them into customers would be blocked by the mail servers.
I hope I have provided you with a lot of useful information to proceed with adopting the DMARC protocol for your email marketing services.
The main email marketing tool used by Factory Communication is HubSpot, the world’s leading CRM (Customer Relationship Management).
With HubSpot, we plan email marketing and marketing automation campaigns that enable us to turn contacts into customers.
Email marketing services: quality email improves your communication and protects your brand
Mail Deliverability is a concept that is becoming increasingly important in communication and marketing, as e-mail remains one of the most important tools.
Protecting and qualifying your domain’s Mail Deliverability is critical for efficient communication, and for protecting your brand.
It should be considered in any case, both for daily e-mail use and for mail marketing, starting with newsletters, and not least all communications, contacts and transactional e-mails, coming from corporate websites and webstores.
Don’t underestimate your website, it also sends a lot of emails
Emails sent from websites are often overlooked, it is taken for granted that they are sent correctly, while it is not uncommon for them to end up in SPAM.
These are important emails: notifications of any problems, contact or quote forms, order confirmations etc etc, if they end up in SPAM, not only your business, but also your brand reputation suffers.
In conclusion, what to do to improve the Mail Deliverability of your domain
These are just a few steps, but all very important.
Probably some or all of these options you already have active, it is good to check them in DNS, to check the consistency and correctness of the information:
- SPF record: check your domain’s SPF record, it should contain all possible origins of emails in your domain, and in case delete unused ones from previous service providers.
- DKIM record: you must have a digital signature for each email source, such as SMTP server, Newsletter, CRM, website.
- DMARC record: checks for the presence of said record, which has indicated an email address for error notifications.
On the net you can find numerous online tools for verifying these services, they can help you, but a minimum of expertise on the subject is necessary, for an optimal configuration it is better if you rely on a professional.
If you also want to send the right message, at the right time, to the right person, contact us!
DMARC Protocol: FAQ
Here you will find a list of FAQs we have selected for you:
DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that relies on SPF and DKIM to verify the authenticity of messages. It works like this:
1. The sender publishes a DMARC record in the DNS of its domain
2. When a receiving server receives an email, it checks the DMARC record of the sender domain
3. The server performs SPF and DKIM checks as specified in the DMARC record
4. Based on the result and the DMARC policy, the server decides how to handle the message (accept, quarantine, or reject)
5. The server sends aggregate reports to the sender on the status of the verifications
Implementing DMARC offers several benefits2:
– Prevents domain misuse in phishing and spoofing attacks
– Improves delivery of legitimate emails
– Provides reports on impersonation attempts
– Increases visibility and control over emails sent from one’s domain
– Protects brand reputation
– Reduces the risk of email fraud
DMARC provides three possible policies:
1. None (p=none): No action is taken on emails that fail authentication. Used in the initial phase to monitor without impact.
2. Quarantine (p=quarantine): Emails that fail authentication are quarantined (usually in the spam folder).
3. Reject (p=reject): Emails that fail authentication are rejected completely.
No, DMARC can work with only SPF or only DKIM implemented2. However, it is strongly recommended to implement both protocols for more robust protection and better deliverability of legitimate emails.
To implement DMARC3:
1. Properly configure SPF and/or DKIM for the domain
2. Create a DMARC record in the domain DNS, specifying the desired policy
3. Start with a “none” policy to monitor without impact
4. Analyze DMARC reports received
5. Gradually increase enforcement by moving to “quarantine” and finally “reject”
6. Continue to monitor and optimize based on feedback received
Want to learn more about email marketing services?
Read these articles!
