Google revealed on October 3, 2023, that beginning in February 2024, mass senders using Gmail would need to verify their emails. Neil Kumaran, a group product manager in charge of Gmail security and trust, made this revelation. This policy has taken effect as of February. Gmail issues are starting to appear in user reports; they indicate that the sender's lack of authentication has resulted in the email being banned.
A New Google Policy Will Close The Gmail Attacker Loophole
Users should be able to "confidently rely on an email's source" and not have to "worry about the intricacies of email security standards," according to the October release, "New Gmail protections for a safer, less spammy inbox." It's spot on, so you won't find me griping about it. Google believes that the best way to fix what it refers to as "loopholes exploited by attackers" that pose a danger to all of us is to mandate that all Gmail users who send "significant volumes" of emails use a strong email authentication technique. Since there are 1.8 billion Gmail accounts, all of us.
Gmail Users Report Authentication Issues
Seth Blank is co-chair of the domain-based message authentication, reporting, and conformance working group and chief technology officer of the email domain validation platform Valimail. "You will start to see temporary errors for unauthenticated mail as of the beginning of February, and starting in April, unauthenticated mail that does not pass DMARC will start to be rejected," cautions Blank. Blank was correct: people are already reporting those login failure messages, and while they are only temporary at the moment, the uncertainty they cause is probably going to last longer. Let's attempt to clarify it.
"Bulk senders who don't meet sender requirements will start getting temporary errors (with error codes) on a small percentage of their non-compliant email traffic in February 2024," according to Google. In order to help senders address problems that lead to non-compliance, these temporary errors are intended to assist senders in identifying email traffic that does not comply with our criteria.
When 99.9% AI Spam Filtering Rate And 15 Billion Daily Blocked Emails Are Not Enough
Although Gmail AI blocks over 99.9% of spam, phishing, and malware from reaching your inbox—including around 15 billion emails per day—Google's Kumaran claims that this is insufficient, which is why the additional bulk email sender criteria have been put in place.
First off, according to Kumaran, "those who send more than 5,000 messages to Gmail addresses in one day" are considered bulk senders. Malicious actors may use email domains for illicit activities, as many do not adequately safeguard their networks. Much of this content that compromises security must be filtered out, and sender validation and robust email domain authentication are crucial for this. "We started requiring emails sent to a Gmail address to have some form of authentication last year (2022), and we've seen a 75% decrease in the number of unauthenticated messages Gmail users receive," adds Kumaran. As a result, billions of communications with harmful purposes were stopped before they could be sent, clearing up Gmail inbox congestion.
Google has made accessible unsubscription options for Gmail users available in addition to the additional authentication requirements for bulk mail sending. Additionally, Google throttles senders that violate their "clear spam rate threshold." You should notice even less spam in your inbox as a consequence of this industry first, according to Kumaran.
What Does "Unauthentication Error" in Gmail Mean?
Another expert in email domain verification, PowerDMARC, has the finest explanation of what these problems signify that I have discovered. Yunes Tarada, the head of the operations team and a specialist in email security and authentication, deconstructs and clarifies a common Gmail unauthenticated sender error message. Tarada adds that users who send fewer than 500 emails a day may also find that Gmail is blocking their messages if they are impersonating Gmail through headers, do not have Sender Policy Framework or DomainKeys Identified Mail implemented, have a spam rate higher than 0.3%, do not have a Transport Layer Security connection for transmitting emails, do not have Authenticated Received Chain enabled to forward messages, or have invalid DNS records.
Expert Says Bulk Email Needs Herd-Immunity
In an effort to help senders and receivers better grasp the authentication requirements, Blank has been directly submitting consumer comments about the guidelines to Google. According to Blank, "when done correctly, email authentication protects partners, customers, and anyone receiving email. This isn't just about protecting yourself." According to Blank, in order to render precise domain spoofing "economically uninteresting," a herd-immunity proportion of 70% of the biggest bulk email senders using string authentication must be obtained.
"Every business will need to become familiar with standards like SPF, DKIM, and DMARC, just as we adapted to HTTPS as the standard for the World Wide Web and like MFA is becoming the standard for our online accounts," says Gerasim Hovhannisyan, CEO of EasyDMARC. Hovhannisyan goes on, "As we navigate the evolving cyber landscape, it will be paramount for businesses to maintain effective communication channels and uphold their digital reputation to stay proactive in adopting and adapting to these security trends."
Updated 02/08: Google is blocking more than just emails in an effort to filter out spam and dangerous conduct. Google recently revealed that it is testing a new feature to prevent Android users from side-loading potentially dangerous applications.
Google's head of mobile security strategy, Eugene Liderman, has announced that the firm would begin testing an improved fraud prevention programme for Android users in Singapore in the next weeks as "part of a continued strategic partnership with the Cyber Security Agency of Singapore." The upgraded fraud prevention programme, according to programmers, has "been tested by the Singapore government." It functions by identifying and analyzing grammars that may otherwise misuse crucial runtime rights.
When an Android user tries to install an app from somewhere other than the official Play Store, the analysis is done in the background. According to the Google statement, this might include employing file managers, chat applications, and web browsers as an internet-side loading source. In particular, the improved fraud prevention pilot will highlight any of four runtime rights—RECIEVE_SMS, READ_SMS, BIND_Notifications, and Accessibility—and examine app permissions being defined in real-time.
This makes sense since, according to Liderman, "fraudsters frequently abuse these to spy on screen content and intercept one-time passwords via SMS or notifications." Using these runtime rights, fraud malware families have been the target of a Google investigation, which indicates that "95 percent of installations came from Internet-sideloading sources."
Liderman suggests that developers check the permissions that their applications are requesting from the device to make sure that the procedure complies with Android privacy best practices. Reducing the number of requests for permissions is the first item on the checklist. According to Linderman, "Your app should only ask for permissions that it needs in order to accomplish an action, and make sure it complies with the Mobile Unwanted Software guidelines." In addition to offering guidance on how to resolve any possible problems, Google will provide an appeals process in case an app is prohibited by the improved fraud protection programme. "Always ensure that your app does not engage in behaviour that could be considered potentially harmful or malware," is Google's major advice to developers.
The Singapore Civil Society's deputy chief executive, Chua Kuan Seah, states, "The fight against online scams is a dynamic one." To remain ahead of the curve as cybercriminals hone their techniques, we need to work together and be creative. Liderman ends by promising that "we will be closely monitoring the results of the pilot programme to assess its impact and make adjustments as needed." This assurance is directed at both Google users and Android developers.