Yahoo’s big change to their DMARC policy has sparked a remarkable amount of debate among stakeholders in the email and security ecosystems. As is usually the case with these crowds, there’s a lot of religion both in support of and against the change. I’m trying to stay out of it, but I’m not sure I’m succeeding.
So, to take a small detour, I thought it might be interesting (or at least somewhat less exasperating) to advance some sort of answer to a related question I’m hearing from both sides: who in the actual heck would use an address from a free inbox provider as the From: address for their own marketing and newsletter mail? Continue reading
It’s going to be a busy Monday for many ESPs and small senders out there today.
Recently, Yahoo Mail appears to have changed its DMARC policy to “p=reject,” meaning that ESP customers who send using a Yahoo email address in the From: line are going to see a spike in hard bounces. In many cases, that will trigger support calls to their ESP’s deliverability teams.
The change doesn’t affect just mail sent to Yahoo, but to any domains that are participating in DMARC. By making the change, Yahoo is essentially instructing any receiving domain that checks Yahoo’s DMARC policy to reject mail that purports to originate from Yahoo’s domain, but that comes from an IP address belonging to someone else.
On a first take, that might sound like a perfectly reasonable security measure. However, lots of mom and pop shops and other small senders who rely on ESPs for their mail programs are using From: addresses (e.g., email@example.com) that are serviced by a free inbox provider, including Yahoo, Gmail, and Aol. It’s not an optimal way of doing things, but there’s nothing inherently abusive about it, either.
I’m hoping that Yahoo will consider reversing the change – and soon! – as it is very likely to result in the inadvertent rejection of a lot of wanted mail. I’ll keep you posted.
Edit: Here are samples of bounces from different large ISPs that you can use to grep your own MTA logs:
smtp;550 5.2.0 mav01n00T5PRKmP0Fav191 Message rejected due to DMARC. Please see http://postmaster.comcast.net/smtp-error-codes.php#DM000001
smtp;550 5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's DMARC policy. Please contact administrator of yahoo.com domain if this was a legitimate mail. Please visit http://support.google.com/mail/answer/2451690 to learn about DMARC initiative. 100si2781324qgv.4 - gsmtp
smtp;550 5.7.1 DMARC failure for domain yahoo.com, policy reject
In my time consulting for senders on deliverability issues, I’ve heard more than a few clients try to explain to me why inactive recipients are never really a problem – until there’s a problem.
Starting July 15th, there is going to be a problem. Continue reading