Gmail and Yahoo’s 2024 inbox protections and what they mean for email programs

Original Article ↗ Hacker News Discussion ↗

Gmail and Yahoo are tightening inbox rules for 2024, requiring bulk senders (those sending ≥5,000 messages a day to Gmail) to use SPF, DKIM and DMARC, support one‑click unsubscribe, and keep spam complaints below 0.3%. Commenters note that serious senders and many self‑hosters already use these protections, but worry about edge cases like email forwarding, shared SMTP services, and distinguishing marketing from transactional messages such as password resets. There is broad support for curbing abusive marketing practices, though skepticism remains about how accurately large providers classify email and how much this will actually reduce spam versus further entrenching major email platforms.

Scope of the New Gmail/Yahoo Requirements

  • Bulk senders (≥ ~5,000 messages/day to personal Gmail) must:
    • Use SPF, DKIM, and DMARC.
    • Keep user‑reported spam complaints below 0.3%.
    • Support one‑click unsubscribe per RFC 8058 and include a visible unsubscribe link in the body (for marketing/subscription mail).
  • “Bulk sender” is defined by messages from the same primary domain in a 24‑hour period; hitting the threshold once marks you as bulk permanently.
  • Transactional mail (e.g., password reset, MFA) is supposed to be exempt from unsubscribe, but it is unclear to some how Google reliably distinguishes transactional vs marketing content.

SPF, DKIM, DMARC: Roles, Limits, and Edge Cases

  • Many see SPF/DKIM/DMARC as “old hat” and basically required already for good deliverability.
  • SPF authenticates sending IP against envelope‑from; DKIM signs headers/content; DMARC tells receivers how to act when they don’t align.
  • Some argue SPF alone is sufficient in theory; others say SPF‑only invites spoofing and that DKIM is more robust (keys vs re‑used IPs).
  • Forwarding breaks SPF; DMARC plus ARC (RFC 8617) is mentioned as the intended fix, but ARC is not fully standardized and behavior under mandatory DMARC is considered unclear.
  • Question raised whether “p=none” DMARC technically satisfies the new “DMARC required” rule.

One‑Click Unsubscribe and UX/Security Concerns

  • The real “new” technical burden is support for RFC 8058 (List‑Unsubscribe POST).
  • Some worry about:
    • Link scanners and crawlers auto‑triggering unsubscribes.
    • Anyone who receives a forwarded message being able to unsubscribe the original recipient.
  • Others respond that:
    • POST, not GET, mitigates some scanning issues.
    • False or prank unsubscribes are a minor harm compared to abusive retention.
    • Confirmation or “oops, resubscribe me” flows and follow‑up confirmation emails can help.

Deliverability, Small Senders, and Self‑Hosting

  • Several self‑hosters report good deliverability if DNS, rDNS, DMARC alignment, and IP reputation are solid; others report rejection by major providers despite doing everything “right”.
  • Shared smarthosts (SendGrid, SES, etc.) complicate things; domain‑based counting helps, but some fear misclassification and lack of recourse.
  • IP warming and finding hosts that allow outbound SMTP are described as harder than setting up SPF/DKIM/DMARC.

DMARC Reporting Ecosystem

  • Many find DMARC aggregate reports (XML in ZIPs) unusable directly and rely on dashboards/services.
  • Multiple commercial and free tools are mentioned; some criticize the “DMARC SaaS industry” as overpriced for simple XML parsing and want lightweight self‑hosted options.

Attitudes Toward Marketing Email and Spam

  • Strong frustration with unsolicited marketing, re‑opt‑ins, dark‑pattern unsubscribes, and “legal update” spam masquerading as transactional.
  • Some mark nearly all commercial email as spam on principle and hope the 0.3% spam‑rate cap forces cleaner practices.
  • Others doubt the changes will meaningfully reduce real‑world spam, noting that much spam already comes from large, fully authenticated providers (including Gmail/Yahoo themselves) and that false positives and inconsistent filtering remain common.