English
Magyar
Gmail is one of the largest (and, according to many, the best) email providers in the world. Thanks to its state-of-the-art features and seamless integration with other Google services, Gmail has managed to outperform all its competitors. With a massive user base of 1.8 billion, Gmail places great emphasis on security requirements and restrictions to ensure the safety of its users and the protection of their data.
This article outlines Gmail’s various security requirements, guides you through the finer points of how these requirements apply to your business email domain, and helps you understand how to meet or maintain Gmail’s security requirements.
Sender authentication
If you want to send bulk emails via Gmail, you must comply with the following:
- SPF or Sender Policy Framework
- DKIM or DomainKeys Identified Mail
- DMARC or Domain-based Messages Authentication Reporting and Conformance
Let’s take a look at each of the protocols.
SPF
SPF, the oldest email authentication protocol, is designed to ensure that unauthorised emails sent from a domain do not reach the recipient’s inbox. With SPF in place, your email communications are protected against threats such as spoofing and phishing.
As a domain owner, you can create a list of authorised servers that are permitted to send emails from your domain. This list is uploaded as a TXT-type DNS record. When an email arrives at the recipient’s mail server, it queries the list of authorised servers to check whether the sending server is included on the approved list.
If the sending server is not authorised, the email will either be rejected or sent to the spam folder.
DKIM
DKIM is used by the domain holder to ensure that outgoing emails are not tampered with during transmission. To do this, DKIM uses cryptographic signatures. These signatures are added to the DKIM protocol header. The domain owner generates a public and a private key. The public key is uploaded to the DNS records so that the recipient’s server can download it.
After downloading, the recipient’s server uses the same key to decrypt the cryptographic signature. The email passes the DKIM check if its content matches the decrypted signature.
If an email passes the DKIM check, the result will be ‘pass’. However, if the content does not match the cryptographic signature, or if the signature is missing, the result will be ‘fail’.
Another benefit of using the DKIM protocol is improved email deliverability. Emails with a DKIM signature are less likely to end up in the spam folder.
DMARC
Of the three email authentication protocols, the latest, DMARC, operates based on the results of SPF and DKIM. DMARC enables domain owners to publish one of three policies (none, quarantine or reject), on the basis of which the recipient’s email servers can decide how to handle unauthorised emails sent from that domain.
To pass the DMARC check, the ‘From’ address of an email must match the domain used in the DKIM and SPF checks. However, if an email fails the DMARC check, the recipient’s server will handle it in accordance with one of the three policies outlined above. Domain owners instruct recipient servers on how to handle unauthorised emails. The recipient server will either take no action, in which case the email is delivered safely to the inbox (p=none), or send it to the spam folder (p=quarantine), or return it to the sender (p=reject).
DMARC also features a reporting function, which enables domain owners to thoroughly analyse unauthorised emails based on the aggregated and forensic DMARC reports received from recipient servers.
TLS encryption
This is yet another cryptography-based protocol that enables secure communication over computer networks. Its ultimate aim is to protect the integrity of data transmitted between the sending and receiving servers. To ensure that emails are encrypted whilst in transit, both the sending and receiving servers must support TLS encryption.