Enhancing email security: Navigating new Google and Yahoo DMARC changes

In the evolving landscape of email security, major players like Google and Yahoo are implementing new DMARC (domain-based message authentication, reporting, and conformance) requirements set to roll out in early 2024.

These changes present a unique opportunity to proactively safeguard K-12 educational institutions, particularly those relying on G Suite, against potential business interruptions associated with third-party learning providers, as well as own-domain impersonation attacks (spoofing).

Announced change to sender authentication mandates

As recently announced, both Google and Yahoo are continuing their introduction of proper sender authentication to protect their customers from e-mail attacks that are spoofing the sender domain(s). Both, Yahoo and Google started this journey a while ago by slowly introducing more weight to protocols like sender policy framework (SPF), DomainKeys identified mail (DKIM), and DMARC.

Their announced next step will be imposing increasingly stringent email authentication requirements starting February 2024. Sender domains that deliver more than 5,000 e-mails per day to Gmail or any Google Workspace-hosted entity will have to carry a DMARC policy or face the consequences of getting legitimate inbound mail rejected due to the inability to validate the sender’s authenticity.

After the change, high-volume senders delivering mail to Google Workspace will have to prove authenticity or face delivery issues including potential rejection of legitimate inbound mail.

The challenge for education customers

Common third-party learning providers such as Blackboard, PowerSchool, MySchoolBucks, and more often send substantial volumes of emails to faculty, staff, and students using the institution's domain as their sender domain. With these educational institutions’ e-mail hosted on Google Workspace, the upcoming changes in DMARC mandates are poised to significantly impact the deliverability of these third-party senders as they are effectively spoofing the educational institutions' domains.

In the eyes of Google, as of February 2024 all of these e-mails are going to be treated the same way that a domain-spoofing phishing attack will be treated.

How Barracuda can help

Barracuda's Domain Fraud Protection as a DMARC-reporting solution emerges as a crucial ally in addressing this challenge. However, given the impending enforcement by Google in February 2024, educational institutions have a narrow window of opportunity to implement DMARC protection for their domains.

Barracuda’s proactive approach will do both — stop inbound e-mail attacks and ensure uninterrupted email communication with third-party learning providers. Most importantly it will shield organizations from potential impersonations of their domains, which is one of the most successfully exploited phishing vectors.

Conclusion

As the digital landscape continues to evolve, the importance of email security in K-12 education cannot be overstated. The upcoming DMARC changes from Google and Yahoo provide a unique opportunity for educational institutions to fortify their defenses against email fraud and ensure a more secure inbox environment while making sure business-critical communication does not get hindered. With the right measures in place, K-12 institutions can embrace these changes as a proactive step toward a safer digital communication ecosystem.

This blog was authored by Thorsten Stoeterau with research and content support from Barracuda Field Solution Architect Michael Townsend.