cisagov / cisagov/XFD

Update Email Processes to Conform with Guidelines

Open
#177 0 comments 0 reactions 1 assignee Claimed by @aloftus23 View on GitHub
improvement
Dominant language
Python
Stars
30
Forks
22
Avg merge
1d 21h
Merged PRs (30d)
22

Description

# 💡 Summary #

Google and Yahoo have requirements for bulk email senders, effective from February 2024. These guidelines focus on enhancing email authentication, controlling spam rates, and simplifying unsubscription processes. As part of our maintaining a secure email ecosystem, we need to modify our email processes to align with these guidelines.

References:
[Gmail email sender guidelines](https://support.google.com/a/answer/81126?sjid=10253132089674411725-NA&visit_id=638490531658576645-2096620686&rd=1)
[New rules for bulk email senders from Google, Yahoo: What you need to know](https://www.msn.com/en-us/news/technology/new-rules-for-bulk-email-senders-from-google-yahoo-what-you-need-to-know/ar-AA1l6t5W)
[Explained: New Inbox Protection Rules from Google and Yahoo for 2024](https://www.mailerlite.com/blog/new-requirements-from-google-and-yahoo)
[Google and Yahoo announce new requirements for email delivery](https://blog.redsift.com/email/google-and-yahoo-announce-new-requirements-for-email-delivery/)[1](https://www.msn.com/en-us/news/technology/new-rules-for-bulk-email-senders-from-google-yahoo-what-you-need-to-know/ar-AA1l6t5W)[2](https://www.zerobounce.net/blog/email-resources/email-verification/google-yahoo-rules-bulk-email-senders)[3](https://www.mailerlite.com/blog/new-requirements-from-google-and-yahoo).
https://aws.amazon.com/blogs/messaging-and-targeting/using-one-click-unsubscribe-with-amazon-ses/

## Motivation and context ##

A critical requirement to scale services.

## Implementation notes ##

Email Authentication:
- Bulk email senders must adhere to well-established best practices for authenticating outgoing emails.
- Implement the following mechanisms: Sender Policy Framework (SPF): Prevents domain spoofing by allowing senders to identify authorized email servers. DomainKeys Identified Mail (DKIM): Adds a digital signature to verify messages from authorized senders. Domain-based Message Authentication, Reporting, and Conformance (DMARC): Specifies actions when an email fails authentication and enables reporting on authentication results.
One-Click Unsubscribing:
- Every email sent should include a one-click unsubscribe option.
- Promptly process unsubscription requests within two days

## Acceptance criteria ##

- [ ] Review current email processes and identify areas that need adjustment.
- [ ] Ensure compliance with the new guidelines.
- [ ] Update email templates to include the one-click unsubscribe link.
- [ ] Implement SPF, DKIM, and DMARC protocols to enhance email authentication.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.