Google is doubling down on its efforts to make Gmail a safe and secure home for online communication with three new requirements for bulk senders, which will be enforced beginning February 2024.

Gmail Security and Trust Product Manager Neil Kumaran described the new rules in a blog post as "a tune-up for the email world" designed to keep things running smoothly – the way an oil change might help a car.

But like auto maintenance, "this is not a one-time exercise," Kumaran wrote. "Keeping email more secure, user friendly and spam-free requires constant collaboration and vigilance from the entire email community."

Bulk senders (anyone who sends more than 5,000 messages to Gmail addresses in one day) will be required to authenticate their email, provide an easy way to unsubscribe, and make sure the messages they're sending are wanted.

These security moves are echoed and supported by the broader industry. Yahoo, for example, says it "looks forward to working with Google and the rest of the email community to make these common sense, high impact changes the new industry standard," Yahoo Senior Director of Product Marcel Becker said in a statement. "No matter who their email provider is, all users deserve the safest, most secure experience possible."

According to Google, these latest updates "should be considered basic email hygiene," Kumaran said. But for organizations that don't meet the new requirements and will need to improve their systems, Google has shared guidance on doing so.

The authentication requirement is targeted at addressing system misconfigurations commonly exploited by attackers. Validating that a sender is who they claim to be sounds basic, but "it's still sometimes impossible to verify who an email is from given the web of antiquated and inconsistent systems on the internet," Kumaran pointed out.

This rule builds upon Google's move last year to require that emails sent to a Gmail address have some form of authentication. That effort has decreased the number of unauthenticated messages Gmail users receive by 75%, according to the company. "That's great progress, but there's much more we need to do," Kumaran said.

To that point, bulk senders will need to "strongly authenticate" their email addresses using established best practices by February 2024.

Bulk senders will also need to provide a one-click unsubscription option for recipients and process unsubscribe requests within two days. "You shouldn't have to jump through hoops to stop receiving unwanted messages from a particular email sender," Kumaran said. This requirement is built on open standards so that once senders implement the required processes, "everyone who uses email benefits," he said.

Finally, bulk senders will be subject to a clear spam rate threshold meant to ensure Gmail users aren't bombarded by unwanted messages. Kumaran claimed this is "an industry first" and will lead to significant decreases in spam emails.