We’ve warned previously that (as part of their new sender requirements) at some point Yahoo was planning to reject unauthenticated mail. It looks like the time is now.
When trying to send mail to Yahoo subscribers, are you receiving a rejection that looks like this?
550 5.7.9 This mail has been blocked because the sender is unauthenticated. Yahoo requires all senders to authenticate with either SPF or DKIM.Yahoo hosts mail for multiple domains (and has merged with or taken over handling of mail from various other mailbox providers), so this can happen when sending not just to yahoo.com subscribers, but also aol.com, verizon.net, ymail.com and rocketmail.com, aim.com and other AOL and Yahoo domains around the world.
What Does It Mean When You’re Receiving This Error Message?
Yahoo is telling you that because your email message(s) are failing email authentication checks, they’re not willing to allow this email into their mail servers, and they’re not able to deliver the email to the intended recipients.
Specifically, the email messages in question are lacking Sender Policy Framework (SPF) email authentication, DomainKeys Identified Mail (DKIM) authentication, and it’s very likely that your sending domain is also lacking a Domain-based Message Authentication, Reporting & Conformance (DMARC) record in the Domain Name System (DNS).
Because of their recent guidelines, Yahoo now requires all senders to authenticate with either SPF or DKIM.
Why Is Yahoo Doing This?
Back in October 2023, Yahoo and Google announced a new set of email sender requirements. We’ve covered that in more detail here, but the summary is that Yahoo and Google are looking to limit the number of bad and unwanted email messages coming into their systems, improving user experience by reducing the amount of spam-related annoyance felt by Yahoo and Gmail users.
Good email senders are being asked to fully implement email authentication to help make it easier for Yahoo and Google to identify them as good senders. They’ve also got additional requirements (including making it easy to unsubscribe and keeping spam complaints low), but the core of the issue here is very specific to email authentication – making it clear that the email domain supposedly sending the email message in question truly is the responsible party for this email message.
What Do I Need to Do to Fix This?
Yahoo is being very clear that a lack of SPF and DKIM authentication is the problem. This fix for you will be to enable that email authentication and how to do that is going to vary based on what email platform or email hosting you’re using to attempt to send the email messages that are being rejected.
Keep in mind that their intent here is not to needlessly inconvenience everyone who sends email messages. Indeed, you’re not even their main target. The goal is to make it easier for them to block the really bad stuff—phishing, malware, and spam—and by authenticating your own email messages, you’re helping them better sort out which email messages are good and wanted and which ones are not.
I’m Using Microsoft O365 or Google Workspace: Isn’t This Set up Already?
Microsoft and Google have default domains that they’ll use to apply DKIM email authentication (onmicrosoft.com and gappssmtp.com, respectively) for users who have newly set up their corporate or business email hosting using their services. However, those default domain settings aren’t enough to pass the new authentication checks included in the new Yahoo and Google requirements.
Both Google and Microsoft offer guidance on how to configure DKIM; I suggest reviewing these and ensuring that you follow all of their recommendations to implement email authentication, both DKIM and SPF.
Other email hosting platforms will have similar guides covering similar steps to enable email authentication. If you’re receiving that Yahoo rejection message, it’s likely that those steps were missed during initial setup. You’ll want to circle back around to review them and identify what might have been skipped initially.
Don’t Forget DMARC
DKIM and SPF are just the starting point; Yahoo and Google also require that you implement DMARC, and we’d love to guide you through how best to implement and monitor DMARC.
Want to learn how our DMARC experts can help you meet these Google and Yahoo sender requirements to avoid blocked mail?
Al Iverson is Valimail’s Industry Research and Community Engagement Lead, bringing over 25 years of experience in email marketing, technology, and deliverability. He’s committed to helping people learn more about DMARC and adopt it beyond just the minimum requirements while also helping good people send email and get their mail delivered.