Monthly source review

Rules watch: Google, Yahoo, and PCI DSS

31 October 2026

A maintained index of the sender rules that change what “good email authentication” means in practice. We review these sources monthly and update the linked guides only when a material rule or interpretation changes.

Google sender rules

Current focus: SPF and DKIM alignment for the From domain, a published DMARC policy, and bulk-sender unsubscribe and spam-rate expectations. The practical path starts with a monitor-only DMARC record and aggregate reports before enforcement.

Google Workspace: Email sender guidelines · Transition from p=none · Check DMARC

Yahoo sender rules

Current focus: authentication and alignment of the visible From domain, especially for high-volume senders. Keep SPF valid, sign with DKIM, and do not treat a pass on an unrelated domain as aligned authentication.

Yahoo sender best practices · Google and Yahoo checklist · Check SPF

PCI DSS and email anti-phishing

Current focus: PCI DSS 4.0 Requirement 5.4.1 and the evidence a payment organization can attach to its anti-phishing narrative. Domain authentication supports the control, but it does not replace phishing-resistant processes, monitoring, or user reporting.

PCI Security Standards document library · PCI DSS 4.0 email guide

Review log

31 October 2026: baseline review of Google, Yahoo, and PCI DSS sources; page created.

This page summarizes sources for operators. It is not legal advice or a substitute for the current official standard. Verify the linked source before making a compliance claim.