p2pnet.net News:- Sender-ID is supposed to make life difficult for spammers by revealing who they are.

“The idea of authenticating email senders has been under discussion for several years, but it has only recently got close to becoming a standard,” says Bill Thompson. “The current version combines two approaches to the problem, one called Sender Policy Framework and the other called Caller ID for Email.

“The fuss is about Caller ID, which was contributed to the standard by Microsoft. The company has said that anyone who wants to use Sender-ID must take out a license to use it, because it incorporates Microsoft’s intellectual property.

In other words, Microsoft is being Microsoft.

Greedy.

But spammers, the very people Sender ID is designed to thwart, might be more than willing to shell out for a license.

MX Logic, an email security company, has found junk emailers are trying to make their messages appear ‘real’ by adopting Sender Policy Framework (SPF), meant to help stop spam.

“In its preliminary study, MX Logic found that some spammers have embraced SPF in the hope that their unsolicited email messages will be viewed as more legitimate because the messages have an SPF email authentication record associated with them,” says MX here, going on:

“In a sample of more than 400,000 unique spam email messages that passed through the MX Logic Threat Center from Aug. 29 through Sept. 3, 16 percent had published SPF records.

“SPF helps prevent domain ’spoofing’ in email and makes it easier to identify fraudulent email scams and ‘phishing’ attacks by authenticating the origin of an email. Email domain owners identify their ‘legitimate’ sending mail servers by publishing an SPF record in the domain name system (DNS). This enables email servers to validate the source of incoming email against the associated SPF record to determine if the email sender’s domain is legitimate and not ’spoofed’.”

For authentication to be effective against spam, the industry will need to come to agreement not only on the authentication standard to be used – such as SPF or Sender ID – but also on accreditation and reputation services that can vouch for the domain’s SPF record as well as email sending history, says Scott Chasin, CTO, MX Logic.

This would allow a clearinghouse of information on good email senders to be developed, “rather than relying on techniques to identify bad email senders,” he say.

A “guilty until proven innocent approach” to email filtering would help minimize the need for email content inspection and create a “first class” category of legitimate email which could, “flow through email filters without interruption”.

MX Logic says it’s monitored compliance with the US CAN-SPAM Act since it went into effect on at the beginning of this year.

“Since then, monthly compliance has ranged from a high of 3 percent from January through April to July’s low of 0.54 percent,” says the company. “While CAN-SPAM compliance increased to 2 percent during August, the amount of spam also increased. Of all email traffic through the MX Logic Threat Center during the month, 92 percent was spam – up from 84 percent in July.”

But, “I wouldn’t read too much into last month’s increase in CAN-SPAM compliance,” says Chasin. “Compliance with the law has always been negligible and the August data doesn’t refute this trend. Two percent compliance is a minor uptick – not a meaningful surge.”

This entry was posted on Friday, September 10th, 2004 at 2:43 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

HOME

Viewed 1571 times