New technology identifying the senders of e-mail
messages has not been widely adopted despite backing from
Microsoft, and may not be effective at stopping spam, according to
a survey by e-mail security company CipherTrust.
A check of around two million e-mail messages sent to
CipherTrust customers between May and July showed only about 5% of
all incoming messages came from domains that published a valid
sender authentication record using Sender Policy Framework (SPF) or
a newer standard - backed by Microsoft - called Sender ID. Within
that 5%, slightly more is spam than legitimate e-mail, said Paul
Judge, chief technology officer at the company.
Sender ID is a technology standard that closes loopholes in the
current system for sending and receiving e-mail that allow senders
- including spammers - to fake, or "spoof," a message's origin.
Organisations publish a list of their approved e-mail servers in
the DNS.
That record, referred to as the sender policy framework (SPF)
record, is then used to verify the sender of e-mail messages sent
to other internet domains using Sender ID.
Tens of thousands of internet domains have published SPF records
since the standard was introduced by Meng Weng Wong of
Pobox.com.
In May, Microsoft and Meng reached an agreement to merge SPF
with a Microsoft-developed standard called Caller ID to form the
new Sender ID standard, which Microsoft submitted to the Internet
Engineering Task Force in June for approval.
Sender ID is fast becoming the de facto e-mail authentication
standard, as Microsoft rallies support from e-mail providers,
internet service providers and e-mail software suppliers.
The result of the survey casts doubt on whether Sender ID or its
predecessor, SPF, can put an end to spam, Judge said.
"The idea that SPF would point to legitimate e-mail because spam
would fail SPF checks is not true, because spammers have rolled out
(SPF) records, too. In fact, three times more spam passes SPF
checks than fails it, so passing or failing an SPF check is not a
strong indicator that messages are spam," he said.
The problem is that spammers have been faster to adopt the
technology than legitimate e-mail senders, Judge said.
"Spammers are now better than companies at reporting the source
of their e-mail," he said.
In fact, of the messages that pass an SPF check, 34% more are
spam than legitimate e-mail, according to the CipherTrust survey,
Judge said.
However, Judge admits that the survey covers only the small
sample of the billions of e-mail messages the company's customers
process, and a tiny percentage of total e-mail traffic that comes
from domains - spammer or legitimate - that publish SPF
records.
"The vast majority of e-mail is from domains that don't have SPF
deployed - around 95% of e-mail doesn't tell you anything. Of the 3
or 5% that does have SPF, the SPF address match doesn't tell you
whether the e-mail is spam," he said.
In fact, 2.8% of legitimate e-mail passes SPF checks, compared
with just 3.8% of spam, CipherTrust's survey showed.
Adoption is a key problem. Only 31 Fortune 1000 companies
publishing SPF or Sender ID records, and only 6% of CipherTrust's
customers publish SPF records, despite the fact that the company's
products can check for and validate SPF records, he said.
But Wong, who co-authored both the SPF and Sender ID standards,
said that stopping spam was never the intention of SPF or Sender
ID. The technology is merely a way to stop one loophole spammers
use: source address spoofing. Evidence that spammers are publishing
SPF records is a good sign, Meng said. Spammers are buying into a
future that will wipe them out," he said.
Meng agreed that getting companies to adopt the Sender ID
standard was a challenge, but said that having Microsoft's backing
would spur adoption.
Paul Roberts writes for IDG News
Service