Spammers use sender authentication too, study says

They've adopted the technology faster than legitimate e-mail senders

New technology for identifying the sender of e-mail messages hasn't been widely adopted, despite backing from software giant Microsoft Corp., and it may not be effective at stopping spam, according to a survey by e-mail security company CipherTrust Inc.

A check of approximately 2 million e-mail messages sent to CipherTrust customers between May and July showed that only about 5% of all incoming messages came from domains that published a valid sender authentication record using the Sender Policy Framework (SPF) or a newer standard backed by Microsoft called Sender ID. Within that 5%, slightly more is spam than is legitimate e-mail, said Paul Judge, chief technology officer at the Alpharetta, Ga.-based company.

Sender ID is a technology standard intended to close loopholes in the current system for sending and receiving e-mail that allow senders -- including spammers -- to fake, or "spoof," a message's origin. Organizations publish a list of their approved e-mail servers in the Domain Name System. That record, referred to as the SPF record, is then used to verify the sender of e-mail messages sent to other Internet domains using Sender ID.

Tens of thousands of Internet domains have published SPF records since the standard was introduced by Meng Weng Wong, chief technology officer at Pobox.com. In May, Microsoft and Meng reached an agreement to merge SPF with a Microsoft-developed standard called Caller ID to form the new Sender ID standard, which Microsoft submitted to the Internet Engineering Task Force in June for approval.

Sender ID is fast becoming the de facto e-mail authentication standard, as Microsoft rallies support from e-mail providers, Internet service providers and e-mail software vendors. But the survey casts doubt on whether Sender ID or its predecessor, SPF, can put an end to spam, Judge said.

"The idea that SPF would point to legitimate e-mail because spam would fail SPF checks is not true, because spammers have rolled out [SPF] records, too," he said. "In fact, three times more spam passes SPF checks [than] fails it, so passing or failing an SPF check is not a strong indicator that messages are spam."

The problem is that spammers have been faster to adopt the technology than legitimate e-mail senders, Judge said. "Spammers are now better than companies at reporting the source of their e-mail," he said. In fact, of the messages that pass an SPF check, 34% more are spam than legitimate e-mail, according to the CipherTrust survey.

Judge acknowledged that the CipherTrust survey covers only a small sample of the billions of e-mail messages the company's customers process and that it's a tiny percentage of total e-mail traffic that comes from domains -- spammer or legitimate -- that publish SPF records.

"The vast majority of e-mail is from domains that don't have SPF deployed -- around 95% of e-mail doesn't tell you anything. Of the 3% or 5% that does have SPF, the SPF address match doesn't tell you whether the e-mail is spam," he said.

In fact, 2.8% of legitimate e-mail passes SPF checks, compared with just 3.8% of spam, CipherTrust's survey showed.

Adoption is a key problem. Only 31 of the Fortune 1,000 companies publish SPF or Sender ID records, and only 6% of CipherTrust's customers publish SPF records, despite the fact that the company's products can check for and validate SPF records, Judge said. "SPF has not taken hold in the enterprise space," he said.

But Wong, who co-authored both the SPF and Sender ID standards, said that stopping spam was never the intention of SPF or Sender ID. The technology is merely a way to close one loophole spammers use: source-address spoofing. Evidence that spammers are publishing SPF records is a good sign, Meng said. "Spammers are buying into a future that will wipe them out," he said.

In theory, when all spammers are forced to publish SPF records, along with all legitimate e-mail senders, it will be easy for legitimate companies to develop e-mail reputations for Internet domains that do and don't send spam, he said.

"In the past, we assumed all e-mail was good and tried to filter out the bad stuff. In the future, we'll assume all e-mail is bad, and filter in the good stuff. It's a lot easier," he said.

"There are about 12 things that we need to do to fix e-mail, and this is one of them," Meng said, paraphrasing comments by Nathaniel Borenstein, an antispam expert at IBM. "When we have all 12 in place, we'll start to win the war."

Meng agreed that getting companies to adopt the Sender ID standard is a challenge, but he said that having Microsoft's backing would spur adoption.

The software company is hosting a summit in Redmond, Wash., this week to promote Sender ID and sender authentication, he said.

Copyright © 2004 IDG Communications, Inc.

8 simple ways to clean data with Excel
  
Shop Tech Products at Amazon