The big problem with email is a total lack of accountability. Nothing in the specification for standard SMTP email traffic requires accurate identification of the sender. Spammers can use bots to spew unwanted bulk mail with a false sender address. Email viruses can spoof the sender address to avoid detection. Phishing sites appear and disappear quickly, with no audit trail leading back to the sender of phishing messages. The DMARC (Domain-based Message Authentication, Reporting & Conformance) specification aims to restore accountability to email and thus cut through the spam and fraud. And yet… we've heard this tale before.
Sender Policy Framework
SPF (Sender Policy Framework) lets the owner of a domain specify which servers can legitimately send mail from that domain. Receivers supporting SPF can simply reject any messages from unauthorized servers. An SPF-protected domain should be less attractive to spammers, since their messages can be easily and automatically blocked. For SPF to succeed, senders must implement its policy and receivers must reject unauthorized mail. SPF is roughly five years old.
DomainKeys Identified Mail
DKIM (DomainKeys Identified Mail) is
a mashup of two earlier proposals, DomainKeys and Identified Internet Mail. It uses a digital signature to verify that an email message really did come from the domain stated in the sender address. The recipient validates the message using the signer's public key. The DomainKeys proposal is almost eight years old; the merged DKIM about five years old.
Where's the Relief?
These proposed solutions have been around for a number of years, but spam and phishing activities are still going strong. Perhaps DMARC can succeed where previous efforts have not? As the image below shows, quite a few major players have signed on (click for a larger view).
Here's the catch. DMARC isn't a new standard for sender verification. Rather, it "standardizes how email receivers perform email authentication using the well-known SPF and DKIM mechanisms." It's possible that all SPF and DKIM needed for spam-killing success was wider adoption. If that's the case, DMARC could save the day. Certainly adding sender verification to all AOL, Gmail, Hotmail, and Yahoo! mail couldn't hurt.
You can view the full specification and learn more at DMARC.org. And if you find the level of spam and phishing emails in your Inbox dropping precipitously, you'll know who to thank.
Source:
SecurityWatch
securitywatch.pcmag.com
Image:
Fotos Digitales Gratis - Free digital photos
www.fotosdigitalesgratis.com
All logos, product and service names mentioned are the trademarks of their respective companies.
Antivirus Free Online
Technology Security Internet Information
www.antivirusfreeonline.net
