Messaging Pipeline | E-mail Sender Authentication Technologies
Free Newsletter GlossaryContact UsAbout Us
One To One Collaboration Servers & Security Business

March 06, 2006

Three Ways To Authenticate E-Mail And Stop Spam

Courtesy of

Page 1 of 2

As long as there's an Internet and people who see it as an opportunity to make money--or mischief--there will be spam. The main challenge for businesses is finding the best way to control the unrelenting onslaught of unwanted E-mails.

The most widely used method of blocking insidious E-mail is spam-filtering software, yet none of the filters works with 100% accuracy. But by combining E-mail sender-authentication technologies with filtering software, businesses stand a better chance of stopping spam.

There's a variety of approaches to sender authentication, but the leading ones are Sender Policy Framework, Sender ID, and Domain Keys Identified Mail. Each one requires a willing community to make it work, and the Internet Engineering Task Force, an international standards organization, also is reviewing each of them.

A spam filter is no match for these unwanted messages.

Check Out The Sender
Spammers usually want to disguise their identities and do that by using fake "from" addresses, or routing their messages not from their own machines but through unsuspecting servers or PCs hooked to the public Internet, or they combine the two methods.

Sender Policy Framework records are specially crafted Domain Name System text records that work by letting your E-mail servers share information with other E-mail servers on the Internet. SPF records are being published by E-mail providers including America Online, Hotmail, and RoadRunner, as well as large companies such as Bank of America, eBay, and Ticketmaster.

When an E-mail message comes in, SPF validates that the envelope sender, the "from" address in the Simple Mail Transfer Protocol, is indeed allowed to distribute E-mail from the sending server. AOL's outbound mail servers, for example, should never be sending messages with Hotmail envelope sender addresses. On the receiving end, an SPF-enabled E-mail server looks up the SPF record for Hotmail and determines that the sending AOL server isn't allowed to send E-mail on its behalf. The SPF record also contains a confidence-level assessment that helps the receiving E-mail system determine authenticity. With this information, the receiving E-mail system can take appropriate action.

Many E-mail security, anti-spam, and message transfer agent applications support SPF, but some tweaks are required to get SPF working. Twenty-five percent to 30% of all E-mail domains publish SPF records, according to Forrester Research, making it the most widely adopted sender-authentication technique.

The approach does have its limitations. The biggest is that SPF doesn't stop enough phishing E-mail because it's checking the envelope return address and not the "from" address that users see in their E-mail clients. This is by design; spammers could bypass SPF with phishing attacks using the correct envelope return address and outbound E-mail servers but trick users with fake content and "from" addresses seen in their mail clients.

E-mail This Story
Print This Story

Page 2: next page

Page 1 | 2

Get the latest Messaging news, product info, and trends every week.

Related Content

  Right-click and choose Copy to extract RSS Feed URL  Messaging Pipeline's Main RSS Feed
  Right-click and choose Copy to extract RSS Feed URL  Messaging Pipeline's Blog RSS Feed

Editorial and vendor perspectives

Editor's Picks
The Six Flavors Of Windows Vista
Microsoft plans to release a full six-pack of Vista versions, one for every taste. Which Vista will be right for you?

Hope is Not Enough When It Comes To Compliance

Three Ways To Authenticate E-Mail And Stop Spam

Wikis In The Workplace

Review: Google Desktop 3

Vendors are now talking about how collaboration can be improved by integrating video with messaging applications. They're even talking about adding live TV to mobile phones. How far do you go before it becomes a bandwidth and business productivity drain?
Video is a great idea
Video is fine but there needs to be size limits
It's never used for anything really productive
I draw the line at live TV

In search of messaging products? Check out our brand new Product Finder for a directory of groupware and collaboration tools, security products, archiving solutions, and more.


Digital Warehouse buys, sells, & rents used Cisco networking hardware such as routers & switches, as well as Juniper, Extreme & Foundry at 50-80% off list price. One year warrantee and fast delivery.

Roaring Penguin's CanIt-PRO anti-spam solution offers customizable spam and virus control for enterprises, campuses and ISPs. Designed for the mail server, CanIt-PRO lets you stop spam on YOUR terms. Click for free price quote for your organization.

Use your Intranet to manage Software Licenses, plan for Windows XP/2000 upgrades, do Security Audits and more. Click to try and ask for our white paper - PC Management for the Internet Age.

Analysts at the Tolly Group put a leading Branch Office IT services solution to the test, measuring performance, security and data reliability. Download the results, detailed in this free report, now.

Whether you need temporary or permanent access to remote PCs, LogMeIn has your solution: LogMeIn IT Reach for automatic maintenance of remote and mobile systems, and LogMeIn Rescue for instant, web-based remote access without pre-installing software.

Sponsored Links:      
 |   |   |   |   |   | 
 |   |   |   | 
 |   |   |   |   | 
Messaging Pipeline  |   |   |   | 
 |   |   |   |   | 
© 2006 | MESSAGING PIPELINE All rights reserved. | |