Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Spammers embrace anti-spam technology

Sender ID and SPF don't mean the end of the problem.

Article comments

The anti-spam technology backed by Microsoft is not taking off and may not even be effective at its job, according to security company CipherTrust.

A check of approximately two million e-mail messages sent to CipherTrust customers between May and July showed that only about five percent of all incoming messages came from domains that published a valid sender authentication record using Sender Policy Framework (SPF) or Sender ID.

Within that five percent, however, more of it was actually spam than legitimate e-mail, said Paul Judge, chief technology officer at the Atlanta company.

Sender ID is a technology standard that closes loopholes in the current system for sending and receiving e-mail that allow senders - including spammers - to spoof a message's origin. Organisations publish a list of their approved e-mail servers in the DNS. That record, referred to as the sender policy framework (SPF) record, is then used to verify the sender of e-mail messages sent to other Internet domains using Sender ID.

Tens of thousands of Internet domains have published SPF records since the standard was introduced by Meng Weng Wong of In May, Microsoft and Meng reached an agreement to merge SPF with a Microsoft-developed standard called Caller ID to form the new Sender ID standard, which Microsoft submitted to the Internet Engineering Task Force in June for approval.

Sender ID is fast becoming the de facto e-mail authentication standard, as Microsoft rallies support from e-mail providers, Internet service providers and e-mail software vendors. But the result of the survey casts doubt on whether Sender ID or its predecessor, SPF, can put an end to spam, Judge said.

"The idea was that SPF would point to legitimate e-mail because spam would fail SPF checks is not true, because spammers have rolled out SPF records, too. In fact, three times more spam passes SPF checks than fails it, so passing or failing an SPF check is not a strong indicator that messages are spam," he said. The problem is that spammers have been faster to adopt the technology than legitimate e-mail senders, Judge said.

"Spammers are now better than companies at reporting the source of their e-mail," he said. In fact, of the messages that pass an SPF check, 34 percent more are spam than legitimate e-mail, according to the CipherTrust survey, Judge said.

However, Judge admits that the CipherTrust survey covers only the small sample of the billions of e-mail messages the company's customers process, and a tiny percentage of total e-mail traffic that comes from domains - spammer or legitimate - that publish SPF records.

"The vast majority of e-mail is from domains that don't have SPF deployed - around 95 percent of e-mail doesn't tell you anything. Of the three or five percent that does have SPF, the SPF address match doesn't tell you whether the e-mail is spam," he said. In fact, 2.8 percent of legitimate e-mail passes SPF checks, compared with just 3.8 percent of spam, CipherTrust's survey showed.

Adoption is a key problem. Only 31 Fortune 1000 companies are publishing SPF or Sender ID records, and only 6 percent of CipherTrust's customers publish SPF records, despite the fact that the company's products can check for and validate SPF records, he said. "SPF has not taken hold in the enterprise space."

But Wong, who co-authored both the SPF and Sender ID standards, said that stopping spam was never the intention of SPF or Sender ID. The technology is merely a way to stop one loophole spammers use: source address spoofing. Evidence that spammers are publishing SPF records is a good sign, Meng said. "Spammers are buying into a future that will wipe them out," he said.

In theory, when all spammers are forced to publish SPF records, along with all legitimate e-mail senders, it will be easy for legitimate companies to develop e-mail reputations for Internet domains that do and do not send spam, he said. "In the past, we assumed all e-mail was good and tried to filter out the bad stuff. In the future, we'll assume all e-mail is bad, and filter in the good stuff. It's a lot easier," he said.

Meng said that SPF was never intended as an anti-spam cure-all, likening the difference between SPF and anti-spam technology to the difference between flour and food. "There are about 12 things that we need to do to fix e-mail, and this is one of them," Meng said, paraphrasing comments by Nathaniel Borenstein of IBM, another antispam expert. "When we have all 12 in place, we'll start to win the war."

Meng agreed that getting companies to adopt the Sender ID standard was a challenge, but said that having Microsoft's backing would spur adoption. The software giant is hosting a summit at its headquarters this week to promote Sender ID and sender authentication.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *