Spammers using sender authentication too, study says

New technology for identifying the sender of e-mail messages has not been widely adopted despite backing from software giant Microsoft Corp. and may not be effective at stopping unsolicited commercial e-mail, otherwise known as spam, according to a survey by e-mail security company CipherTrust Inc.

A check of approximately two million e-mail messages sent to CipherTrust customers between May and July showed that only about 5 percent of all incoming messages came from domains that published a valid sender authentication record using Sender Policy Framework (SPF) or a newer standard, backed by Microsoft, called Sender ID. Within that 5 percent, slightly more is spam than legitimate e-mail, said Paul Judge, chief technology officer at the Atlanta company.

Sender ID is a technology standard that closes loopholes in the current system for sending and receiving e-mail that allow senders -- including spammers -- to fake, or "spoof," a message's origin. Organizations publish a list of their approved e-mail servers in the DNS (domain name system). That record, referred to as the sender policy framework (SPF) record, is then used to verify the sender of e-mail messages sent to other Internet domains using Sender ID.

Tens of thousands of Internet domains have published SPF records since the standard was introduced by Meng Weng Wong of Pobox.com. In May, Microsoft and Meng reached an agreement to merge SPF with a Microsoft-developed standard called Caller ID to form the new Sender ID standard, which Microsoft submitted to the Internet Engineering Task Force in June for approval.

Sender ID is fast becoming the de facto e-mail authentication standard, as Microsoft rallies support from e-mail providers, Internet service providers and e-mail software vendors.

The result of the survey casts doubt on whether Sender ID or its predecessor, SPF, can put an end to spam, Judge said.

"The idea was that SPF would point to legitimate e-mail because spam would fail SPF checks is not true, because spammers have rolled out (SPF) records, too. In fact, three times more spam passes SPF checks that fails it, so passing or failing an SPF check is not a strong indicator that messages are spam," he said.

The problem is that spammers have been faster to adopt the technology than legitimate e-mail senders, Judge said.

"Spammers are now better than companies at reporting the source of their e-mail," he said. In fact, of the messages that pass an SPF check, 34 percent more are spam than legitimate e-mail, according to the CipherTrust survey, Judge said.

However, Judge admits that the CipherTrust survey covers only the small sample of the billions of e-mail messages the company's customers process, and a tiny percentage of total e-mail traffic that comes from domains -- spammer or legitimate -- that publish SPF records.

"The vast majority of e-mail is from domains that don't have SPF deployed -- around 95 percent of e-mail doesn't tell you anything. Of the 3 or 5 percent that does have SPF, the SPF address match doesn't tell you whether the e-mail is spam," he said.

In fact, 2.8 percent of legitimate e-mail passes SPF checks, compared with just 3.8 percent of spam, CipherTrust's survey showed.