Spammers using sender authentication too, study says

Adoption is a key problem. Only 31 Fortune 1000 companies publishing SPF or Sender ID records, and only 6 percent of CipherTrust's customers publish SPF records, despite the fact that the company's products can check for and validate SPF records, he said.

"SPF has not taken hold in the enterprise space," he said.

But Wong, who co-authored both the SPF and Sender ID standards, said that stopping spam was never the intention of SPF or Sender ID. The technology is merely a way to stop one loophole spammers use: source address spoofing. Evidence that spammers are publishing SPF records is a good sign, Meng said.

"Spammers are buying into a future that will wipe them out," he said.

In theory, when all spammers are forced to publish SPF records, along with all legitimate e-mail senders, it will be easy for legitimate companies to develop e-mail reputations for Internet domains that do and do not send spam, he said. .

"In the past, we assumed all e-mail was good and tried to filter out the bad stuff. In the future, we'll assume all e-mail is bad, and filter in the good stuff. It's a lot easier," he said.

Meng said that SPF was never intended as an antispam cure-all, likening the difference between SPF and antispam technology to the difference between "flour and food."

"There are about 12 things that we need to do to fix e-mail, and this is one of them," Meng said, paraphrasing comments by Nathaniel Borenstein of IBM Corp., another antispam expert. "When we have all 12 in place, we'll start to win the war."

Meng agreed that getting companies to adopt the Sender ID standard was a challenge, but said that having Microsoft's backing would spur adoption.

The software company is hosting a summit in Redmond, Washington, the location of its headquarters, this week to promote Sender ID and sender authentication, he said.