E-mail authentication standards aimed at reducing e-mail spam have been dogged by rivalry between vendors. But fresh hope surrounds an encryption technique that is an open technology and has considerable support.
Yahoo and Cisco Systems are the lead vendors behind a new e-mail authentication specification that will be considered as a possible industry standard by the Internet Engineering Task Force at the end of the month.
Called Domain Keys Identified E-mail (DKIM), it represents a blending of earlier attempts by both companies to tackle spam and its most virulent form, phishing, which commonly uses spam messages to redirect online banking users to fake sites.
DKIM effectively merges Yahoo’s DomainKeys system — submitted to the taskforce in March last year — and Cisco’s Identified Mail system. DomainKeys had made the most headway with widespread testing and adoption. Yahoo says it receives 350-million e-mails signed with it every day.
DKIM essentially puts electronic signatures on outgoing e-mail. It uses cryptographic keys to give each e-mail a unique signature that enables its source to be identified. Each e-mail domain owner holds a public and a private encryption key. The public key is held on record and the private key is stored on any DKIM-enabled mail server.
When an e-mail is sent the signature is added to the e-mail header. On arrival at its destination another DKIM-enabled server reads the signature and verifies the source from the domain system.
The end result could be that only those e-mails with a verified source appear in your inbox. The rest would be held in quarantine.
Yahoo and Cisco believe DKIM could cut out spoofing, whereby spammers use the header information to make it look like the e-mail has come from your bank or other confidential source. The list of supporting firms includes Sendmail, SPG, Alt-N Technologies, AOL, Earthlink, IBM, Microsoft, and Verisign.
Eric Allman, chief technology officer and co-founder of Sendmail, said: ”It’s not an exaggeration to claim that the email industry would eventually collapse without an initiative like DKIM. The aim is that DKIM can become a public standard that is open and has the support of key players. The key is breaking down the barriers.”
Most industry watchers believe the specification has momentum so long as it remains open. In a recent security update, Graham Titterton, an Ovum analyst, said: ”Cisco and Yahoo have prepared the ground well and obtained the backing of several major players in the industry, so their chances are good. But they must ensure they make the standard ”open” and do not succumb to the temptation to make cash out of the desperation of email users.”
And if DKIM gathers momentum, the emphasis may shift from earlier approaches, most notably Microsoft’s Sender ID, which is making its way through the standards process. This system uses what is known as Sender Policy Framework (SPF) record from each server — in essence a list that matches mail servers with a unique IP address. Instead of using signatures it examines the domain from which the message originated and checks if it has come from an authorised server.
Sender ID was knocked back at the end of last year after Microsoft refused to allow it to be used in open source applications. The company has also angered some in the industry when it was reported that in November its Hotmail service would delete messages without a valid SenderID record. It retaliated by saying that SenderID records will weigh more heavily as a means of filtering, but a mix of filters would still be used.
Supporting vendors say the two can work side by side. The first commercial product to use DKIM is Alt-N Technologies email server software MDaemon 8.10, due for release on Tuesday. Arvel Hathcock, founder and chief executive of Alt-N Technologies, said: ”MDaemon already includes full support for SPF and DomainKeys. DKIM adds the latest in cryptographic authentication.”
Others are waiting to see how things develop. David Vella, product manager of anti-spam specialists GFI Software, said: ”Using DKIM requires upgrading your mail software on incoming and outgoing mail servers, and may require purchasing a new server.
”We don’t have plans to support DKIM because drafts have yet to be released. So we will wait to decide if our anti-spam product, MailEssentials, will support it.”
He remains sanguine about the biggest challenge to beating spam: ”Good technical guidelines do not mean the problem will be solved since the weakest link is always the individual running the system.” – Guardian Unlimited Â