Chris-Linfoot.net

A tool that could help in the battle against spam (1) and phishing attacks has received industry approval.

The DomainKeys Identified Mail (DKIM) system is a method of validating the identity of the sender of an e-mail (1).

I've said it before, but it evidently bears repeating - sender authentication is not an anti-spam technology. OK, it might help against phishing, but only if those entities who are regular phishing targets actually adopt some form of sender authentication and very few have (2).

Here's the problem.

We all remember what happened when we finally got a ratified standard for electronic document formats - ODF. Microsoft ignored it and created OpenXML. I expect you see where I am going with this.

There is not one, but there are in fact two sender authentication technologies from which you can choose, SPF (aka Sender ID) and DKIM. The latter of these is the one that has just been accepted as a draft standard by the IETF. The former is the one to which Microsoft has very prominently given its backing.

So the fact that the IETF has accepted DKIM as a draft standard has little real world significance.

The other obvious problem is that, while the main beneficiaries of any sender authentication scheme are the senders themselves, the parties actually doing the authentication are the recipients. With some senders using no sender authentication and others choosing one or the other (2) in order for either of these two standards (3) to have any value at all, it will be necessary for receiving systems to understand both.

At the ND8 public beta forum a couple of weeks ago, someone asked IBM for "SPF-SenderID-DomainKey" capabilities and elicited this less than reassuring response:

We have considered DKIM support for a future release but...

Many customers do not run Domino as your edge mail SMTP server? Most customers I've talked to use another mail gateway for external delivery of email so the DKIM/Sender ID support would be on that server.

Please respond here if you do use Domino as your gateway SMTP server.

Dear readers, you will be aware that I am very interested in the use of Domino as a border MTA myself, though for somewhat different reasons.

Please help me by completing the poll that is currently live at the top, left of chris-linfoot.net and tell me what your border MTA is.

And if it is Domino, please post a response in that thread over at the ND8 public beta forum and say so too. I think IBM needs to know.

1. Again with the lazy journalism and non-sequiturs! Oy!
   
2. eBay is a notable exception to this rule - its outbound emails include a DKIM signature and it publishes an SPF record in DNS too.
3. The two standards are the de facto (SPF) and the de jure (DKIM).

Category: Fixing SMTP
Technorati: SPF DKIM Sender+ID

Unable to post a comment? Please read this for a possible explanation...