Messaging News: The Urgent Need to Implement Authenticated Email
Tags :Security
This was in the January/February 2006 issue
which you can get in PDF
here. I thought this would
be a rather large article to read, not the total of one page that it filled
around a half page shadow picture and an ad for a conference (wow I just
noticed it was the same conference the author is charman of). The following
was an excerpt from the article by Craig Spiezle. Now Craig did nothing
but put out the numbers and stats in my reading of it. I should note
that his title is Director, Microsoft Technology Care and Safety
and also the Chair of the emailauthentication.org
board.
What's New in Email
Authentication?
Over the past 18 months, authenticated
mail has evolved significantly from concept to implementation, with two
complementary approaches: the Sender ID Framework (SIDF) and DomainKeys
Identified Mail (DKIM). SIDF is an Internet Protocol (IP)-based solution
that was developed from the merger of the Sender Policy Framework (SPF)
and Microsoft Caller ID for Email. DKIM is the merger of Yahoo! DomainKeys
and Cisco's Identified Internet Mail (IIM) specifications.
There is more rant to read on this below
... a search on Google for SIDF turned up some fun.
I have talked in my session on my thoughts
on Microsoft's implementation, which is reverse DNS with a marketing name
on it. If everyone appropriately managed their DNS and reverse entries,
we could turn on the ability to verify senders host and block much unwanted
mail. The issue is that by turning that on, you block most all mail.
DomainKeys on the other hand has some wider
adoption and implementations. You can go and read for days how these
work, or better yet, I might just do some postings myself. Chris
Linfoot does and awesome job
on covering many aspects of this already, I bow in honor.
SIDF on Google turned up a few things but
what we want. Apparently the following were better hits, LOL. Everything
from documentary festivals, to dairy farmers.
I think that both of these are viable and
possible solutions, but have yet to see anyone using them in full swing
outside of the testing that is publicly announced from some large ISPs
(hint AOL and of course Hotmail). Who has the desire to jump into
something very new and not fully understand the implications of what happens
to mail that cannot be verified. If you are still letting it in because
you don't want to miss any mail, then why are you turning it on in the
first place?
blog comments powered by Disqus
On Monday, February 27th, 2006 by Chris Miller
