Common anti-spam standard ready soon

Industry likely to agree on IP-based sender authentication scheme

Dinah Greek, vnunet.com 25 Jun 2004

Agreement on a common standard for anti-spam technology using an IP-based sender authentication scheme could be reached within weeks.

Sender ID is a combination of Microsoft's Caller ID with a domain authentication scheme devised by Meng Wong, co-founder of email forwarding and hosting company Pobox.com.

The Anti-Spam Technical Alliance, which includes Microsoft, recently issued an interim report outlining its statement of intent on sender authentication.

Microsoft has also presented a formal specification of the Sender ID technology to be evaluated by the Internet Engineering Task Force standards body.

George Webb, anti-spam technology and strategy manager at Microsoft, told vnunet.com that IP-based authentication is the next logical stop in the fight against spam, and that he hoped the standard would soon be agreed and adopted.

"This is not the end [of spam], but it is the beginning of the end," he said, adding that the industry is finally working together to tackle the problem.

"There was a lot of independent thinking before but big progress has been made over the past year. Industry is coming together," he said.

PCs being hijacked to send spam without the knowledge of their users is on the increase, warned Webb.

"Increasingly we have the problem of zombie machines. I have seen numbers put as high as 65 per cent of spam that is coming from [these] PCs," he said.

While Sender ID tackles the problem of authenticating the sender, Webb insisted that there is a place for alternative technologies, such as Yahoo's Domain Key.

"We will need other solutions as well and it is critical that the industry works together and is proactive. There is no silver bullet," he warned.

"Sender ID is the only IP-based solution and can be deployed quickly. SendMail is already developing plug-ins for Sender ID, but it is not going to solve all the problems.

"Domain Key is a different approach and has a place. But signing technology is a fairly difficult infrastructure and will take longer to deploy."

See also: