Yahoo Working on Anti-Spam Technology October 4, 2007
The BBC reports that Yahoo is working on a new email technology to battle spoofed email message called DomainKeys. The technology could help fight email fraud tactics where fraudsters send email that pretends to be official email from an online bank or auction website. eBay's auction website and payment system PayPal have been plagued by these phising tactics.
The firms are supporting the emerging standard known as domain keys, which block fake e-mails by validating the sender with a digital signature.
Spammers hide their identity by using a false, or spoofed, address in the millions of messages they send out.
The technology, called the DomainKeys Identified Mail (DKIM), will be available to millions of Yahoo Mail users worldwide in the coming weeks.
It is a big step forward for consumers in defence against the bad guys," John Kremer, vice president of Yahoo Mail, told Reuters news agency.
DomainKeys relies on the use of encrypted digital signatures to prove that an email come from the domain it claims to come from. Both the sender and the recipient need the DomainKeys Identified Mail (DKIM) specification for the technology to work effectively. A faq on Yahoo's DomainKeys website explains how this technology could help stop spam.
Several ways. First, it can allow receiving companies to drop or quarantine unsigned email that comes from domains that are known to always sign their emails with DomainKeys, thus impacting spam and phishing attacks. Second, the ability to verify sender domain will allow email service providers to begin to build reputation databases that can be shared with the community and also applied to spam policy. For example, one ISP could share their "spam vs. legit email ratio" for the domain www.example.com with other ISPs that may not yet have built up information about the credibility and "spamminess" of email coming from www.example.com. Last, by eliminating forged From: addresses, we can bring server-level traceability back to email (not user-level - we believe that should be a policy of the provider and the choice of the user). Spammers don't want to be traced, so they will be forced to only spam companies that aren't using verification solutions.
The BBC article says Yahoo developed the technology and they are backed by AOL, Google, IBM, Sendmail and Verisign. More information about DKIY can be found here. The BBC also says there is another email technology called Sender Policy Network (SPF) that is backed by Microsoft, Amazon and eBay.
