MailVice Spam-Free Email

Sender Authentication: The Final Frontier

This sender filtering would have worked well if we had been able to see that emails coming from spammers with our addresses as the SENDERS were fake.  (This "spoofing", as it's called, is most dangerous when used for phishing, an identity theft method.)  Of course, we were unknowingly stepping into the same pit that AOL, Yahoo, PO Box, and Microsoft had uncovered:  sender authentication.  With many choices of emerging technology like DNA, SPF, Sender ID, and Domain Keys, we enthusiastically set out to choose one.  To our complete dismay, all of these new proposed technologies had the same problems:  No one but spammers would participate.

Determined to solve this problem, we formed another research team and set out to find a way to get the job done.  A web interface was developed by another team in the meantime for our corporate domain's users knowing that it could never be an effective solution if we couldn't solve the sender authentication problem.  The interface was very much geared towards the engineers that wanted to use it and fairly effective even without the sender authentication.

The authentication team worked for months observing the real email traffic of our customers to gather statistical data about the way mail systems had been structured on the Internet.  The puzzle boiled down to the fact that "The Rules" for email systems were very loose and there was a wide range of implementations.  In short, sending servers only occasionally had any identifiable relationship to the sender's email address.  The statistics were used to extract the common elements of the ways that system administrators had interpreted The Rules.  The final product was a practical rule set that described how every email domain on the planet worked and what methods were necessary to research the associations between the email sender and the server that was delivering mail on their behalf.