As the makers of beta format videotapes well know, standards are everything. And in the increasingly difficult battle against spammers, it's become an all-out standards war. Security experts and email companies are proposing several different email address verification standards. There's Sender Policy Framework (SPF), "an SMTP extension that rejects messages whose senders' "From" field domain names don't match a list of authorized IP addresses for that domain." Then there is Sender ID Framework (SIDF), which combines SPF with Microsoft's former Caller ID for E-mail proposal. The problem: to work, everyone has to register with the public SPF database. Only a handful of banks and other phish-worthy companies have registered.
And then there's Yahoo!'s DomainKey. It uses public key encryption technology - something that's been largely rejected as a solution - and Yahoo! won't give up the fight to squash SPF and SIDF in favor of DomainKey.
Clearly, there won't be a good solution unless everyone can agree on one - and use it. Will we be destined for many more years of "Whac-a-Mole" or will a VHS-style winner emerge?
1. SPF nor Sender ID require a registration in a public database. And Yahoo's Domain Keys has not been rejected. In fact, it is being combined with Cisco's IIM and will likely be a work item of the IETF by this summer.
Posted at 4:51AM on Dec 19th 2005 by grumpy