Industry group makes fresh push to eliminate phishing

Companies hope use of a new protocol, DMARC, will make users less likely to receive fraudulent messages

Companies such as Facebook, Google and PayPal are pushing for widespread use of a new technical specification, DMARC, that could make it harder for phishers to reach their victims.

A common problem with e-mail is that it is very easy to spoof the "from" address, making it difficult for an average user to know if an email is really from the domain it purports to be from. Technologies such as DKIM and SPF already allow domain owners to vouch for mail sent in their name, but don't specify what to do with messages that fail the test. DMARC builds on those systems, allowing domain owners to ask receiving mail servers to discard mail that fails authentication tests. That will make it less likely that scam messages impersonating sites such as PayPal will appear in your inbox.

There is a huge financial incentive for criminals to compromise user accounts on social internet and e-commerce sites in order to steal passwords and bank account or credit card details, according to the DMARC group. To do that, spammers and phishers often exploit trust in well-known brands by sending email purporting to be from such sites.

The specification for DMARC (Domain-based Message Authentication, Reporting & Conformance) allows organizations sending email to indicate whether they are using one or both of two security technologies to authenticate the sender of email messages, and includes a reporting mechanism where email senders can get feedback on how their messages are being handled. With that information, once domain owners have fine-tuned the mail-sending process, they can tell receivers to outright reject messages purporting to be from the domain that don't pass muster.

One of the authentication technologies is DKIM (DomainKeys Identified Mail), which verifies the domain name through which a message was sent by analyzing the message's cryptographic signature. Recipients can choose to put more trust in messages coming from a domain that is considered reputable.

The other is SPF (Sender Policy Framework), which allows domain owners to specify which hosts are allowed to send e-mail for their domains. With SPF, if a scammer forges the "from " address, a bogus e-mail can be identified by checking the SPF record.

DKIM and SPF have been used by a number of companies for several years. But there are several problems that DMARC aims to fix. It has been hard for email receivers to always authenticate messages sent with SPF or DKIM due to the use of third-party service providers, according to DMARC.org.

Also, if a domain sends a mix of messages -- some authenticated, some not -- it's hard for receivers to distinguish legitimate messages that haven't been authenticated from fraudulent ones.

The DMARC group plans to submit a draft of the specification to the Internet Engineering Task Force in the hope that it will eventually become an industry standard.

Google is hoping the industry's latest push for DMARC will maintain momentum for antipsam efforts. So far, participating companies include Bank of America, Fidelity, Microsoft, Yahoo, PayPal, LinkedIn, AOL, American Greetings, Cloudmark and Agari.

"Industry groups come and go, and it's not always easy to tell at the beginning which ones are actually going to generate good solutions," wrote Adam Dawes, a Google product manager. "When the right contributors come together to solve real problems, though, real things happen."

Send news tips and comments to jeremy_kirk@idg.com

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?