The author of the Sender Policy Framework (SPF) specification has announced a proposal to converge the specification with aspects of Microsoft Corp.’s Caller-ID spec. Microsoft is expected to follow up with its own announcement soon.
SPF and Caller-ID are two of the more prominent efforts to introduce authentication to the SMTP protocol, filling in holes exploited by spammers to avoid detection. The two approaches have different benefits and limitations.
Meng Weng Wong, author of the SPF specification, explains the high points of the convergence plan on his Web site. SPF focuses on the SMTP “envelope,” the portion of an e-mail message that precedes all the headers and contents, while Caller-ID focuses on the headers.
SPF can reject messages in which the sender specified in the envelope doesn’t match a list of mail servers authorized by the sending domain. Caller-ID also checks a list of authorized servers, but based on the mail headers. Each approach stops different types of mail problems, and SPF also has the advantage of being able to reject a message without having to accept the contents from the sending server.
The “new SPF” as Wong calls it would add a new “RFROM” parameter to the SMTP SEND command specifying the “purported responsible sender,” which specifies an e-mail address responsible for the transmission of the message. Mail headers contain many addresses, and the responsible one can differ depending on a number of common circumstances, such as messages forwarded from another address and messages sent by a mailing list server.
The existence of the RFROM parameter would allow new SPF servers to confirm that the address seen by the user as the sender of the message is not spoofed. The old SPF lacks this basic defense against “phishing” attacks.
How this convergence will be received by MARID, the IETF standards body currently working on an authorization standard, is unclear, as are possibilities for incorporating aspects of other proposals, such as Yahoo’s Domain Keys.
Check out eWEEK.com’s Security Center at http://security.eweek.com for the latest security news, reviews and analysis.
Be sure to add our eWEEK.com developer and Web services news feed to your RSS newsreader or My Yahoo page