SMTP Authentication Hits Standards Track

By Larry Seltzer  |  Posted 2004-05-03 Print this article Print

An IETF working group has taken up SPF advocates' challenge to define a formal standard, and it's moving at the standards-equivalent speed of greased lightning. I've always said we should hurry up and do this, but who knows what we'll end up with.

SMTP authentication is coming. But in what form? There is a broad consensus among experts that SMTP authentication, by which Internet mail servers will be able to confirm that messages sent to them come from the domains from which they purport to come, will help to fight spam.
Nobody thinks its the cure for spam, although many (myself included) think its a substantial and necessary ingredient in drastically setting back the infection of spam on the e-mail system.

Several major initiatives have been announced over the past year or so, the big three being the Sender Policy Framework (SPF, formerly "Sender Permitted From:"), Yahoo Inc.s Domain Keys and Microsoft Corp.s Caller ID for E-mail.

At a regular IETF meeting in Seoul, South Korea, in February, a formal IETF working group was created at the urging of SPF advocates. The group, called MTA Authorization Records in DNS (MARID), has a charter that is interesting and, for the most part, admirable. The group will focus (as the group name might imply) only on MTA authorization, and only on DNS-based mechanisms. It maintains a fairly rigid and aggressive schedule for making certain key decisions.

The group is an outgrowth of the Anti-Spam Research Group (ASRG), a part of the Internet Research Task Force (IRTF). The ASRG has produced a digital mountain of discussion but not a whole lot of consensus on actual solutions, and theres way too much topical variety and digression on the groups mailing list. All of this is perhaps why some folks went to the IETF asking to be saved from themselves and to have a standard put on the "railroad" track.

For insights on security coverage around the Web, check out Security Center Editor Larry Seltzers Weblog. The group really began talking about things just about a month ago. According to the charter, there are major decision-making milestones in May and June and a working-group document submission in August. If the process only amounted to rubber-stamping the SPF specification, the schedule would be a breeze to meet, but as I have said, there are three major proposals with big differences among them. Theres no question that someones interests arent going to be met.

A bit of technical background is necessary here: RFC2821 is the specification of the SMTP protocol, including some addresses used in what is called the "envelope" of a message for saying where the message is going. RFC2822 is the standard for the format of the message transmitted by SMTP; this includes all of the message headers and defines what the user sees as the "From:" and other key addresses. SMTP authentication proposals generally focus on one or the other of these.

The chairmen of the working group, Andrew Newton and Marshall T. Rose, announced April 29 that the group would focus on RFC2821 identities, meaning envelope identities—basically meaning SPF. As they say, there is a strong consensus that further checking based on RFC2822 (message header) identities should be done, but basically this will be put off so the group can meet its aggressive deadlines, unusual deadlines for the IETF.

Next Page: Chairmen say framework must support RFC2822 mechanisms.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel