Who Will Win the SMTP Authentication Wars?

After reading all three, Im inclined to like Yahoos Domain Keys the best. It does have its downsides; its the most heavyweight for one, adding a fair processing load to outbound mail serving. And then theres the fact that not only has the spec not been made public, but there isnt even a Yahoo press release about it. Certainly its not clear that Domain Keys is a practical solution yet, but if it could be made to work it would be a leap straight into the next generation, without as many of the problems that IP-based solutions create, such as breaking mail forwarding. Domain Keys shouldnt interfere with mail forwarding, and in fact it supports multiple levels of signed messages, so that even if I remail spam to a third party and I authenticate as the sender, the recipient can confirm that the original sender was a spammer. Neat.

And the validity of the signatures and keys in the Domain Keys scheme should be almost beyond reproach. Its not going to be worth the work involved in brute-forcing your way around the cryptography, and even if the keys were compromised it would be a quick matter to regenerate new ones, leaving only the DNS TTL as a variable in recovery. Because DNS is used as the public key repository, theres no need for complicated and expensive certificate authorities. Anyone can generate their own keys using a variety of free tools.

The signature approach takes any uncertainty about the contents of headers out of consideration. Its irrelevant. The signature either matches the key for the appropriate domain or it doesnt. Theres less gray area for policy management than there is with Caller ID, which allows the administrator to handle mail with different degrees of validity in different ways. Domain Keys is black and white.

So it could be that some combination of SPF and one of the alternatives could be the ideal solution. It seems to me that if envelope processing could determine that a message was illegitimate SPF could dispose of it. The ones that validated through SPF could go on to a different type of testing through Caller ID or Domain Keys. This would save a lot of bandwidth by using SPF for pre-screening, and avoid all the extra processing of Caller ID and Domain Keys unless they were necessary. And in the end, the only mail to be subjected to actual spam filtering would likely be genuine. It could change the nature of filtering software a great deal when spam is a rare thing, but thats another column.

In the meantime, the disaster I feared, that of having three important authentication standards in operation, doesnt seem all that horrible anymore. My hope is that mail server vendors will offer support for all of the standards. Were entering a period of experimentation to find out what works best. But it is the case that everyone will have to support all the standards that are left standing when its all over. Otherwise, you wont be able to send mail to their users and receive mail from them. Kind of stupid, since there is a certain level of redundancy, but as long as nobodys a jerk about the intellectual property rights, theres no reason why all of them cant coexist.

If you asked me six months ago how I thought the spam and worm problems would work out, I would confess to being an avowed pessimist. Spam and worms were taking over; only a fundamental change in the structure of Internet e-mail could stop them, and we all knew that wouldnt happen. Good thing I was wrong; it looks like the only question is what changes will happen.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Be sure to check out eWEEK.coms Security Center at http://security.eweek.com for the latest security news, views and analysis.

Be sure to add Our eWEEK.com Security news feed to your RSS newsreader:
http://rssnewsapps.ziffdavis.com/eweeksecurity.xml

More from Larry Seltzer