Spam: Use Sender ID or we'll junk you, says Microsoft

Microsoft is to wage war on spam by pushing for all emails to have Sender ID or risk being identified as junk mail by Hotmail and MSN.

Around November, Hotmail and MSN will flag as potential spam those messages that do not have the tag to verify the sender, according to Craig Spiezle, a director in the technology care and safety group at the software maker. The move is meant to spur on the adoption of Sender ID, he said.

Sender ID is a specification for verifying the authenticity of email by ensuring the validity of the server from which the email came. While the purpose of curbing junk mail may be laudable, the debate on how to stop the tide of junk mail is still ongoing. According to Microsoft, up to 90 per cent of email is spam.

Critics say Sender ID, which includes technology developed by Microsoft, is not an accepted standard and has many shortcomings. Also, there are technologies that compete with Sender ID, such as Yahoo!'s DomainKeys.

Dave Rand, chief technologist for internet content security at security software company Trend Micro, said: "We think Microsoft is trying to strong-arm the industry into the adoption of an incomplete and not accepted standard."

Microsoft's move increases pressure on email senders to adopt Sender ID. The technology requires internet service providers, companies and other internet domain holders to publish so-called SPF, or Sender Policy Framework, records to identify their mail servers.

About one million domains currently publish SPF records, Microsoft said. That's far from the 71.4 million registered domains worldwide at the end of last year. Still, because some large email senders such as AOL support Sender ID, about 30 per cent of email today carries Sender ID information, according to email filtering company MessageLabs.

Sender ID has not been a success because it is not very highly regarded, said Ray Everett-Church, co-founder of the Coalition Against Unsolicited Commercial E-mail and co-author of the book Fighting Spam for Dummies.

"Microsoft has been trying to shove Sender ID down the throats of the internet community for several years now, to little effect," he said.

Microsoft's unilateral move may hurt internet users, he said. "Sender ID isn't widely deployed, meaning that average users are now at risk for having their legitimate email tagged as spam when they send messages to Hotmail users."

Experts say one of the problems with Sender ID is that it doesn't work with email forwarding services. The basic premise of Sender ID is to check if an email that claims to be coming from a certain internet domain is really being sent from the email servers associated with that domain.

Matt Sergeant, a senior anti-spam technologist at MessageLabs, said: "If you receive mail forwarded through, for example, a university alumni account, the Sender ID check fails."

The Internet Engineering Task Force, a standard-setting body, dissolved a working group on Sender ID in September. But Microsoft is plowing ahead with Sender ID, perhaps in a last-ditch effort to make good on a promise by chairman and chief software architect Bill Gates to can spam by 2006.

Microsoft's Spiezle said: "All domain holders and email senders should be publishing SPF records and planning to do that now if they want to improve the legitimacy of their mail, plus protect their domain and consumers. It is the responsible thing to do."

However, this Microsoft effort to push adoption of Sender ID is likely to fail, certainly with such a short deadline, said Jonathan Penn, an analyst at Forrester Research. "Hotmail is in no position to dictate that organisations adopt Sender ID," he said.

Adopting Sender ID or any other technology requires time and budgets, Penn said. "Company budgets are on a yearly cycle and most of them have no money for such a project this year," he said.

Joris Evers writes for CNET News.com