Kirill Popov

AOL - "We're using Sender-ID, no we aren't, yes we are." This month we lay out an ISP scorecard on who is using or plans to use and check for the various authentication protocols.

First, a quick update on the three most promising protocols:

SPF

SPF, now known as SPF Classic, remains in use by early adopters and developers within the email industry while Sender-ID goes through the vetting process. AOL still publishes its SPF record in the classic format, rather than the new and improved Sender-ID. An SPF check has also been implemented in the current (3.0x) version of the popular open-source spam filter, SpamAssassin.

Sender-ID

Microsoft hit a snag with Sender-ID, which I detailed in my last article, but has regrouped and addressed the concerns about the proposal’s compatibility and patent issues. The new and improved Sender-ID proposal is fully backwards compatible with SPF Classic, allowing great flexibility about the type of verification that the user of Sender-ID can perform. These changes, amongst the re-wording of Microsoft’s patent applications, got AOL back on board to resume testing of long-term Sender-ID adoption. AOL announced that they will begin testing incoming email with Sender-ID, and may publish the results of their testing "to the internet community at large, at the appropriate time".

Domain Keys

Yahoo’s Domain Keys proposal remains in the experimental stages. The process involves creating a cryptographic key unique to the message it is attached to, to assert authenticity of the message. Because of this more involved process, there has been relatively little mainstream movement towards adoption. One noteworthy news item is that Gmail’s outgoing emails are now sent with an attached cryptographic key, in the Domain Keys format. While Google will not comment on how this plays into their email filtering systems, it’s safe to say that Google is evaluating the various authentication systems to keep Gmail on the cutting edge.

As you can see by the adoption rate of these protocols, there is still uncertainty as to which format will be the format to follow. With Sender-ID now having the support of Microsoft and AOL, it’s poised to take the lead