[Asrg] DNS-based Email Sender Authentication Mechanisms: a Critical Review

[Amir Herzberg <[e-mail]>]

Hi guys, I wrote a `critical review' of SPF, DKIM and Sender-ID Framework
(SIDF); it's in process of publication at `computer & security`, you can see
it at http://dx.doi.org/10.1016/j.cose.2009.05.002 (pending editing, final
changes etc.). Nothing much new, just an attempt to provide a
fair-yet-critical survey, hopefully to help clarify this important subject.
Comments will be most welcome. Abstract below.

Amir Herzberg

Title: DNS-based Email Sender Authentication Mechanisms: a Critical Review

Abstract

We describe and compare three predominant email sender authentication
mechanisms based on DNS: SPF, DKIM and Sender-ID Framework (SIDF). These
mechanisms are designed mainly to assist in filtering of undesirable email
messages, in particular spam and phishing emails.We clarify the limitations
of these mechanisms, identify risks, and make recommendations. In
particular, we discuss potential abuse of these mechanisms to facilitate DNS
poisoning, and suggest countermeasures.

-- 
Amir Herzberg
Associate Professor, Dept. of Computer Science
Bar Ilan University
http://AmirHerzberg.com