Yahoo To Stop Email Spam Forever With DKIM
The Yahoo blog has listed out how they plan to stop spammers, spoofers, and phishers everywhere.
We’ve just reached an important milestone in our battle against email scammers. Today, the Internet Engineering Task Force (IETF) has approved DomainKeys Identified Mail (DKIM) as a proposed Internet standard — RFC 4871. That’s bad news for spammers, spoofers, and phishers everywhere.
DKIM is an email authentication framework that addresses the widespread
issue of email forgery, using cryptography to verify the domain of the
sender. It allows email providers to validate an email’s originating
domain, making use of blacklists and whitelists more effective. It also
makes phishing attacks easier to detect by helping to identify abusive
How DomainKeys Works
How it Works – Sending Servers
There are two steps to signing an email with DomainKeys:
- Set up: The domain owner (typically the team running the email systems within a company or service provider) generates a public/private key pair to use for signing all outgoing messages (multiple key pairs are allowed). The public key is published in DNS, and the private key is made available to their DomainKey-enabled outbound email servers. This is step “A” in the diagram to the right.
- Signing: When each email is sent by an authorized end-user within the domain, the DomainKey-enabled email system automatically uses the stored private key to generate a digital signature of the message. This signature is then pre-pended as a header to the email, and the email is sent on to the target recipient’s mail server. This is step “B” in the diagram to the right.
How it Works – Receiving Servers
There are three steps to verifying a signed email:
- Preparing: The DomainKeys-enabled receiving email system extracts the signature and claimed From: domain from the email headers and fetches the public key from DNS for the claimed From: domain. This is step “C” in the diagram to the right.
- Verifying: The public key from DNS is then used by the receiving mail system to verify that the signature was generated by the matching private key. This proves that the email was truly sent by, and with the permission of, the claimed sending From: domain and that its headers and content weren’t altered during transfer.
- Delivering: The receiving email system applies local policies based on the results of the signature test. If the domain is verified and other anti-spam tests don’t catch it, the email can be delivered to the user’s inbox. If the signature fails to verify, or there isn’t one, the email can be dropped, flagged, or quarantined. This is step “D” in the diagram on the right.
In general, Yahoo! expects that DomainKeys will be verified by the receiving email servers. However, end-user mail clients could also be modified to verify signatures and take action on the results.
For more technical Details Head over to the yahoo antispam page