Bill Gates Outlines Technology Vision to Help Stop Spam

3. Recipient e-mail systems query the DNS for the list of outbound e-mail server IP addresses of the purported responsible domain. They then check whether the IP address from which the message was received is on that list. If no match is found, the message has most likely been spoofed.

Microsoft is moving ahead with plans for a pilot implementation of Caller ID for E-Mail in its Hotmail(R) service. Hotmail will begin publishing outbound IP addresses today and will begin checking inbound addresses early this summer. In addition, the company continues to work with others in the industry to test this proposal, including Amazon.com Inc., Brightmail Inc. and Sendmail Inc.

"Amazon.com is working aggressively to combat spoofing on several fronts, and we are committed to collaborating with others in the industry to find effective solutions for the problem of spam," said Larry Hughes Jr., senior manager for IT Security at Amazon.com. "We look forward to working with Microsoft and others in the industry to test their proposals."

"Most spammers disguise the source of their e-mail to evade spam filters and detection," said Enrique Salem, CEO and president of Brightmail, a leading provider of anti-spam technology. "We are excited to join Microsoft in testing this new Caller ID for E-Mail technology to help promote the establishment of verifiable identity in e-mail. We believe that by combining verifiable identity with our Reputation Service, we will improve our best-of-breed anti- spam technology to help legitimate e-mail get delivered while helping keep spam out of users' inboxes."

"Authenticated sender technologies like Microsoft's caller ID are essential to help address fraud and spam in Internet e-mail," said Eric Allman, CTO at Sendmail. "The key to ensuring that these types of technologies are successful is widespread adoption. Sendmail's millions of users -- including more than 70 percent of the Fortune 1000 -- substantially increase the deployment of such technologies. We are excited to work with Microsoft in promoting the acceptance of caller ID as an open standard on the Internet."

Best Practices for Legitimate High-Volume Senders

Not all commercial e-mail is junk. Many regulated businesses including banks, brokerage firms and insurance companies rely on e-mail to contact their customers and provide information about their services. Other organizations such as airlines, news media and a variety of online retail services send legitimate e-mail to their customers. However, today there is no easy way for these businesses to distinguish themselves from spammers.

As outlined in its CSRI proposal, Microsoft supports the development of reasonable behavior policies for sending commercial e-mail, similar to the policies of behavior that organizations such as TRUSTe and others have helped establish in the area of electronic privacy. Microsoft believes that once agreed-upon policies have been developed, independent e-mail trust authorities (IETAs) should be established to certify and monitor high-volume e-mail senders for compliance with such policies.

...continued