Domain Assurance by Return Path

As often happens during MAAWG, email companies are announcing new products. One of the interesting ones is the new Domain Assurance product from Return Path.

Domain Assurance […] first audit[s] a company’s email streams to be sure authentication has been properly implemented. Then, the company’s domains are added to a registry. Participating ISPs can check the registry and block any unauthenticated emails coming from the domains found there. Return Path provides on-going checks for authentication accuracy and alerts participating companies any time their brand is phished or spoofed.

While this type of authentication won’t solve phishing, it is a tool to help protect end users from malicious mail.

Related Posts

With great wisdom…

Guest Post by JD Falk
There was certainly some surprise in the room when I pointed out (yep, it was me) that Laura has been around since before there were ESPs. Part of it, I’m sure, was because Laura’s not particularly ancient — and part was because it’s a shock to realize that people sent and received email and everything was just fine long before the segment of the industry that you work in had even been imagined.
Since this was at MAAWG, there were quite a few people in the room who were involved before there were ESPs (I asked for a show of hands) — and it was interesting to see how many of them work for ESPs now. Commenting on Laura’s article “A very young industry,” Kent McGovern mentioned three — including Anne Mitchell, who made up the word “deliverability” not long after stepping down as the head lawyer for the first shared blacklist of email-sending IP addresses.
Just think about that. She was the head lawyer for the MAPS RBL before there was such a thing as deliverability. (I worked with her there; so did Laura.)
There are a lot of us who’ve been around that long, and most don’t work in the deliverability/marketing side of the industry. Nearly all of us have become cynical over the years; some were cynical to begin with. A few, sadly, have burned out entirely from the frustration of having the same arguments, same discussions, over and over and over.
I think some of the recent refrain calling for ESPs to pressure each other into better practices comes in part from that same frustration. Yes, bad practices are bad, but we’re also tired with teaching the same thing to people with the same title, and feeling like the message never gets through. Part of what we’re saying is “It’s your industry, you’ve learned this stuff, now you teach ’em.”
And when you do, it does work — far more often than when we say it, because you speak the same language. There’s now a generation (for lack of a better term) of ESP & deliverability staff who weren’t around before there were ESPs, maybe not even before CAN-SPAM, but have learned many of the same things and undergone similar transformation. Who’d have thought that Jaren Angerbauer — quite possibly the nicest guy in the industry — would ever start sighing at those young whippersnappers like a cynical old anti-spammer? And Jaren’s not only teaching deliverabilitators; he’s also teaching college students, ensuring that they’ll know far more when they enter the work force than you or he did.
We old-timers once struggled with the idea that we must reach out — even to people we disagree with — and teach what we knew, learning along the way to put it into terms that marketers understand. It’s so much simpler to add to a blacklist and throw away they key, declaring “not my problem anymore.” But we did start teaching, and look how far we’ve come; we’re still doing it, and look how much further there is to go.
Now it’s time for the next generation to do the same. Stop looking to us, or to the ISPs, to solve the problems of your industry for you; we’re busy dealing with spam, as we should’ve been doing all along. Your colleagues’ cluelessness is exactly as impermanent as your own was, and can be overcome in the same ways. Whether you have fifteen or ten or five or merely two years of experience, you’ve found your way to this blog and read down to this line, and attained some measure of wisdom, and you can ease the passage for others.
When someone at a marketing conference says something that you know isn’t true, that you know will result in poor deliverability and industry ire, call them on it. Engage them in a dialogue. Teach, explain, cajole, push — because with great wisdom comes great responsibility.
It’s your turn.
J.D. Falk is Director of Product Strategy for Receiver Products at Return Path, which is not an ESP.

Read More

Delivery resources

I’m working on a few projects designed to help provide mentoring for other delivery people and to bridge the communication gap between the various groups active in email. One of those projects is collecting, linking to, and publishing more delivery resources. Some will be linked to directly from the blog, others will be linked to from the wiki. While I’m reasonably familiar with what’s out there, it is impossible for me to know about all the useful resources available. So I ask you readers:

Read More

Who can you trust?

I’ve been recently dealing with a client who is looking at implementing authentication on their domains. He’s done a lot of background research into the schemes and has a relatively firm grasp on the issue. At this point we’re working out what policies he wants to set and how to correctly implement those policies.
His questions were well informed for the most part. A few of them were completely out of left field, so I asked him for some of his references. One of those references was the EEC Email Authentication Whitepaper.
My client was doing the best he could to inform himself and relies on industry groups like the EEC to provide him with accurate information. In this case, their information was incomplete and incorrect.
We all have our perspectives and biases (yes, even me!) but there are objective facts that can be independently verified. For instance, the EEC Authentication whitepaper claimed that Yahoo requires DKIM signing for access to their whitelist program. This is incorrect, a sender does not have to sign with DKIM in order to apply for the Yahoo whitelist program. A bulk sender does have to sign with DKIM for a Y! FBL, but ISPs are given access to an IP based FBL by Yahoo. I am shocked that none of the experts that contributed to the document caught that error.
Independent verification is one reason I publish the Delivery Wiki. It’s a resource for everyone and a way to share my knowledge and thought processes. But other experts can “check my work” as it were and provide corrections if my information is outdated or faulty. All too often, senders end up blaming delivery problems on evil spirits, or using “dear” in the subject line or using too much pink in the design.
Delivery isn’t that esoteric or difficult if you have a clear understanding of the policy and technical decisions at a range of ESPs and ISPs, the history and reasoning behind those decisions, and enough experience to predict the implications when they collide.
Many senders do face delivery challenges and there is considerable demand for delivery experts to provide delivery facts. That niche has been filled by a mix of people, of all levels of experience, expertise and technical knowledge, leading to the difficult task of working out which of those “experts” are experts, and which of those “facts” are facts.

Read More