SenderID is dead

A question came up on the email geeks slack channel (Join Here) about SenderID. They recently had a customer ask for SenderID authentication.

We’ve written about it a few times: (Hotmail moves to SPF Authentication and Until it stops moving) but we’ve not actually stated the reasons why in a post.

SenderID was basically SPF version 2. It tried to use the same mechanism as SPF to authenticate the visible from address. In some ways it was a predecessor to DMARC. It was an authentication method championed by Microsoft.

The really important thing to remember is that Hotmail was the only domain that really used SenderID. It was a check built into some versions of Exchange servers, too. But it was never really used outside of Microsoft.

In 2012, the IETF published an informational RFC that looked at deployment of SPF and Sender ID. The author looked at a number of different things and concluded there wasn’t much use of Sender ID.

The absence of significant adoption of the [SUBMITTER] extension, SENDER-ID], and [PRA], indicates that there is not a strong community deploying and using these protocols.

Six months after that RFC was published, Microsoft announced they were moving away from Sender ID. Given they were the only major implementation, this was the signal that it was a dead authentication method.

There is no reason to publish Sender ID records. It’s dead.