New email authentication framework called DMARC, backed by major email and security tool providers, aims to make spoofed domains in messages a thing of the past.
Leading free email providers AOL, Google, Microsoft, and Yahoo have banded together with financial, social media, and message security companies to make it easier to verify the authenticity of email messages.
Together, the companies on Monday announced the formation of
DMARC.org, an organization that aspires to make email more trustworthy and phishing more difficult. DMARC.org will promote the DMARC specification, which describes how email senders should authenticate messages, how they should communicate their authentication practices, and how message recipients can discover and implement sender policies.
The acronym stands for domain-based message authentication, reporting, and conformance. Think of it as a set of rules that can make email more secure.
"It's a specification that the DMARC.org group has worked on over the last 18 months to produce," said Google product manager Adam Dawes in a phone interview. "It's a proposed mechanism by which senders and receivers can work together to fight phishing, and to lock down and prevent abuse of domains in the email channel."
Malicious email senders can easily make their messages appear to come from someone else's Internet domain, and such messages often are used for phishing--attempts to dupe message recipients into providing sensitive information under false pretenses or through malware.
According to the Anti-Phishing Working Group, there are presently about 20,000 to 25,000 unique phishing campaigns every month, each targeting hundreds of thousands to millions of email users. And thousands of fake phishing websites are set up every day.
Those involved in DMARC have a stake in making email a better experience. Dawes said that being duped by a phishing message often leads to compromises at multiple online services, because people tend to
use the same password across different websites. Losing control of one's account, he said, "is one of the worst experiences that a user can have. If that happens because someone received a phishing message in his or her Gmail inbox, that's a terrible Google experience. Users rely on us to protect them against those threats."
COMUNICACIÓN
