Lably
Skip to content

Email authentication

Techniques aimed at providing verifiable information about the origin of email messages

  • 10 min read
  • 5 chapters

Related on Lably

Through Simple Mail Transfer Protocol, Phishing and Email spam

Lab · Class 6–12AI & Python Builds (Medha AI)Lab · Class 10–11NLP Pipelines

The original base of Internet email, Simple Mail Transfer Protocol (SMTP), has no such feature, so forged sender addresses in emails (a practice known as email spoofing) have been widely used in phishing, email spam, and various types of frauds. To combat this, many competing email authentication proposals have been developed. By 2018 three had been widely adopted – SPF, DKIM and DMARC. The results of such validation can be used in automated email filtering, or can assist recipients when selecting an appropriate action.

This article does not cover user authentication of email submission and retrieval.

Rationale

In the early 1980s, when Simple Mail Transfer Protocol (SMTP) was designed, it provided for no real verification of sending user or system. This was not a problem while email systems were run by trusted corporations and universities, but since the commercialization of the Internet in the early 1990s, spam, phishing, and other crimes have been found to increasingly involve email.

Email authentication is a necessary first step towards identifying the origin of messages, and thereby making policies and laws more enforceable.

Hinging on domain ownership is a stance that emerged in the early 2000. It implies a coarse-grained authentication, given that domains appear on the right part of email addresses, after the at sign. Fine-grained authentication, at a user level, can be achieved by other means, such as Pretty Good Privacy and S/MIME. At present, each individual must ultimately manage their own digital identity.

An outstanding rationale for email authentication is the ability to automate email filtering at receiving servers. That way, spoofed messages can be rejected before they arrive to a user's inbox. While protocols strive to devise ways to reliably block distrusted mail, security indicators can tag unauthenticated messages that still reach the inbox. A 2018 study shows that security indicators can lower the click-through ratio by more than ten points: 48.9% to 37.2% of the users who open spoofed messages.

Sign in to keep reading

4 more chapters are free with a Lably account.

More in Computing and communication

ISBNUnique numeric book identifier since 1970X (social network)American social networking serviceWayback MachineDigital archive by the Internet ArchivePython (programming language)General-purpose programming languageMacOSOperating system for Apple computersUnicodeCharacter encoding standard