Powerful new antiphishing weapon DKIM emerges

Spoofers, spammers and phishers, beware.

There's a new gun in town, and some of the Internet's most powerful companies -- including Yahoo, Google, PayPal and AOL -- are brandishing it in the ongoing battle against e-mail fraud.

Deploy DKIM in three simple steps.
Read how Microsoft and Yahoo’s e-mail security technologies stack up.

The new weapon is called DKIM, an emerging e-mail authentication standard developed by the Internet Engineering Task Force. DKIM, which stands for DomainKeys Identified Mail, allows an organization to cryptographically sign outgoing e-mail to verify that it sent the message.

DKIM addresses one of the Internet's biggest threats: e-mail fraud. As much as 80% of e-mail from leading brands, banks and ISPs is spoofed, according to a report released in late January by the Authentication and Online Trust Alliance (AOTA). AOTA analyzed more than 100 million e-mails from Fortune 500 brands sent over a five-month period.

"It's a critical need that IT professionals look at e-mail authentication as a competitive advantage to protect their brands and their customers from these exploits as well as to protect their employees from spoofed or forged e-mail coming into their networks," says Craig Spiezle, chairman of AOTA.

DKIM proponents say the standard is an important step in rebuilding consumer confidence in e-mail. (Compare Messaging Security products.) 

"DKIM increases the trust with which people can regard their e-mail," says Jim Fenton, a distinguished engineer with Cisco and one of the authors of the standard. "DKIM isn't going to put an end to phishing, but I'm confident that DKIM is going to make it harder for phishing attacks to occur."

Under development since 2004, DKIM is finally reaching a critical mass. It's expected to be widely deployed this year, particularly in financial services and e-commerce firms. Early adopters include Bank of America, American Greetings and Cisco.

"My guess is that probably half of the Fortune 1000 will be DKIM signing in 2008," predicts Greg Olson, director of product management at Sendmail, which started shipping a DKIM-compliant e-mail appliance in November.