Yahoo! tackles spam with DomainKeys

By Steve Malone

Posted on 16 Nov 2004 at 09:45

After a year or so of debate Yahoo! has finally decided to tackling the problems of spam and phishing by pressing ahead with the DomainKeys on its Yahoo! Mail.

The DomainKeys technology developed by Yahoo! on the principle of encryption of authentication between mail servers. Owners of mail servers transmit 'public' and 'private' key that identifies them. The public key is registered at the DNS level whilst the private key is held on the mail server itself. When the company wishes to send out email it adds the private key to the header. The receiving email server then checks that the private header on the incoming email matches the 'public' key. If they match, then the email is judged to come from the authentic source. If not, it will be assumed to be spoofed.

The scheme works entirely transparently and users should notice no difference in their email service - except perhaps for a reduction in spoofed spam and phishing emails.

To make sure that the scheme becomes a standard across the Internet, Yahoo! is offering royalty free licences to anyone wanting to adopt it for their own servers. Similarly, anyone who wishes to declare their email service DomainKey enabled can say so.

However, DomainKeys is not the only technology designed to tackle the problem of spoofed mail. Microsoft has spent much of the year pushing its rival Sender ID technology that requires sites to register with a central service before they can send out bulk emails. However, despite some early success with larger companies such as AOL, Sender ID has been treated with suspicion by many in the open source community who have raised concerns over the licence terms offered by Microsoft.