Dear CAUCE Team,
We are looking for support resources to thwart a massive spam/forgery attack that misuses our company name -- claiming we are the spam source. The spam contains url links to numerous computers that apparently download viruses. We are looking for assistance and guidance in dealing with this. Any suggestions?
Regards,
Forged
Dear Forged,
We have a lot of sympathy for your predicament. Internet e-mail has no built-in security, and there is little one can do to prevent bad guys from putting fake names on their junk. We have seen a large number of spam with faked return addresses from your competitors as well as from your brand. There are several things we can recomend to potentially help with your email program, and protect users from receiving email with your forged from addresses (note: this will not completely remove this threat, but can help protect your users/brand):
- Only send email from well branded mail servers (i.e. MTA1.outbound.yourdomain.com) and not generic mail.myisp.com. This will help ISPs distinguish between your mail and a fake mail server.
- Implement, or fix, one or more of these popular authentication solutions; SPF, Sender ID, DKIM, and BATV.
- Send email from your own domain, do not use the senders email address - authentication solutions will generally cause these messages to fail.
- Let your users know of these changes and your policies regarding the structure of your emails
- Provide instructions on your web pages with information similar to this:
- "We only send email with fully qualified domain names (http://www.yourcomapny.com) and never with an IP address in the URLs (http://1.2.3.4) - if you receive and email with IPs in the body - DO NOT CLICK THESE LINK WITH IP ADDRESSES."
- "We in no way endorse the sending of spam and have taken the following actions to protect our users: SPF,Sender ID, etc...)
Do you have a question you would like answered? Email them to comments.
