© 2007 Convio, Inc.

Implementation of Sender IDBill Pease, Chief ScientistConvio

2© 2007 Convio, Inc.

What is Sender ID?

■ An email authentication standard developed and promoted by Microsoft

■ Used to verify the identity of email senders so that Microsoft can:▶ Provide subscribers at its ISPs (Hotmail and MSN)

with a “safer” inbox by separating email authorized by a brand from phishing attacks spoofing a brand

▶ Provide users of its email client (Outlook) with information about the “trustworthiness” of senders

■ For more information▶ http://en.wikipedia.org/wiki/SenderID▶ http://www.microsoft.com/mscorp/safety/

technologies/senderid/default.mspx

3© 2007 Convio, Inc.

What is the relationship between Sender ID and Sender Policy Framework (SPF)?■ Sender ID and Sender Policy

Framework (SPF) are two related methods of email authentication that enable organizations to specify which mail servers are authorized to send email in their name.

■ Sender ID is based on and very similar technically to SPF: ▶ Both systems use TXT records

published by the DNS servers of a domain name

▶ Both enable email publishers to declare which mail IPs are authorized to send mail in a domain’s name

■ Sender ID checks can be performed using SPF records

■ The methods differ in which “From” address they verify

■ SPF verifies the domain of the envelope sender (i.e., the domain in the Return-Path header of an email message) ▶ This allows systems to conserve

resources by verifying senders during the first step of the SMTP process, rather than wait on the full transfer of an email message

■ Sender ID verifies the “from” address displayed to the recipient by their email client▶ This allows system to verify the

“from” address visible to end users

■ Sender ID determines the “Purported Responsible Address” by evaluating four mail header fields...▶ From ▶ Sender ▶ Resent-From ▶ Resent-Sender .

4© 2007 Convio, Inc.

Why Implement Sender ID?

■ Microsoft integrates sender verification into the spam filtering systems in use at Hotmail and MSN:▶ Higher probability of delivery to inbox, rather than

diversion to bulk mail folder▶ Participation in the third-party whitelist used at

Hotmail and MSN (Sender Score Certified, operated by Return Path) requires compliance with Sender ID

■ Microsoft mail clients encourage users to distrust email from senders that cannot be verified by Sender ID

5© 2007 Convio, Inc.

What does Sender ID implementation involve?

■ Simple addition of a TXT record to the DNS zone for each domain your organization uses to send email from Convio▶ Identify list of “From” email addresses used in Convio▶ Add TXT record to each domain and sub-domain’s DNS

authorizing Convio to send email▶ See instructions at http://customer.convio.com/site/PageServer?

pagename=SenderID

■ IF your DNS hosting provider does not support TXT records:▶ Switch to a provider that does support established internet

standards for sender verification dyndns.com UltraDNS.com

▶ DNS hosting is a separable commodity service – your organization does not need to switch its website host, email host, etc.

6© 2007 Convio, Inc.

What happens if an organization does not support Sender ID?

■ Your organization will fail Sender ID verification at Hotmail and MSN and in some Outlook versions

■ Microsoft will flag your email as potentially untrustworthy ▶ See screenshots on following pages

7© 2007 Convio, Inc.

Trust demotion if your mail fails Sender ID

8© 2007 Convio, Inc.

Microsoft’s explanation of what happens to messages that fail Sender ID

"If the Sender ID verification passes, the message is delivered as regular mail. If the check fails, the message is further analyzed and the receiving server may refuse to deliver the e-mail, or it may flag the e-mail as a possible deceptive message. Depending on the recipient's ISP or e-mail server software, messages that fail the Sender ID check may be flagged and sorted differently. For example, a simple icon may be displayed in the message to indicate the failure. Or the message may be sent to the junk mail folder for the recipient's review, or it may be automatically rejected and deleted."