Google and Yahoo are expanding their use of a successful system for identifying spam.
The move is part of years-long effort to implement a series of checks designed to figure out if an email really has been sent by the domain it purports to come from.
Email spoofing has long been a problem since its easy to forge the “from” address, making it more likely the receiver will believe it came from a legitimate source.
By Nov. 2, Yahoo plans to being using DMARC (Domain-based Message Authentication, Reporting & Conformance) for its ymail.com and rocketmail.com services. Next year, Google also plans to move Gmail to a strict DMARC policy, according to a news release.
DMARC allows email senders to tell receiving services if they are using two other technologies to weed out spam.
Many email senders use DKIM, or DomainKeys Identified Mail, which wraps a cryptographic signature around an email that verifies the domain name through which the message was sent.
The second technology, SPF, or Sender Policy Framework, allows email senders to indicate which hosts are authorized to send their email, allowing receiving organizations to discard messages coming from spoofed “from” addresses.
DMARC also allows for some flexibility for email senders, letting them to tell the recipient what to do if some messages aren’t authenticated. Recipients can also tell senders what they’ve done with the messages that didn’t pass muster.
The idea is to dramatically cut down on phishing emails, which seek to get people to click on malicious links or reveal personal information.
DMARC has wide industry support and is also used by Facebook and Microsoft.