Microsoft opens up anti-spam standard

By Tom Sanders

Oct 26 2006 9:55AM

Openness promise courts open source developers.

Microsoft has released its Sender ID Framework specification under the company's Open Specification Promise.

This allows software developers and service providers to use the technology without having to pay a licence fee to Microsoft.

In the past Sender ID has drawn fire from open source developers because the previous Microsoft licence didn't allow the technology to be deployed in combination with open source software.

"There have been lingering questions from some members of the development community about the licensing terms from Microsoft and how those terms may affect their ability to implement Sender ID," said Brian Arbogast, corporate vice president of the Windows Live Platform Development Group.

"By putting Sender ID under the Open Specification Promise, our goal is to put those questions to rest and advance interoperable efforts for online safety worldwide."

In an effort to weed out forged or spoofed sender addresses, Sender ID checks whether an email's sender matches the corresponding Internet protocol (IP) address. While it's easy to spoof an email address, it is very hard to spoof an IP address.

Spammers and senders of phising emails often use a forged 'From' address to hide their identity and sneak past spam filters. Microsoft's Hotmail, for instance, is hosted on a set number of servers with fixed IP addresses. Email that claims to be sent from a Hotmail address but doesn't originate from one of its servers can easily be flagged as spam.

The Sender ID technology requires domain owners to publish so-called Sender Policy Framework (SPF) records, a list of IP addresses used to send email.

Spam filter developers such as Symantec and Sendmail, as well as Microsoft's Hotmail service, support the technology. Currently about five million Internet domains have adopted Sender ID, according to Microsoft.

Microsoft's Open Specification Promise was first published in September to cover all Web services technologies. It is essentially a patent pledge that promises not to sue any developers or distributors for potential infringement of Microsoft's intellectual property in areas that are coved by the Promise.