Microsoft's Caller ID for E-Mail proposal and Meng Weng Wong, the co-founder and CTO of PoBox.com and the author of the Sender Policy Framework (SPF) proposal were converged into "Sender ID."

Sender ID is designed to help verify the source of e-mail to help eliminate domain spoofing and provide greater protection against phishing schemes. By providing a unified specification, Microsoft and Wong hope to simplify industry adoption of effective e-mail authentication technology, thereby helping more swiftly provide greater spam protection to e-mail users worldwide.

"Spoofing," or sending e-mail purporting to be from someone it's not, is an increasingly common and relatively simple way for spammers to try to trick filters. It can also pose a security risk when used to deliver e-mail viruses or phisher scams, which attempt to trick users into divulging personal information such as credit card numbers or account passwords by pretending to be from a legitimate source, such as a user's bank. Sender ID aims to prevent spoofing by confirming what domain a message came from and thereby increase the effectiveness of spam filters.

Under the merged proposal, organizations will publish information about their outgoing e-mail servers, such as IP addresses, in the Domain Name System (DNS) using the industry-standard XML format. Backward compatibility will be provided for the many domains that have already published information in the SPF TXT format.

The converged specification will enable receiving systems to test for spoofing at the message transport (SMTP) level, or envelope, as originally proposed in SPF, as well as in the message body headers, as originally proposed in Caller ID. Testing for spoofing at the message transport level allows receiving systems to block some spam messages before they are sent. Checking the message body headers is necessary in cases in which a deeper examination of the message contents is required to detect spoofing and phishing.

"Twenty thousand domains have already published SPF records," Wong said. "Sender ID automatically gives those domains additional protection from phishing and spoofing as well."

"Over half of the e-mail targeting our Hotmail® customers today come from spoofed domains, and we are committed to taking this trick away from spammers," said Ryan Hamlin, general manager of the Anti-Spam Technology and Strategy group at Microsoft. "We very much look forward to working with the IETF and others in the industry to help swiftly move forward in establishing e-mail authentication standards as a key step toward containing the spam problem for customers worldwide."

Momentum for this kind of standard is building. Earlier this week, the Anti-Spam Technical Alliance (ASTA) formed by key industry stakeholders such as America Online, British Telecom, Comcast, EarthLink, Microsoft and Yahoo! published a host of recommendations for the industry to effectively address the spam problem and recognized the need for the broad adoption of e-mail authentication mechanisms, including the kind of IP-based approaches put forth in Sender ID. Also, in addition to Microsoft, many leading technology companies including America Online, Brightmail, Cloudmark, EarthLink, IronPort, Sendmail, Tumbleweed and VeriSign have already committed to quick adoption and implementation of Sender ID as it moves toward becoming an industry standard.