Security threats Toolkit

Email users get a reputation

Joris Evers CNET News

Published: 30 Aug 2005 09:30 BST

A new Web site aims to help determine whether a specific computer has been sending legitimate email or spam.

The TrustedSource Web site uses data from reputation filters, which are billed as the next big thing in email security. Makers of spam-fighting tools collect data on email senders and use that to assign "reputations" to email sending computers and Internet domains. Those who send a lot of spam get a negative rating and their messages are more likely to be filtered out.

CipherTrust is one of those email security vendors. The company has sold more than 4,000 of its IronMail appliances to customers worldwide. CipherTrust is now sharing some of the reputation data it has gathered through those machines with the public through the TrustedSource Web site, the company announced on Monday.

The Web site is designed to be a reference tool. Entering a domain name generates a list of the IP addresses of machines that send email for that domain. Users can then drill down and click on each sending address to see if the specific machine has been sending junk mail or legitimate messages.

TrustedSource could be useful for the occasional check, for example when configuring a spam filter or just to learn the reputation associated with a specific domain. It may be more helpful for organisations to identify which systems on their networks are sending email, said Dmitri Alperovitch, a research engineer at CipherTrust. Typically, on a corporate network, only designated email servers should be sending email.

"Often companies don't realize that they have zombie machines on their network that have been sending email," Alperovitch said. Zombie machines are computers that have been commandeered by cybercriminals and are often used to send spam.

The Web site also provides information on the adoption of fledgling email authentication technologies. There are lists of Internet domains that send email using DomainKeys Identified Mail and Sender ID. Both technologies are designed to improve spam filters and prevent the spoofing of email addresses.

TrustedSource can help IT staff implement Sender ID, or to make sure that the implementation was done properly. Sender ID requires a so-called Sender Policy Framework record. This record should list the IP addresses of computers that may send email on behalf of a domain. TrustedSource lists all the IP addresses that are actually sending mail.

In addition to the TrustedSource Web site, CipherTrust on Monday also released two new anti-spam products, which both use reputation services to filter out unwanted mail:

The IronMail Gateway 6.0 is an improved version of CipherTrust's e-mail scanning appliance. It offers better enterprise integration, implementation, management and reporting features than its predecessor, according to CipherTrust.
IronMail Edge is a new first line of defense against bad e-mail. The appliance — designed for large enterprises — scans e-mail at the outer edge of a company's network, preventing unwanted traffic from using up valuable bandwidth.