Internet Giants Unite in War on Phishing

Organizations Unite to Combat Email Phishing through DMARC.org

Fifteen companies, including PayPal, Google, Facebook, and Microsoft, have united to launch DMARC, a blueprint for a global counter attack on phishing, and a way to improve coordination between email providers and mail sender domain owners to combat spam.

DMARC, Domain-based Message Authentication, Reporting and Conformance, will be supported by DMARC.Org, a newly announced technical working group that has been developing the standards for the past 18 months.

The group says it has a draft specification that helps create a feedback loop between legitimate email senders and receivers to make it more challenging for phishers trying to send fraudulent email.

DMARC.org says that its specification addresses concerns that have traditionally deterred widespread deployment of an authenticated, trusted email ecosystem. Email receivers currently lack a reliable way to know the extent to which an email sender uses standards like SPF and DKIM for authenticating their messages. Because of this, email providers must rely on complex and imperfect measurements to distinguish legitimate unauthenticated messages from fraudulent phishing messages.

It also gives the legitimate owner of an Internet domain a way to request that illegitimate messages – spoofed spam, phishing – be put directly in the spam folder or rejected outright.

The group plans to gather data and input from field usage and then submit its DMARC specification to the The Internet Engineering Task Force (IETF) for standardization.

“Email phishing defrauds millions of people and companies every year, resulting in a loss of consumer confidence in email and the Internet as a whole,” said Brett McDowell, Chair of DMARC.org and Senior Manager of Customer Security Initiatives at PayPal. “Industry cooperation – combined with technology and consumer education – is crucial to fight phishing.”