A new service from Return Path, a provider of e-mail certification and reputation management services, helps marketers prevent criminals from using legitimate Internet domain names to send malicious e-mail to customers’ inboxes as part of “phishing” attacks.
Phishing attacks typically use legitimate brands and domain names to send e-mail designed to trick recipients into clicking to a fraudulent web site and enter information like credit card numbers and passwords that crooks can either sell to other criminals or use to make fraudulent financial transactions.
Return Path’s new application, Domain Assurance, is designed to stop such criminals before they can send phishing e-mails, says Sam Masiello, general manager of the company’s anti-phishing services.
Under the Domain Assurance service, Return Path and Internet service providers will audit marketers’ e-mail and Internet domain names—the Internet addresses from which they send e-mail—to ensure they’re properly authenticated under recognized industry methods such as Sender Policy Framework, or SPF, and DomainKeys Identified Mail, or DKIM. Such methods validate e-mail as coming from a particular domain name or IP address. For example, if the body of an e-mail claims that it’s from Target Corp., the service will check the sending domain name to verify that it’s an authentic Target domain, Masiello says.
Once its e-mail system is authenticated, a marketer can add its domain names to the Domain Assurance Registry, which enables ISPs to automatically reject unauthenticated e-mail that spammers attempt to send with spoofed versions of registered domains, Masiello says.
“Domain Assurance changes the game by blocking phishing e-mails before they get delivered to the customer mailbox,” says George Bilbrey, president of Return Path.
Domain Assurance also comes with an online dashboard that lets clients view reports from Return Path and its participating ISPs, including major ISPs like Yahoo and Comcast, about any attempts by spammers to use their domain names to send malicious e-mail. The dashboard also provides information from the Return Path Reputation Network, which includes spam-related information compiled by ISPs.
The reports in the dashboard include information on spammers such as the web addresses of the fraudulent web sites to which they attempt to lure e-mail recipients. This enables the legitimate marketers to take steps with other security services firms, ISPs and legal authorities to take down such fraudulent web sites, Masiello says.
Fees for using Domain Assurance are based on monthly e-mail volume and the level of support provided by Return Path, which can include assistance in interpreting the information the system provides on fraudulent activity, Masiello says. Clients typically use a self-help software tool to set themselves up with the system, a process that usually takes less than two hours regardless of the client’s number of domain names, he adds.