Reducing NDR Spams with SenderID tool

What is NDR?

NDR means Non Delivery Report. It is when you receive a message delivery failure saying that something you sent was undeliverable or bounced. But why are you receiving these messages from mail servers that you have not sent email to? This means that "someone" is using or spoofing your email address and they are claiming to be YOU when they are sending emails. Can't believe it? Yes, it can be done. The example for this is, lets say you have an email address like you@domain.com. A spammer got hold of your email and "spoof" the email address. The spammer will now send out spam emails using the email address, to email addressess (some to wrong addresses, or non existent email address), the mail servers of the domain will send out a notice that the email could no be sent this is either the recipient is non existent or the mailbox is full. These non delivery notices are then sent to you@domain.com, even if you did not really sent those emails. And that is why you are getting NDRs.

For these reasons, spams are now becoming a major problems in networks. Spams can actually break down your network because of these emails that keep on coming, eating all the bandwidth that the network can provide, causing denial of service. These spam emails will also make your network get banned or deferred in other sites such as Yahoo, this will mean, you cannot temporarily send a message to a yahoo account, for this will be considered as spam. Now the internet community has now come up with a way to fight these types of NDRs and spams. It is called the Sender Provider Framework or SPF.

SPF will not directly stop spam or junk email, but, it is a way to say which mail sources are legitimate for their domain and which ones are not. SPF was created in 2003 to help close loopholes in email delivery systems that allow spammers to "spoof" or steal your email address to send hundreds, thousands or even millions of emails illicitly.

What Sender Provider Framework really do?

Let us have an example, a spammer forges your email address you@domain.com and tries to send out hundreds or thousands of spams from somewhere other that your mail server. Without SPF, you will surely receive the Non Delivery Reports, this is because SMTP lacks the authentication mechanism and because of this, it is easy to pretend someone you're not. But when SPF is operational, the spammer's message is still sent from your email address which is you@domain.com, but, the remote mail servers will now have a way to determine whether or not the spammer's email server is allowed to send email from your email address. If your organization says they recognize the sending IP addresses, it passes, and you can assume the sender is who they say they are. If the message fails SPF tests, its a forgery and the message is silently dropped without a Non Delivery Report being generated.

Implementing SPF in your Domain

You can use Microsoft's Sender ID Tool and follow the prompts. The link is http://www.microsoft.com/mscorp/safety/content/technologies/senderid/wizard/.

WOODRIDGE

IT Management Articles

Reducing NDR Spams with SenderID tool