Premiere Global Services' director of deliverability services discusses where to begin with email authentication and how to use it to for profits.
More than two years ago, email authentication standards were introduced to help curb spam, phishing and other abusive practices. Since then, two protocols designed to guarantee email sender identities have emerged and, according to the Email Sender and Provider Coalition (ESPC), many of the top ISPs have adopted at least one. Approximately 21 percent of Fortune 500 companies have adopted one or both, and more than 35 percent of all email is now being authenticated.
The benefits of authentication are being felt at every point along the email spectrum. While not a silver bullet for spam or ISP filtering, it is a critical first step toward solving reputation issues, which involves checking senders' identities against a database of bounce rates, unsubscribe practices and user complaints. For now, however, authentication enables ISPs and corporate domains to determine with more confidence whether email is genuine or fraudulent and whether it should be delivered to the recipient's junk folder or inbox. Recipients are better protected against spam and phishing attacks, and can have a greater trust in their email boxes. And, email marketers who meet authentication requirements are recognized as legitimate, which means improved deliverability, fewer false positives, potentially higher open rates and enhanced preservation of the company's reputation.
If only one, which one?
There are two primary technologies for authenticating email: IP-based and cryptographic. Sender ID Framework (Sender ID or SIDF) and Sender Policy Framework (SPF) are IP-based protocols, while Domain Keys (DK) and DomainKeys Identified Mail (DKIM) utilize cryptographic standards. For the purposes of this article I will use Domain Keys and DKIM interchangeably as I expect all those that are currently publishing Domain Keys to upgrade to DKIM when those specifications are finalized. Sender ID and SPF have been the dominant force in the Domain Keys however, is quickly gaining ground, increasing from less than one percent usage to 10 percent in nine months.
In an ideal world, email senders would utilize both Sender ID/SPF and Domain Keys, since each has its own strengths and the two are now being seen as complementary technologies. However, companies that only have the capacity to adopt one set of standards are well advised to do so. Some ISPs have begun to enforce authentication by sending users visual alerts and negative notices to draw attention to unauthenticated messages. The trend toward enforcement is building slowly, but eventually, senders who fail to authenticate could lose access to a large percentage of their target inboxes, which has the potential to send campaign ROIs plunging.
Because most ISPs and corporate domains have elected to support one or the other authentication solutions, the best way for a company to choose its protocol is with a domain analysis, which will reveal the ones most used by their target audiences. Companies with large numbers of customers using Yahoo!, SBC Global or Earthlink, for example, should consider implementing Domain Keys. On the other hand, those with customers who prefer AOL, MSN or Hotmail should consider adopting Sender ID/SPF. Gmail supports both. For more ISPs and the authentication technologies they support, see the "Authentication at a Glance" table.
Preparing to adopt
Implementing authentication standards is not especially difficult, but there are certain steps that must be followed. An email service provider and/or domain/hosting company can provide guidance on technical requirements such as inventorying all internal and external servers that send company email and obtaining IP addresses and host names for each, creating authentication records or encryption keys, publishing authentication records and testing. Sender ID/SPF and Domain Keys both provide options for publishing authentication records in "test" mode to eliminate the risk of delivery failures during an actual campaign. This ensures receivers have verified all authorized mail servers and that no mail servers were missed in the inventory. A number of testing tools are available from sources such as Yahoo, Gmail and OpenSPF.
Spencer Kollas is director of deliverability services, Premiere Global Services. Read full bio.