資料３

Anti-Spam mail Promotion Council• Set up as a venue for a wide range of stakeholders both in private and public sectors interested inanti-spam measures• Engages in various activities including the adoption of the Spam Eradication Declaration and thecreation of the Anti-Spam Measures Handbook /Sender Authentication Technologies ManualOrganization:
Anti-Spam mail Promotion Council
Chairperson: Ikufumi Niimi, Professor, Meiji University
Deputy Chairperson: Shuji Sakuraba, Senior Engineer, Internet
Initiative Japan Inc.

Steering CommitteeMembers (50): include telecom businesses, email service
providers (ESPs), advertisers, Application Service Providers(ASPs), security vendors, related organizations, consumer
groups, academic experts, and related government agencies
and ministries

Technical Working GroupLAP 10 Tokyo Committee

Secretariat: Japan Data Communications AssociationHistory：
2008

2009

2010

2011

2012

2013

2014

Establishment andfirst meeting Nov. 27 ▼Second meeting
Oct. 2 ▼Third meeting
July 22 ▼4th meeting
Aug. 4 ▼5th meeting
July 18 ▼6th meeting
Sept. 25 ▼7th meeting
Sept. 24 ▼2011 released

2012 released

2013 released

2014 released

Spam Eradication
Declaration adoptedAnti-Spam Measures Handbook
2009 released
2010 released
Spoofing Eradication Program released

Spoofing Eradication Program revised

Sender Authentication Technologies Manualreleased
2nd edition released

Spam trend in Japan(x 10k messages / day)

220,000

80.00%

200,000

70.00%

180,000
60.00%

160,000
140,000

50.00%

120,000
40.00%
100,000
30.00%

80,00060,00040,00020,00020.00%
legitimate mailspam mail10.00%

spam rate (right side scale)001 04 07 10 01 04 07 10 01 04 07 10 01 04 07 10 01 04 07 10 01 04
20092010
2011
2012
2013
2014

0.00%

Outbound Port 25 Blocking(OP25B)•Basic feature– Block access to port 25 from dynamically assigned IP address by ISPs (InternetService Providers)•Introducing OP25B– Provide email submission service on port 587 (RFC2476)– Require authentication for email submission (SMTP-AUTH, RFC2554)– Configure ACLs (Access Control Lists) to the routers for OP25B– Introducing source address validation (RFC2827, RFC3705) or block incoming
traffic from port 25 for preventing asymmetric routing attacks

Effect of OP25B
Number of ISPs

Japan Spam Ranking

1001OP25B

Spam Rank

9080Target date of OP25B
deployment in the JEAG
Recommendation

706050403013

MIC clarified the legalityof OP25B

25JEAG
published
Recommendation

372010490

Spam Rank: Based on Sophos’s Dirty Dozen report
MIC: Ministry of Internal Affairs and Communication
JEAG: Japan Email Anti-Abuse GroupSender Authentication Technologies• ASPC promote two technologies– SPF (Sender Policy Framework, RFC7208)– DKIM (DomainKeys Identified Mail, RFC6376, STD76)• Next, DMARC + Domain Reputation
Adaption rate of all “.jp” domains
SPF

DK50.0%45.0%
40.0%
35.0%
30.0%
25.0%
20.0%
15.0%
10.0%

Source: WIDE Project and JPRS surveys

5.0%'12/04'12/01'11/10'11/07'11/04'11/01'10/10'10/07'10/04'10/01'09/10'09/07'09/04'09/01'08/10'08/07'08/04'08/01'07/10'07/07'07/04'07/01'06/10'06/07'06/04'06/01'05/10'05/07'05/04

0.0%

50%

40%

30%

20%

DKIM

Jun-14Jun-1440%

May-1450%

May-1460%

Apr-1470%

Apr-1480%

Mar-14Feb-14Jan-14

Dec-13

Nov-13Oct-13

Sep-13Aug-13

Jul-13Jun-13May-13

Apr-13Mar-13

Feb-13Jan-13

Dec-12

Nov-12Oct-12

Sep-12

Aug-12

Jul-12

Jun-12

May-12

Apr-12Mar-12

Feb-12

Jan-12

Dec-11

Nov-11

Oct-11

Sep-11SPF

Mar-14Feb-14Jan-14

Dec-13

Nov-13Oct-13

Sep-13Aug-13

Jul-13Jun-13May-13Apr-13Mar-13

Feb-13Jan-13

Dec-12

Nov-12Oct-12

Sep-12

Aug-12

Jul-12

Jun-12

May-12

Apr-12Mar-12

Feb-12

Jan-12

Dec-11

Nov-110%

Oct-11

10%

Sep-11

90%

Aug-11

Jul-11

100%

Aug-11

Jul-11

Sender Authentication Technologies(Authentication results of receiving message)
passhardfail
softfail
neutralpermerror
temperror
none

30%20%10%0%

100%

90%

80%

70%

60%

passfail
neutralpermerror
temperrornone

Source: MIC survey (SPF: 7 ISPs, DKIM 4 ISPs)DMARC + Domain Reputation(sample model)• 3 steps for inbound mail filtering– Sender Authentication (SPF and/or DKIM) + DMARC– Domain Reputation (White List / Black List)– Spam Filter (Contents Filter)• Requirements for email ecosystem– Domain Reputation Data– Feedback mechanism

Educational Activities of unauthorized login incidents(NIFTY Corporation)Less known about danger of unauthorizedlogin

In our websites, we explain to customers about recent unauthorized login incidents. We
have “Risk Check tool” for checking the awareness of risks of unauthorized login. And we
guide customers to adequate contents showing the troubles caused by unauthorized login,
so customers will be able to know the risk of it and get the tips about how to prevent fromthose troubles. When making these websites, we use attractive “kawaii” characters tohelp people get to know the unauthorized login troubles. Through those activities, NIFTY
is making a big effort to prevent from spam caused by unauthorized login.

Three ways to protect you from unauthorized login
To stay protected from unauthorized login troubles,changing passwords on important sites, and not reusing passwords are effective methods. In addition tothat, NIFTY provides three special tools to preventfrom unauthorized login.
・One-time password system: As the single-use
password is used only in once for authentication,
passwords intercepted by a password sniffer are notuseful to an attacker.
・Login alert system: It will let you know by e-mailwhenever made a login to NIFTY service by your ID.
・Login record checker: You can see the login record
for @nifty.

Introducing troubles of unauthorized login
In this section, we explain several cases of troubles
caused by an unauthorized login. Also, we illustrate
those troubles in spoken language to make it easierto understand the threatens of unauthorized login.

Countermeasures and Situations inMobile Messaging
Messaging Environment

Message Trends

NTT DoCoMo

GourmetMailing list

Inter-Mobile Carrier
Spam Mail (0.03%)

SNS Alert
Shopping

Legitimate Mail (30%)

InternetDisaster-prevention,evacuation

Spam Mail (70%)
SoftBankKDDI (au)(until end of Jun 2014)
Exchanging Subscribers Information••

In-bound Filtered Communication•Low spam rate reason in mobile carriers–The system and guideline of exchanging subscribers information and related information are penetrated.
•••

Act on identification, etc. by mobile phone carriers and the mobile phone improper user prevention act(http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/050526_1.html)
Privacy law (the personal information protection act) and the guideline in telecommunication(http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/privacy.html)
Privacy policy of mobile phone carriers–––•

NTT DoCoMo (http://www.nttdocomo.co.jp/utility/privacy/communication.html)
KDDI (au) (http://www.kddi.com/corporate/kddi/kokai/kojin/denki.html)
SoftBank (http://www.softbank.jp/corp/group/sbm/privacy/telecom/)Out-bound traffic from mobile carrier is restricted (500 recipients per day are permitted in SLA).
–––•

Refer to http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/m_mail.html
Spam Mail is detected by per-User In-bound filters shown as below.

NTT DoCoMo (https://www.nttdocomo.co.jp/info/spam_mail/measure/mail_limit/)
KDDI (au) (http://www.au.kddi.com/support/mobile/trouble/forestalling/mail/anti-spam-effort/)
SoftBank (http://www.softbank.jp/mobile/support/antispam/report/wrestle/)

Several In-bound filters are provided by default (It must be applied by Opt-In, but adopted at high rate).
–

Various Anti-Spam filters are provided to subscribers, as shown in next slide

携帯電話事業者の取り組み(対策状況)

メッセージング環境

迷惑メール動向

NTT DoCoMo

ケータイキャリア間の迷惑メール (0.03%)

SNS通知

グルメ

ショッピング

メルマガ

通常メール(30%)

Internet
防災関連情報

迷惑メール(70%)
SoftBank

KDDI (au)(2014年6月末まで)

送信者情報の交換* 参照先 http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/m_mail.html* お客様の設定によりフィルタリングしたメール

迷惑メールフィルタ適用

•

対策内容
–

携帯電話の契約時の本人確認義務や無断譲渡の禁止、ケータイキャリア間で迷惑メール送信者情報の交換および対処の実施•••

携帯電話不正利用防止法 (http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/050526_1.html)
個人情報保護法、および、電気通信事業者における個人情報保護に関するガイドライン (http://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/privacy.html)
ケータイキャリア各社のプライバシーポリシー–––•

送信通数制限の適用–––•

NTT DoCoMo (http://www.nttdocomo.co.jp/utility/privacy/communication.html)
KDDI (au) (http://www.kddi.com/corporate/kddi/kokai/kojin/denki.html)
SoftBank (http://www.softbank.jp/corp/group/sbm/privacy/telecom/)
NTT DoCoMo (https://www.nttdocomo.co.jp/info/spam_mail/measure/mail_limit/)
KDDI (au) (http://www.au.kddi.com/support/mobile/trouble/forestalling/mail/anti-spam-effort/)
SoftBank (http://www.softbank.jp/mobile/support/antispam/report/wrestle/)

迷惑メールフィルタの適用–

さまざまな迷惑メールフィルタを提供中 (次のスライドを参照)

Anti-Spam filters and Educational Activities inMobile Messaging
In-bound filters
迷惑メールフィルタ

携帯電話事業者の迷惑メールフィルタ設定と啓発活動
docomoIn-bound filters
迷惑メールフィルタ

Official Homepage
公式ホームページ

White List to receive
ドメイ ン ・アドレス指定受信

auSoftBank

http://www.nttdocomo.co.jp/info/spam_mail/http://www.au.kddi.com/service/email/support
http://mb.softbank.jp/mb/support/antispam//meiwaku/index.html

120 entries
受信設定: 120件

200 entries
受信リスト設定: 200件

300 entries
受信許可リスト設定: 300件

200 entries
拒否リスト設定: 200件

300 entries
受信拒否リスト設定: 300件

collective setting: ON/OFF
携帯・PHS事業者を 一括設定

per-Mobile Carrier setting: ON/OFF
事業者毎に受信を 設定

collective setting: ON/OFF・ケータイ /PHSからのみ許可設定

Setting: STEP1

collective setting: ON/OFF

E.164(MSISDN) address: Receive/Reject【受信／拒否設定 STEP１】

携帯電話：一括指定受信設定
collective setting: ON/OFF

・電話番号メール許可・拒否設定150件
E.164(MSISDN) address from foeign carrier: Receive/Reject

per-Domain: 120 entries

Black List to reject
ドメイ ン ・アドレス指定拒否

ドメイ ン 拒否設定: 120件
per-Mail Address: 120 entries
アドレス拒否設定: 120件

Receive only inter-mobile
carrier mail
携帯・PHS、パソコン 、電話番号など
を 一括設定―スマートフォ ン ：携帯/PHSのみ受信設定

・海外からの電話番号メール許可・拒否設定

Strength of Spam Filter

setting: Strong/Weaksetting: ON/OFF

setting: Strong/Normal

判定強度を 選択する 簡易設定

かんたん設定オススメ一括設定

かんたん設定Anti-Mobile Carrier Mail
Spoophing

Reject Spoophing mail: ON/OFF

ケータイ のなりすまし対策

Sender Domain
Authentication
ドメイ ン 認証

Exception List forreceiveing
救済リスト

Reject Spoophing mail: ON/OFF

なりすましメール拒否機能

なりすましメール拒否設定

setting: STEP1【受信／拒否設定 STEP１】

Regulate Spoophing mail: High/Normal/Low

Reject Spoophing mail: ON/OFF

なりすまし規制（高・中・低）

なりすましメール対策―

setting: STEP2【受信／拒否設定 STEP2】
per-Mail Address
宛先指定受信20 entries

20 entries

setting: STEP3 (10 entries)

なりすまし規制回避リスト20件

救済リスト設定20件

setting: ON/OFF

setting: ON/OFF

アドレス帳受信設定

ともだち メール安心設定

setting: ON/OFF

setting: ON/OFF

setting: ON/OFF

迷惑メールおまかせブ ロ ック

迷惑メールおまかせ規制

迷惑メールフィルター

setting: ON/OFF

setting: ON/OFF

URLリン ク規制

URLリン ク付きメール拒否設定【受信／拒否設定 STEP3】10件

White List associated withaddress book―

アドレス帳登録外からのメール拒否

Recommended setting
メールサーバでの迷惑メール判定

URL filtering―

URL付きメール受信拒否

Specific URL filtering

setting: ON/OFF

特定URL付きメール受信拒否

ＵＲＬ付きメール拒否機能

Reject HTML mail――HTMLメール受信拒否

Reject bulk mail
大量送信メールの受信制限

setting: ON/OFF
iモードメール大量送信者からのメール受信制限

setting: ON/OFF
HTMLメール規制――――

Anti-Spam filters and Educational Activities inMobile Messaging
携帯電話事業者の迷惑メールフィルタ設定と啓発活動

Related functions
メール関連設定

docomoRelated functions
関連設定

auSoftBank

Virus check for Smart phone Option

Default

Default

スマートフォ ン 向けウイ ルスメール規制 あんしんネットセキュリティ

ウイ ルスメール規制

Eメール(i)のウイ ルスチェ ックサービ ス（iPhone/iPad）

alphanumeric address from 3 to 30 character length

alphanumeric address up to 30 character length

alphanumeric address from 3 to 30 character length

半角英数字3字以上30字以内

半角英数字30字以内

半角英数字3字以上30字以内

limited 3 times/day

limited 3 times/day

limited 3 times/day

1日3回まで

1日3回までChange of mail addressメールアドレスの変更

24時間内に3回まで――

limited 99 times/account
また1つの電話番号につき最大99回まで

setting: ON/OFF

Checking Message Header
メールヘッダ情報の確認方法

メールヘッダ情報受信設定
Message Header is attached with message body.

for last 30 days, max 500 mails
for last 2 days
携帯画面上で過去30日間に受信したメールを 最大500件まで確認
パソコン から過去2日間に受信したメールについて確認
docomo発以外の受信メールへ本文末尾に表示する よ う設定でき 可能
る

Catalogues and Pamphlet for Customer お客様向けカタログ、パンフレット
docomoauSoftBank
How to protect from SPAM mail.

Anti-SPAM filters setting
Safety Guide for using Mobile Phone

How to protect from SPAM mail.

How to protect from Virus and SPAM mail.