1. Periodic Observation Report

Messaging Technology

1.1 Introduction

measures, however, so using them properly is important to

According to the Council of Anti-Phishing Japan’s reports*1,

ensure effectiveness. Further, some posit that the rise in

the number of phishing cases reported to the council isthese emails reflects the recent social situation, so it may

rising rapidly. April 2020 saw 11,645 cases reported, an

persist for some time yet.

increase of 1,974 vs. the previous month (March 2020) anda hefty 9,257-case year-on-year rise (vs. April 2019). The

In this issue, we report on the prevalence of sender au-

substance of these cases shows a large volume of phish-

thentication technologies (SPF, DKIM, DMARC) that are

ing impersonating major companies that maintain an online

effective against email spoofing. We also discuss how topresence. Indeed, I have also received a number of such

use the results of sender authentication against the type ofemails. The Subject header and the display name and local

phishing emails currently circulating. We also report on thepart of the From header generally look the part, but the

JPAAWG 2nd General Meeting, held last year.

sender domain name is often completely different. And because fraudulent emails impersonating government agencies

1.2 Sender Authentication Rates

may be on the rise, countermeasures should be taken by

It is now 14 years since the first SPF (Sender Policy

both email recipients as well as owners of domains likely to

Framework) specification, RFC 4408*2, was published in

be spoofed.

April 2006. This was later followed by the DKIM specification, which uses digital signatures, and eventually DMARC,

4

As we have repeatedly reported, sender authentication iswhich uses SPF and DKIM authentication results. We reporteffective against phishing and other forms of email spoof-on the current prevalence of these sender authentication

ing. Those who send phishing emails are aware of thesetechnologies.

*1

Council of Anti-Phishing Japan, monthly reports listing (https://www.antiphishing.jp/report/monthly/, in Japanese).

*2

Subsequently revised in April 2014 as RFC 7208.

© Internet Initiative Japan Inc.

Jul.2020

Vol.

47

1. Periodic Observation Report

1.2.1 Results Based on Emails Received

increase in phishing reports, however, implies that spoofed

Given the practical implications, the percentage breakdown

emails are not themselves in decline. That is, spoofed emailsof authentication results for received emails can be con-that are not spoofing as far as SPF is concerned may be on

sidered important from the perspective of studying sender

the rise.

authentication deployment rates. IIJ’s email services provide the ability to perform SPF, DKIM, and DMARC sender

Figure 2 breaks down DKIM authentication results forauthentication upon email receipt. This feature returns aemails received in April 2020. The “none” result accounts“none” result for each method if the received email cannot

for 51.7% (48.3% deployment rate), a 10.5%pt drop frombe authenticated. So the proportion of received emails that

62.2% a year earlier, meaning that the deployment rate in-

do not return “none” can be interpreted as the deployment

creased 10.5%pt. Implementing DKIM as a sender requires

rate for received emails.

some effort as it requires adding a DKIM digital signatureon the sending email server. The current deployment rate is

Figure 1 shows the breakdown of SPF authentication re-by no means adequate, but 13 years since the first DKIM

sults for emails received in April 2020. The “none” result

specification was released in RFC 4871, it has finally spreadaccounts for 12.1%, meaning that the deployment rate wasto around half of all emails received (in terms of emails re-

87.9%. This is a 2.2%pt increase vs. the rate of 85.7%

ceived on IIJ services).

reported a year ago in IIR Vol. 43. The figure for “pass”,
meaning SPF authentication was successful, rose 9%pt

Figure 3 breaks down DMARC authentication resultsfrom 70.1% in April 2019 to 79.1% in April 2020. So thefor emails received in April 2020. The “none” result ac-

proportion of authentication failures (hardfail, softfail, andcounts for 75.4%, indicating a deployment rate of 24.6%,

neutral in the case of SPF) also fell by 6.4%pt, indicating aa 1.5%pt increase vs. a year earlier. This is a very small

rise in emails not spoofing as far as SPF is concerned. The

increase relative to SPF, which in practical terms is now

none

12.1%

permerror

1.0%

neutral0.3%

softfail

5.9%

hardfail

1.6%

pass 79.1%

Figure 1: Breakdown of SPF Authentication Results
pass 20.6%

pass 45.4%

fail 3.9%
permerror 0.1%

none

none

51.7%

75.4%

fail 1.1%
neutral 1.8%

Figure 2: Breakdown of DKIM Authentication Results

Figure 3: Breakdown of DMARC Authentication Results© Internet Initiative Japan Inc.

5

almost fully deployed, and DKIM, which generally entails an

being an extremely low point for DMARC, the graph instead

implementation cost. Deploying DMARC requires either SPF

shows that while there is a gradual increase in sender do-

or DKIM, or both, to be present, but if that requirement ismains supporting DMARC, that growth is very slow.

satisfied, DMARC can be implemented by simply publishinga DMARC record (text resource record) on the DNS, as is

Figure 5 breaks down the TLDs (top level domains) ofdone with SPF. There is no need to look at the sending email

domain names that passed DMARC authentication. The

server’s exit point, so DMARC records should actually bepercentages are not relative to the volume of emails re-easier to configure. We still do not know whether the mea-

ceived; they indicate TLD counts as a proportion of thegre increase in deployment relative to SPF and DKIM reflects

total number of separate DMARC domain names (uniquea simple lack of recognition or administrators being unclear

domain names). The .com TLD had the largest pie piece

about the motivation for publishing a DMARC record. We

at 53.2%. Second was .net with 9.5%, and Japan’s

intend to continue advocating for the broader deployment.jp domain name was third with 6.7%. Among domainof DMARC ahead.

names that passed SPF authentication, .com was again
the most common TLD, so there was no major difference

Figure 4 shows the breakdown of DMARC certification re-in the rankings.

sults over time, from January 2016. Rather than April 2020

(%)
100

75

50
■none
■permerror■temperror
■fail
■pass

25

Ja

n.

’1
6
Fe
b
M .
ar
Ap .
r.
M
ay
Ju
n.
Ju
l.
Au
g.
Se
p
O .
ct
.
N
ov
.
Ja De
n. c.
’1
7
Fe
b
M .
ar
Ap .
r.
M
ay
Ju
n
Ju .
l.
Au
g
Se .
p
O .
ct
.
N
ov
.
Ja De
n. c.
’1
8
Fe
b
M .
ar
Ap .
r.
M
ay
Ju
n
Ju .
l.
Au
g
Se .
p
O .
ct
.
N
ov
.
Ja De
n. c.
’1
9
Fe
b
M .
ar
Ap .
r.
M
ay
Ju
n
Ju .
l.
Au
g
Se .
p
O .
ct
.
N
ov
D .
Ja ec
n. .
’2
0
Fe
b
M .
ar
Ap .
r.

0

Figure 4: Breakdown of DMARC Authentication Results Over Timeothers

19.2%

in

0.8%

co

1.0%

de

1.0%

uk

1.6%

cn

1.6%

org

2.3%

au

3.0%

jp

6.7%

net

9.6%

com 53.2%

Figure 5: TLD Breakdown for DMARC Domain Names

6© Internet Initiative Japan Inc.

(Date)

Jul.2020

Vol.

47

1. Periodic Observation Report

1.2.2 Results Based on Domain Names

on an average of 57.3% of all jp domain names. Our latest

Another view on sender authentication technology is pro-results, for May 2020, show a 7.8%pt increase to 65.1%.

vided by looking at how many records for each senderauthentication technology are registered for registered do-

Figure 6 plots DMARC deployment on jp domain names. Frommain names. To do this, we have to set a scope and obtain

0.57% in March 2018, it rose 0.62%pt to 1.19% in May

all domain names within that scope.

2020. So the rate doubled over roughly two years, but it
was low to begin with and the increase itself was very small

As reported in IIR Vol. 39, we are studying jp domain names

relative to that for SPF, so both readings were very low. By

in collaboration with Japan Registry Services (JPRS), anddomain type, DMARC is currently most prevalent on go.jp

we currently have a joint research agreement with Internet

domains, but only with a 5.4% reading. SPF has 92.4% prev-

Association Japan (IAjapan). I am taking part in the studies

alence on go.jp, so we hope to see similar efforts to drive

as a member of IAJapan.

increasing use of DMARC records on all jp domains.

DKIM needs the DKIM selector name to acquire the digital

1.2.3 Sender Authentication as a Measure Against Emailsignature information (DKIM record), but since the selector

Spoofing

is specified in the email header, the domain name alone isGovernment agencies and so forth are implementing a range

insufficient to determine the DKIM record’s location. It isof measures under the current societal situation, and email

sometimes possible to guess whether a DKIM record has

communications are set to increase as part of that process.

been created , but this is not always accurate. This is why

Online purchasing and the like is also on the rise as people

only study results on the prevalence of SPF and DMARC,

avoid going out. As a reflection of this, fraud via phishingand not DKIM, are published*4. In each case, the proportions

and email spoofing may be on the rise.

*3

are based on domain names that have MX resource records,
enabling us to determine that the domain name is used for

For example, emails impersonating Amazon are frequentemail. There are, of course, ways of configuring SPF andand adopt a number of patterns, but emails from the actual

DMARC records (and, recently, MX resource records too)

Amazon support SPF, DKIM, and DMARC, so sender authen-for non-email domain names, but we’ll cover the details of

tication will tell you if an email is spoofed or not. And thethat another time.

Amazon SPF record ends with “-all”, so an SPF authentication failure always returns the strongest result of “fail”. The

Here, we report on the latest study results for SPF and

DMARC policy is also set to the relatively strong “p=quar-

DMARC. In March 2018, when our study began, SPF wasantine”. So Amazon seems to have actively adopted sender

6■Average■Generaluse■Regional
■lg
■ed
■gr
■ne
■or
■go
■co
■ac
■ad

4.5

3

1.5

0

ay

Ap
r.

M

ar
.
M

Fe
b.

20

.

.

ec

.’

Ja
n

D

ct
.

p.

ov
N

O

l.

g.

Se

Au

n.

Ju

Ju

r.

.

ay
M

Ap

.

ar
M

19
.’

Fe
b

D
ec
.

ct
.

p.

N
ov
.

O

Se

Ju
l.

Au
g.

n.
Ju

r.

ay

Ap

M

Ja
n

M

ar
.’

18

(Date)

Figure 6: DMARC Deployment on jp Domain Names*5 Over Time*3

How to Measure Deployment Ratio of Domain Authentications (http://member.wide.ad.jp/wg/antispam/stats/measure.html.en).

*4Anti-spam Measures | Statistical Data (https://www.soumu.go.jp/main_sosiki/joho_tsusin/d_syohi/m_mail.html#toukei, in Japanese).

*5

Regional (newly registered) includes prefectural domain names.

© Internet Initiative Japan Inc.

7

authentication technology and bolstered defences against

Anti-Spam Conference. And as with the 1st GM, IIJ was

email spoofing. A point to note about detecting Amazon

again a platinum sponsor.

spoofing emails is the need to check that the authenticateddomain name is correct. In Japan, Amazon uses the ama-

In light of the 1st GM’s outcomes, the following new ideas

zon.co.jp domain name. Many of the spoofed emails use

were tried at the 2nd GM.

completely unrelated domain names and are set up so as
to pass SPF and DMARC. The Subject header and the dis-

1.Hold meeting over two days

play name in the From header contain the string “Amazon”.

2.Welcome many speakers and attendees from abroad,So ensuring that the authenticated domain name is also
checked is key to avoid being defrauded.

including M3AAWG members
3.Hold training sessions (paid)
4.Conduct Open Round Table discussions

Of the jp domain name types shown in Figure 6, lg.jp, which
is used by local governments and such, has consistently

Open Round Table (ORT) sessions are held at every M3AAWG

had the lowest DMARC deployment rate since our study

General Meeting*6, allowing participants to gather and dis-began. Of course, local governments do not only use lg.jp,

cuss topics of interest to them. ORTs can even be the point

but the deployment rates shown indicate what proportion ofof inception for documents like new technical specifications

domains with MX records have a DMARC record configured,and Best Practices, making them one of the driving forces

and the proportion of those with an SPF record was a highbehind M3AAWG’s activities. JPAAWG set five themes for

80.7%, coming in behind go.jp. So here again, to protect

the sessions, and JPAAWG members served as moderators

against spoofed emails, administrators first of all need to

to facilitate balanced discussion involving all participants.

configure a DMARC record to protect the sender domain

JPAAWG hopes to continue hosting activities like ORTs toin the header. And to determine just how many emails areprovide a forum for discussing issues and thinking about

spoofing the domain, they also need to get set up to re-solutions.

ceive DMARC reports so they can constantly monitor what
is happening.

We wanted to hold the JPAAWG 3rd General Meeting in asimilar format in 2020. Under present circumstances, how-8

1.3 JPAAWG 2nd General Meeting

ever, a large gathering does not look all that viable. We are

The JPAAWG 2nd General Meeting (GM) took place atin the process of considering what sort of format would

Bellesalle Iidabashi First on November 14–15, 2019 (Figure

work, so we will provide notice on the website*7 once a7). As in 2018, it was held in conjunction with IAJapan’s

decision is made.

*6

Messaging, Mobile and Malware Anti-Abuse Working Group (https://www.m3aawg.org).

*7

Japan Anti-Abuse Working Group (JPAAWG) (https://www.jpaawg.org/).

© Internet Initiative Japan Inc.

Jul.2020

Vol.

47

1. Periodic Observation Report

1.4 Conclusion

So in 2020, we had opportunities to present both in Japan

I attended the JANOG45 meeting held in Sapporo over

and abroad, and we were all set to continue communicat-

January 22–24, 2020, and made a presentation in theing our key insights with increased vigor. But the situation“Current State of Phishing and Countermeasures“ session.

took a turn, as you know, and forced a rethink of the for-I went because I felt it was important for a large number

mat in which meetings are held. Yet our work is aimed atof people in the field to be aware that adoption of senderpromoting the proper use of the various tools available onauthentication technologies, DMARC in particular, is low,

the Internet, so even under circumstances such as these, I

as discussed in this report. At the M AAWG 48th Generalthink we should continue working to make communication

Meeting in San Francisco over February 17–20, 2020, we

happen and ensure that those tools are not misused.

3

again held a JPAAWG BoF group meeting, and in a session
titled “State of Messaging Anti-Abuse in Japan”, I presented on JPAAWG’s activities along with other JPAAWG/
M3AAWG members.

Figure 7: Photo taken at the JPAAWG 2nd General Meeting

Shuji Sakuraba
Senior Manager, Application Service Department, Network & Cloud Division, IIJ. Mr. Sakuraba is engaged in the research and developmentof communication systems. He is also involved in various activities in collaboration with related external organizations aimed at bringing
about safe and secure messaging environments. He has been a member of M3AAWG since its establishment. He is the chair of the Japan
Anti-Abuse Working Group (JPAAWG). He is acting chairperson of the Anti-Spam mail Promotion Council (ASPC) and a member of its
administrative group, as well as chief examiner for the Technology Workgroup. He is a visiting researcher at Internet Association Japan andchairman of its Anti-Spam Measures Committee. He is a visiting researcher at JIPDEC.

© Internet Initiative Japan Inc.

9