Messaging Technology

2. Messaging Technology

Sender Authentication Technology Reaches the Practical Application Stage
with a Focus on SPF
In this report we will present an overview of spam trends for week 27 through week 39 of 2011.
As was the case in the previous study, China was the top source of spam.
The volume of spam that had been in decline since the latter half of last year also seemed close to hitting
bottom during this period.

2.1 Introduction
In this report we discuss the latest trends in spam and email-related technologies, and summarize various activities in which
IIJ is engaged. In this volume we focus on data for the period of 13 weeks from week 27 of 2011 (July 4 to July 10, 2011) to week
39 (September 26 to October 2, 2011), which corresponds to the 2nd quarter for many Japanese companies.
Additionally, in “Trends in Email Technologies,” we report on the penetration rate of sender authentication technologies.
In this report we also present survey results for services other than IIJ’s email services, and compare and comment on thepenetration rate in Japan and other regions. We now believe that the penetration rate of sender authentication technology,in particular SPF (Sender Policy Framework), has risen significantly in Japan through the activities of organizations such as
JEAG*1 and the Anti-Spam mail Promotion Council*2 in which the authors participate. We refer to external data to get to thetruth of this matter.

2.2 Spam Trends
In this section, we will report on historical ratios of spam and the results of our analysis concerning spam sources based ontrends detected by the Spam Filter feature provided through IIJ’s email services.

2.2.1 Spam Volume Decline Stops
Figure 1 shows spam ratio trends over the period of one year and three months (65 weeks), including the current survey
period and the same period for the previous year. The average spam ratio for the current survey period was 48.2%. This is asignificant drop of 30.8% compared to the same period for the previous year, but a drop of merely 2% compared to the last
survey period. This indicates that the volume of spam that had been in decline since the latter half of last year may have hit
bottom during this period. Additionally, although the suspension of large-scale botnet activity caused a drop in spam volume
worldwide, it is possible that mail-based targeted attacks on specific companies are taking place, so the security threat may
now actually be higher.

(%)
90
85
80
75
70
65
60
55
50
45
40
2010.7.5

8.5

9.5

10.5

11.5

12.5

2011.1.5

Figure 1: Spam Ratio Trends

28*1Japan Email Anti-Abuse Group, http://jeag.jp/ (in Japanese)*2

http://www.dekyo.or.jp/soudan/anti_spam/ (in Japanese)

2.5

3.5

4.5

5.5

6.5

7.5

8.5

9.5

(Date)

Figure 2 shows our analysis of regional sources of spam over the period studied. In this survey China (CN) remained the top
regional source of spam, accounting for 32.2% of spam, or almost a third of the total. As in the previous report, Japan (JP)was in 2nd at 13.8%, with actual numbers also rising. The Philippines (PH, 5.6%) was 3rd, the United States (US, 5.6%) was4th*3, India (IN, 4.8%) was 5th, and South Korea (KR, 4.5%) was 6th.
n Trends in the Main Regional Sources of Spam and Anti-Spam Activities
Figure 3 shows trends in ratios for the top six regional sources of spam from the beginning of 2011 to the current survey

Messaging Technology

2.2.2 China Remains in Top Spotperiod. As demonstrated by these trends, China (CN) has held top place since the end of January 2011. Because China has
been the source of more than double the spam volume of second place holder Japan (JP) during the current survey period,reducing spam from China would be an effective way of reducing spam received in Japan. Together with the Japanese
government, we have held talks with China about the spam issue via the ISC*4. During these talks we strongly encouraged theimplementation of OP25B*5 that has been successful in Japan. However, unlike Japan, in China telecommunications carriers
are separate from the companies that provide application services such as email, so it seems the telecommunications carriers
that would have to implement OP25B have little awareness of the issue of spam and related complaints. This also appears
to be the reason that the implementation of OP25B in South Korean is not gaining much ground. We will continue to present
data from Japan and encourage the bolstering of countermeasures.

2.3 Trends in Email TechnologiesHere we will examine a variety of technological trends relating to email. In this report we present a number of survey results
regarding the adoption of sender authentication technology.

Other 11.1%

CN 32.2%

IT 0.5%

JP 13.8%

KZ 0.5%PH 5.6%

B Y 0.8%

US 5.6%

RO 1.0%IN 4.8%

HK 1.1%

KR 4.5%

PL 1.2%PK 1.3%
TH 1.6%
UA 1.8%
ID 2.0%BR 2.1%RU 3.6%

V N 2.3%

TW 2.6%

Figure 2: Regional Sources of Spam(%)
403530CN25JP20PH15US10IN05KR02011.1.31.10 1.17 1.24 1.31

2.7

2.14 2.21 2.28

3.7

3.14 3.21 3.28

4.4

4.11 4.18 4.25

5.2

5.9

5.16 5.23 5.30

6.6

6.13 6.20 6.27

7.4

7.11 7.18 7.25

8.1

8.8

8.15 8.22 8.29

9.5

9.12 9.19 9.26

(Date)

Figure 3: Trends in Ratios for the Main Regional Sources of Spam*3

3rd and 4th place both have the same value due to figures being rounded to the first decimal place, but the ratio for the Philippines (PH) is actually higher.

*4Internet Society of China, http://www.isc.org.cn/english/*5OP25B (Outbound Port 25 Blocking) is technology that blocks access to port 25, which is used by MTAs (Mail Transfer Agents), from dynamic IP addresses
used for the Internet connections of consumers. It is an effective measure for suppressing the sending of spam on your network.

29

Messaging Technology

2.3.1 SPF Sender Implementation Status
Figure 4 shows SPF authentication result ratios for email received during the current survey period (July to September 2011).
43.2% of authentication results showed “none,” indicating that the sender domain did not declare an SPF record. This wasa drop of 3.3% compared to the previous survey. This indicates that the mail sender adoption rate increased by 3.3% basedon the volume of mail sent. Though there is some variation, sender adoption rates are increasing consistently. SPF, which iseasy for senders to implement, is expected to continue to spread as a key technology for mail systems.

2.3.2 Global Penetration Rates
The implementation of sender authentication technology in Japan has reached the practical application stage, with a focus
on sender SPF in particular. However, because email is an Internet-based global communication system, it is not enough forthis technology to spread in Japan alone. Lars Eggert*6 of the Nokia Research Center conducts and publishes surveys on theglobal penetration of technologies such as SPF and DKIM on a regular basis.
The surveys target the most popular website domains in each region (covering 500 domains in Japan). As of September
30, SPF*7 penetration was 52.8% in Japan, 60.2% in the United States, 57.8% in South Korea, 52.4% in the United Kingdom,
and 42.4% in Germany. It may appear from these results that penetration in Japan is about average, but it is not that highcompared with the overall global Internet penetration of 61.0%. Similarly, while DKIM*8 penetration is 10.2% in Japan, it is33.6% in the United States. 13.1% in South Korea, 22.4% in the United Kingdom, 15.4% in Germany, and 25.7% globally, withJapan trailing behind in each case. With the relatively easy to implement SPF authentication only being adopted by about
half of senders, it is possible there is a lack of awareness about SPF itself. We will strive to raise awareness and increase
penetration through a variety of organizations.

2.4 Conclusion
The IEFT (Internet Engineering Task Force) DKIM (DomainKeys Identified Mail) Working Group concluded their activities
upon releasing RFC6376 as a revision of the existing RFC4871 and the revisions in RFC5672, and at the same time releasing
RFC6377, which summarizes operations regarding the relationship between DKIM and mailing lists. However, there are stillparts of DKIM that do not fit in with a number of forms of mail utilization that are now in widespread use. The IETF continues
to conduct activities related to sender authentication technology, such as initiating discussions regarding MARF (Messaging
Abuse Reporting Format) and reputation. We will continue toparticipate in these discussions, and make improvements sotemperror 0.2%

that email will endure as a tool for better communications.

permerror 0.9%
none 43.2%
neutral 3.2%
softfail 9.0%
hardfail 3.0%

pass 40.5%

Figure 4: SPF Authentication Result Ratios

Author:Shuji Sakuraba
Mr. Sakuraba is a Senior Engineer in the Application Service Department of the IIJ Service Division. He is engaged in the research and development ofmessaging systems. He is also involved in various activities in collaboration with external related organizations for securing a comfortable messagingenvironment. He is a MAAWG member and JEAG board member. He is a member of the Anti-Spam mail Promotion Council (ASPC) and administrative
group, as well as chief examiner for the Sender Authentication Technology Workgroup. He is also a member of Internet Association Japan’s Anti-Spam
Measures Committee. He is a member of the Ministry of Internal Affairs and Communications’ Unsolicited Mail Measure Working Group.

30*6https://fit.nokia.com/lars/*7

SPF Deployment Trends (https://fit.nokia.com/lars/meter/spf.html)*8

DKIM Deployment Trends (https://fit.nokia.com/lars/meter/dkim.html)