Why DKIM Will Fail

CNET reports that the Domain Keys Identified Email (DKIM) project just got preliminary approval from the IETF. The usual suspects in the open source crowd (e.g., Sendmail, Postfix) have added support and a few closed source guys have too. In addition to software support, the big names in email providers (AOL, Yahoo, etc.) have added support on their end.

Notably missing is Microsoft which is significant given that most of the corporate world runs on Exchange.

Here are two reasons why DKIM is destined to become yet another irrelevant standard:

1. Without Microsoft's backing, DKIM will lack the wide scale adoption necessary to be effective.
   
   
2. Spammers will simply sign their spam.
   

On the first point, you have to stop and think about how email as a market is segmented because raw numbers alone are misleading. Email is broken down into two major categories: enterprise email and everything else. The everything else bucket includes the big email providers like Yahoo, AOL, and Hotmail, as well countless hosting providers. User for user, the everything else bucket is *huge*, but largely consumer based. While they can make the C2C and B2C worlds move, they can't make the B2B world move. Thus the kicker: enterprise email is dollar for dollar more significant.

The people willing to pay the hosting providers for services tend to be businesses that need services above basic email and are willing to pay for it. These businesses need to communicate with everyone and unless all the other enterprise users start using DKIM, Yahoo and friends will need to continue allowing non-DKIM email. After all, hosting providers are not going to anger their highest margin customers.

As for the second point, spammers have long adopted the hit and run approach to spamming. There are two approaches to working around DKIM. Approach 1: Get a legitimate domain with a legitimate signature, spam until the signature is not trusted. Ditch the domain and get a new signature. Approach 2: Leverage botnets to send email from users that have trusted accounts through trusted email servers. Continue until either the user is not trusted and the ISP shuts them down or the user cleans up their machine.

Either way, spammers will get a signature and users will continue to see spam in their inbox.

At this point, I believe that spamming is going to be an indefinite problem much like how junk mail is an indefinite problem. The most effective approaches to blocking spam will continue to be content based filtering and the arms race between content filtering technology and spammers will continue. Anti-spam companies know this -- despite DKIM and countless other "stop them at their source" projects, anti-spam's long term prospects continue to look good.

Time to go update SpamAssassin...