Why electronic mail has no sender authentication

1982The protocol, as specified

The sending machine states who the mail is from. Nothing verifies the statement, and there is no mechanism in the protocol for doing so.

That is not an oversight. The network at the time consisted of a few hundred machines run by identifiable organisations, mostly academic, and the practical problem was getting mail delivered at all across unreliable links.

Two different senders

A complication that explains why the repair took three separate protocols. The address the delivery machinery uses and the address displayed to the reader are different fields, carried in different parts of the message, and neither has ever been required to match the other.

A message can therefore be delivered on behalf of one address while displaying another, which is legitimate for mailing lists and forwarding, and is also exactly what a forged message does.

1980sRelaying as a courtesy

Machines commonly accepted mail from anybody for delivery to anybody, because the network was patchy and passing a message along was helpful.

Closing that behaviour took most of a decade of argument once it became the mechanism of mass unsolicited mail, and the argument was genuinely difficult: the operators being asked to stop were being asked to withdraw a service to strangers for the benefit of other strangers.

2000sThe first retrofit

A domain publishes, in the naming system, which machines are permitted to send mail on its behalf. A receiver can then check whether the connecting machine is on the list.

It authenticates the sending machine, not the message, and it breaks when mail is forwarded, because the forwarding machine is not on the original domain's list.

2000s and 2010sThe second and third

The second signs the message itself with a key published in the same naming system, which survives forwarding and proves that a domain took responsibility for the content.

The third exists because neither of the first two says anything about the address the reader actually sees. It requires that the authenticated domain match the visible one, and lets a domain state what receivers should do when it does not.

present dayWhat the repair achieved and did not

Together they make it possible to establish that a domain authorised a message. They establish nothing about a person, they are voluntary at both ends, and a receiver gains protection only against senders who have chosen to publish policy.

The remaining gap is where the damage is. A message from a domain that resembles a real one passes every check, because every check concerns the domain that sent it rather than the one a reader might confuse it with.

2010s onwardsThe consequence nobody planned

Because the checks are advisory, receivers decide how to weigh them, and a handful of very large receivers therefore decide in practice whether mail from a given sender arrives.

An open protocol with no authentication produced, by way of its repairs, an informal gatekeeping arrangement with no appeal. That is a structural outcome rather than anybody's decision, and it is the second-order cost of the original omission.

What the original design got right

Worth conceding. The protocol is simple enough to implement in an afternoon, degrades gracefully across unreliable links, and requires no coordination to join, which is why mail spread to every machine on the network and every network since.

The absent authentication is the same property viewed from the other side: a system anybody may join is a system anybody may join.

present dayThe address that resembles another

The remaining and largest gap is not technical. A domain registered a week ago, differing from a real one by a character, can publish every record correctly and pass every check.

All three retrofits verify that a message came from the domain it claims. None of them has any opinion about whether that domain is the one the reader has in mind, and no protocol can, because that is a question about a person's expectations.

present dayWhat a reader can actually check

The practical residue for anybody receiving mail is short. The displayed name is arbitrary text. The address beside it is the only part any protocol has an opinion about, and the opinion concerns the part after the final dot-separated components rather than the whole string.

Everything else in a message, including logos, formatting and the apparent thread it belongs to, is supplied by whoever sent it and verified by nothing.

What it would take to do properly

Authenticating people rather than domains requires every correspondent to hold a key and every reader's software to check it, which has been specified repeatedly since the nineteen-nineties and adopted by a small minority.

The obstacle is not the cryptography. It is that key management is an unsolved usability problem, and a system that fails closed for ordinary people fails to deliver their mail, which they will not accept.

What we cannot verify

The specifications are published and can be read. Figures for how much mail is fraudulent, and for the share of phishing in intrusions, come from vendors and industry bodies with an interest in the answer and vary by an order of magnitude between sources; none is reproduced here.