Home Malware

Below are the M3AAWG published materials related to our work on preventing and mitigating malware. There is also a Malware video playlist on our YouTube channel at www.youtube.com/maawg and there are a few selected videos on our website in the Training Videos and Keynotes Videos sections under the Meetings menu tab.

Best Practices

January 29, 2024

M3AAWG DNS Abuse Prevention, Remediation, and Mitigation Practices for Registrars and Registries

This document is intended to provide concrete best practices for preventing or mitigating malicious or compromised domains at the registry or registrar level. A fundamental gap within the DNS community exists for how registries and registrars can best operationally effectuate anti-abuse mechanisms specific to malicious or compromised domains. M3AAWG hopes this document will help inform relevant DNS stakeholders and promote a safer and more secure DNS ecosystem. 

August 11, 2023

M3AAWG Best Common Practices for Managing Port 25 for IP Networks

This document is an update to our previous "Managing Port 25 for Residential or Dynamic IP Space - Benefits of Adoption and Risks of Inaction" document published in 2005.

Spammers and other abusers often use viruses and spyware as vehicles to assume control over large numbers of computers. By managing the sending of email from devices on their network, providers can reduce the costs of running their business, increase customer satisfaction, and reduce the level of internet abuse associated with their service.

May 18, 2023

M3AAWG Present and Future of the Public Suffix List

This document describes the PSL, explains its current strengths and limitations, and outlines some possible future enhancements. Most importantly, though, the community must step up and help to make sure it continues to exist. 

May 12, 2023

M3AAWG Ransomware Active Attack Response Best Common Practices

This document addresses the options available if you realize that you are a victim of a Ransomware attack. It explains how to consider risks and alternatives in resolving the recovery and supporting continuity for your business, and how to tackle those issues. 

February 21, 2022

M3AAWG Brand Protection Kit Domain Management

This document focuses on domain management. It outlines how to protect brands from threat actors who are keen to register domains that mimic a brand in order to steal information and/or assets. 


Public Policy Comments

October 03, 2023

M3AAWG Comments on the Request for Information on Open-Source Software Security: Areas of Long-Term Focus and Prioritization

The Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG) made recommendations to the Office of the National Cyber Director (ONCD) regarding the security of open-source software (OSS) in comments submitted to that office on Oct. 3rd, 2023 in response to the Request for Information on Open-Source Software Security: Areas of Long-Term Focus and Prioritization

Comments Submitted: October 3, 2023

August 30, 2023

M3AAWG Comments on Powers in Relation to UK-Related Domain Name Registries

M3AAWG recognizes that the scope of the powers described in the proposals is limited to situations where there has been a serious relevant failure in relation to an internet domain registry or any of its registrars in scope country code top-level domains (.uk) and generic top level domains (gTLDs) (.scot / .wales / .cymru / .london) that are targeting the UK. We generally support the powers in order to protect the public from harm in these limited circumstances. View the document to review the full scope of comments submitted.

Comments Submitted: August 31, 2023

July 12, 2023

M3AAWG Comments on ICANN Amendments to the Base gTLD RA and RAA to Modify DNS Abuse Contract Obligations

M3AAWG welcomes the Contracted Party House’s consideration of long overdue changes to the Base gTLDs Registry Agreement (RA) and the Registrar Accreditation Agreement (RAA) related to the pertinent issue of DNS Abuse. Comments have been submitted for the Amendments to the Base gTLD RA and RAA to Modify DNS Abuse Contract Obligations. In these Comments, M3AAWG urges that these amendments be part of a coordinated effort to address DNS Abuse now and going forward. 

May 25, 2023

M3AAWG Comments on the NTIA's Introduction of Accountable Measures Regarding Access to Personal Information of .us Registrants

M3AAWG has submitted comments on the National Telecommunications and Information Administration's Introduction of Accountable Measures Regarding Access to Personal Information of .us Registrants. In this set of Comments, M3AAWG urges the Agency NOT to implement the potential changes described in this request for comments. Read more for additional insight into M3AAWG's submission.

April 04, 2023

M3AAWG Comments on Review of the Computer Misuse Act 1990: consultation and response to call for information (accessible)

M3AAWG has submitted Comments focused on technical recommendations in response to the UK government's request for Review of the Computer Misuse Act 1990: consultation and response to call for information. These comments provide recommendations supporting efforts to tackle online abuse and cybercrime while respectfully urging the UK government to liaise with key security and anti-abuse groups including M3AAWG and its partner organizations as well as key UK-based and international industry stakeholders.


M3AAWG Reports

M3AAWG Bot Metrics Report

September 01, 2014

Combines data from our first report in 2012 through 2013

M3AAWG Email Metrics Report

September 01, 2014

Combines data from our first report in 2012 through 2013

DM3Z Blog

Updates and Commentary from the Messaging, Malware and Mobile Anti-Abuse Working Group

None at this time.


Articles About M3AAWG

June 01, 2020

Should you deploy a TLS 1.3 middlebox?

To inspect or not to inspect, that is the question.

TLS 1.3 is by far the most secure version of the Transport Layer Security (TLS) protocol, but its use of ephemeral elliptic curve keys--and the deprecation of static RSA keys--means that TLS sessions now offer forward secrecy, a bane to enterprise security administrators who want to maintain visibility into their network traffic.

May 07, 2020

MarTech Interview with Len Shneyder, VP of Industry Relations at Twilio SendGrid

Domain-based Message Authentication, and Reporting, and Conformance is a policy that adds to SPF and DKIM and gives a receiving set of instructions on what they should do when an email they received fails other authentication checks.

February 20, 2020

Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) Celebrates Jerry Upton's 15 Years as Executive Director at the 48th General Meeting

The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG), the largest global industry consortium developing collaborative approaches to combat online abuse, today announced that Jerry Upton will retire from his role as M3AAWG's Executive Director after 15 years of service. He will be succeeded by Amy Cadagin.

January 07, 2020

How to stop email spoofing of parked domains

J.M. Porup includes M3AAWG recommendations on protecting parked domains in an article on the importance of publishing a DMARC record for every domain a business owns.


Subscribe to