Below are the M3AAWG published materials related to our work on preventing and mitigating malware. There is also a Malware video playlist on our YouTube channel at www.youtube.com/maawg and there are a few selected videos on our website in the Training Videos and Keynotes Videos sections under the Meetings menu tab.
There are a number of scenarios in which senders may be required or compelled to send a bulk message despite the fact that such messages are highly likely to exhibit poor delivery metrics such as increased bounces or complaints. These messages are not intended to be used for standard marketing or transactional notices; these are the exceptions to the rule. Prominent examples of high-risk sends would be items such as breach notifications, product recalls, health and safety notices, or other notifications that might need to be sent to individuals who have been previously been suppressed or unsubscribed.
Received email may not be handled only by a human. It may be partially or even fully handled by a software program. The purpose of this document is to offer guidance to marketing and sales staff about the way that nonhuman interactions (NHI, also known as “automated clicks”) affect the performance metrics of their email messages and reporting systems. This document is not intended to solve issues, but rather to provide insights into the effects of NHI and offer some best practices for senders.
M3AAWG Comments on the Initial Report of the Temporary Specification for gTLD Registration Data Phase 2 Expedited Policy Development Process
M3AAWG, the Messaging, Malware and Mobile Anti-Abuse Working Group, appreciates this opportunity to comment on the Initial Report of the Temporary Specification for gTLD Registration Data Phase 2 Expedited Policy Development Process (https://gnso.icann.org/en/issues/epdp-phase-2-initial-07feb20-en.pdf).
The Messaging, Malware, and Mobile Anti Abuse Working Group (M3AAWG) welcomes the opportunity to review the draft report from ICANN’s Security Stability and Resiliency Review Team (Two).
When preparing for bulk or transactional email sending, two items require special attention: outbound IP addresses, and the domain names to be used for these communications. For the latter, ESPs (Email Service Providers) go through this set-up process frequently and have to review the same readiness checklist each time. This process may involve individual client preferences and constraints, both legal and technical.
Public Policy Comments
Recommendations pertaining to findings from the M3AAWG and APWG WHOIS Survey Report presented to ICANN in June, 2021
As a followup to the June 2021 survey report of cyber investigators and anti-abuse service providers on the ongoing impacts of ICANN’s implementation of the EU GDPR, the Temporary Specification for gTLD Registration Data (Temporary Specification, adopted in May 2018), M3AAWG and the Anti-Phishing Working Group (APWG) has released their recommendations for ICANN'S consideration.
M3AAWG and the Anti-Phishing Working Group (APWG) conducted a follow up survey to our 2018 survey of cyber investigators and anti-abuse service providers to determine the ongoing impacts of ICANN’s implementation of the EU GDPR, the Temporary Specification for gTLD Registration Data (Temporary Specification, adopted in May 2018). The report contains our findings and presents some recommendations for consideration.
The Messaging, Malware, and Mobile Anti Abuse Working Group (M3AAWG) welcomes the opportunity to review and submit comments on the final report from ICANN!s Second Securi-ty Stability and Resiliency Review Team (SSR2 RT) to the ICANN Board.
M3AAWG, the Messaging, Malware and Mobile Anti-Abuse Working group, appreciates this opportunity to comment on the Revised Directive on Security of Network and Information Systems (NIS) (https://ec.europa.eu/digital-single-market/en/news/revised-directive-security-network-and-information-systems-nis2). We make these comments in our capacities as cybersecurity professionals and researchers committed to ensuring the security and stability of the internet, including the domain name ecosystem.
"Call for comments – Development of a network-level blocking framework to limit botnet traffic and strengthen Canadians ’online safety", Compliance and Enforcement and Telecom Notice of Consultation CRTC 2021-9
M3AAWG appreciates the invitation to comment on this proceeding. Paragraph 17 of the call for comments stated: "The Commission seeks input from Internet service subscribers on the first question below, and from all stakeholders on the remaining matters."
M3AAWG Bot Metrics Report
M3AAWG Email Metrics Report
Updates and Commentary from the Messaging, Malware and Mobile Anti-Abuse Working Group
None at this time.
Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) Recognizes Cristine Hoepers of CERT.br with Mary Litynski Award
Articles About M3AAWG
Coalition Against Stalkerware Named J.D. Falk Award Winner for Raising Awareness About and Helping Victims of Malicious Spying Apps
Award Honors Falk, Antispam Pioneer and a M3AAWG Founding Member
To inspect or not to inspect, that is the question.
TLS 1.3 is by far the most secure version of the Transport Layer Security (TLS) protocol, but its use of ephemeral elliptic curve keys--and the deprecation of static RSA keys--means that TLS sessions now offer forward secrecy, a bane to enterprise security administrators who want to maintain visibility into their network traffic.
Domain-based Message Authentication, and Reporting, and Conformance is a policy that adds to SPF and DKIM and gives a receiving set of instructions on what they should do when an email they received fails other authentication checks.
Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) Celebrates Jerry Upton's 15 Years as Executive Director at the 48th General Meeting
The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG), the largest global industry consortium developing collaborative approaches to combat online abuse, today announced that Jerry Upton will retire from his role as M3AAWG's Executive Director after 15 years of service. He will be succeeded by Amy Cadagin.
J.M. Porup includes M3AAWG recommendations on protecting parked domains in an article on the importance of publishing a DMARC record for every domain a business owns.