Home Messaging

Below are the M3AAWG published materials related to our messaging anti-abuse work. There is also a Messaging video playlist on our YouTube channel at www.youtube.com/maawg and there are a few selected videos on our website in the Training Videos and Keynotes Videos sections under the Meetings menu tab.

Best Practices

PDF
January 31, 2018

M3AAWG Recommendations for Preserving Investments in New Generic Top-Level Domains (gTLDs)

Over a thousand new generic Top-Level Domains (gTLDs) have been, or are in, the process of being created under ICANN’s new gTLD program.  This paper is written for current Registry operators and for companies interested in applying for new gTLDs, and outlines the risks and some relatively simple recommendations that can help correct these problems.

PDF
December 30, 2017

M3AAWG Recommendations for Senders Handling of Complaints

Email abuse rates can significantly affect a sender’s reputation and, consequently, its ability to deliver customers’ emails to the inbox. This paper explains some of the common processes senders can use to effectively manage and monitor email complaints and to help their customers, who are the list owners, develop healthy email practices that generate better results.
of email lists.

PDF
November 03, 2017

M3AAWG Recommendation on Web Form Signup Attacks

Many list web forms provoke an email confirmation to the subscriber's email address provided in the form but malicious entities are now using this feature to do bulk form submissions with forged addresses that flood the subscriber’s inbox. M3AAWG members collaborated across the industry to propose a header as an initial step that hosting and sending companies can implement to help protect against these attacks. The header allows receivers to identify floods of mail coming from sign-up forms that are bombarding victim mailboxes.

PDF
August 30, 2017

M3AAWG Best Practices for Managing SPF Records

This document covers best practices on how to properly construct and maintain an SPF record, common errors and some unintended consequences.  It is targeted at those with a basic understanding of the purpose and usage of SPF.

PDF
July 31, 2017

M3AAWG Best Practices for Implementing DKIM To Avoid Key Length Vulnerability, Revised July 2017

Due to disclosed vulnerabilities associated with the use of short DKIM keys, organizations should review their DKIM email authentication implementation based on these best practices updated in July 2017.  Also see a short video on this issue at the M3AAWG YouTube Channel (www.youtube.com/maawg).

Pages

Public Policy Comments

April 13, 2018

WHOIS Tiered Access and Accreditation Program

M3AAWG submitted these short comments to ICANN stating that an expert group from the Anti-Abuse community should be created to facilitate the certification of qualified applicants from the security field.

March 27, 2018

Engaging the FTC on Web Host Security Tips for Small Businesses

M3AAWG issued this joint letter with the i2Coaition to engage the FTC on web hosting security for small businesses.  The letter was sent to the U.S. Federal Trade Commission on March 26, 2018. 

March 09, 2018

M3AAWG Comments on Proposed Interim Calzone Model for Compliance with ICANN Agreements and Policies in Relation to the European Union's General Data Protection Regulation

M3AAWG provided comments on the proposed interim Calzone Model for ICANN agreements' compliance with the European Union's GDPR.

January 26, 2018

Proposed Interim Models for Compliance with ICANN Agreements and Policies in Relation to the EU's GDPR

M3AAWG provided comments on the ICANN report.  The filed comments also are available on the ICANN website at https://www.icann.org/resources/pages/gdpr-legal-analysis-2017-11-17-en

Pages

M3AAWG Reports

M3AAWG Email Metrics Report

November 14, 2014

First-Fourth Quarter 2012, First-Fourth Quarter 2013, First-Second Quarter 2014

January 01, 2012

First-Fourth Quarter 2011

March 22, 2011

Third and Fourth Quarter 2010

November 18, 2010

First and Second Quarter 2010

March 11, 2010

Third and Fourth Quarter 2009

Pages

DM3Z Blog

Messaging

Updates and Commentary from the Messaging, Malware and Mobile Anti-Abuse Working Group

[Author’s note: As I write this in October, the second massive denial of service attack in two weeks threatening to take down significant sections of the internet has just ended. Could full implementation of Operation Safety-Net have prevented this?

Over the past few years, the Pervasive Monitoring SIG within M3AAWG has worked to educate members and the community at large about better practices for message encryption and data privacy.  Messaging abuse, such as Man-in-the-Middle attacks, continues to threaten end-users and make confidential personal and business data more accessible to cybercriminals. After the revelations made by various whistleblowers around the world, we now know that we’re being watched at an ever-increasing rate, and even if we believe we’re innocent, our privacy could be violated without just cause. read more

Ongoing disclosures about the pervasive monitoring of email, voice and other network traffic remain an industry concern and major companies in the online ecosystem have been publicly identified as specific targets for non-consensual eavesdropping activity.  As a result, both the general public and various technical communities have a heightened interest in implementing measures that could protect operational security and customer privacy.

The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) supports the use of effective, end-to-end encryption. Mechanisms that intentionally compromise encryption put that effectiveness at risk. Therefore M3AAWG endorses the recommendations in the recent paper "Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications" written by 15 noted security experts.

Over the past year or so, messaging security and encryption has been increasingly in the spotlight.   We now send and receive more data over the Internet than ever before, yet until recently, email messages have been typically transmitted in clear text. This lack of encryption allows any interested party with just a little know-how and some basic equipment to potentially intercept the content therein: they can read personal information, bills, social media notices, birthday invitations, promotional material and even access pictures of loved ones or other sensitive attachments.  

Pages

News

Articles About M3AAWG

URL
November 13, 2017

Hackers Shut Down ProPublica’s Email For a Day. Here’s How to Stop Attacks Like That.

ProPublica's Julia Angwin augments her earlier "list bomb" article with information on what can be done to prevent these attacks. 

URL
November 09, 2017

How Journalists Fought Back Against Crippling Email Bombs

ProPublica journalist Julia Angwin describes how she and colleages were "list bombed" and talks about the growing problem, including a preventive strategy developed by M3AAWG.
 

Subscribe to Messaging Subscribe to News Releases