Home Best Practices

These best practices and papers represent the cooperative efforts of M3AAWG members to provide the industry with recommendations and background information to improve messaging security and protect users. M3AAWG best practices are updated as needed and new documents are added as they become available.

PDF
March 31, 2019

M3AAWG Best Common Practices for Mitigating Abuse of Web Messaging Systems, Version 1.1

Cyber criminals are increasingly turning to Web-based messaging systems to transmit their content. Yet, there are many techniques to prevent or mitigate these attacks and this document details the Best Common Practices for protecting these messaging systems.  This Version 1.1 has been updated additional suggestions for managing the collection, storage and indenxing of data, a new section on multifactor authentication and other changes.

PDF
March 31, 2019

Configuring Human Readable Delivery Status Notifications (DSN), updated 2019

A discussion on improving non-deliverability status notices to better identify abuse issues, this document has been updated with minor changes for clarity and to simplify the text.

PDF
February 17, 2019

M3AAWG Border Gateway Protocol (BGP) Flowspec Best Practices

Flow Specification (Flowspec) is a new type of Network Layer Reachability Information (NLRI) for the BGP routing protocol. It was originally developed to help mitigate DDoS attacks but its use has expanded to numerous other applications.

PDF
January 01, 2019

M3AAWG Position on Email Appending, Version 1.0.1

In marketing terms, “appending” – also known as "e-appending" or "e-pending" – is the practice of taking demographic information known (or assumed) to be related to a particular customer and matching it with other data. It is the position of M3AAWG that this is an abusive messaging practice.  The January 2019 Version 1.0.1 is updated to include the European Union's GDPR and CASL.

PDF
December 20, 2018

M3AAWG Best Current Practices for Reporting Phishing URLs

Phishing continues to be a significant problem for hosting companies, mailbox providers, brand owners and, of course, for every internet user. This document iinforms all of these groups on the best current practices for reporting phishing URLs.

Pages