NOTICE: Citizendium is still being set up on its newer server, treat as a beta for now; please see here for more.
Citizendium - a community developing a quality comprehensive compendium of knowledge, online and free. Click here to join and contribute—free
CZ thanks our previous donors. Donate here. Treasurer's Financial Report -- Thanks to our content contributors. --

Email challenge-response

From Citizendium
Jump to: navigation, search
This article is a stub and thus not approved.
Main Article
Related Articles  [?]
Bibliography  [?]
External Links  [?]
Citable Version  [?]
This editable Main Article is under development and not meant to be cited; by editing it you can help to improve it towards a future approved, citable version. These unapproved articles are subject to a disclaimer.
Due to technical limitations, this article uses an unusual title. It should be called  Email challenge/response.

Challenge/Response (C/R) is a method of filtering spam email.

The sender is asked to respond to a challenge, on the theory that only legitimate senders with important messages will respond.

C/R is controversial due to its potential for generating unwanted challenges to forged sender addresses.

The sender address may be:

1) A fictitious or invalid address.
2) An address of a real person, either
  a) the actual sender's address, or
  b) a forged address.

C/R is 100% effective in eliminating category 1. Category 2a is less than 100% effective identifying legitimate senders, because some will not respond to the challenge.

Category 2b is almost always an annoyance to the person whose address was forged. Many will report these challenges as "backscatter spam". Few will take action to avoid such backscatter.

Backscatter spam may be reduced by publishing an SPF record. Spammers generally avoid using return addresses that are protected by SPF.

A properly-designed C/R system will not send a challenge to an SPF-protected sender's address, unless that address passes the SPF check. In that case, a challenge to a forged address should be a welcome alert to its recipient, leading to correction of a problem on the recipient's side.