Many email filtering vendors act as both inbound gateway and outbound gateway for their clients.  My interest is the outbound gateway role, because it inserts an intermediate organization between the message originator and my MX server.

The client configures the vendor's server into their SPF policy, and the vendor typically adds a DKIM signature as well,, ensuring that the message is dual-authenticated.  However, the dual authentication is only meaningful if the gateway vendor has authenticated sender identity on the message that it received.   If the gateway vendor has been duped into accepting a fraudulently identified message, then I am also a dupe if I accept the message as authenticated.

I have tried asking a few vendors how they authenticate messages that claim to be from their clients.   So far I have these results:

Favorable:

Silent:

Negative from observed messages:

These problems were detected by my content filtering product.   So far no other problematic vendors have been detected, and the volume of exploits is currently low, but I don't expect it to stay that way.

 

Do  you know specific vendors that have good techniques for client authentication, so that they cannot be duped?   Please post those to this message.

Do you know of other vendors that are vulnerable to duping?   Please reply with a Private Message.