OutlookPower: Aren't attachment filters, anti-virus filters, and better firewalls even more important than spam filtering?

Webb: These different security precautions are all important and often times work together to provide stronger user protection overall. Keep in mind that spam can also be a delivery mechanism for viruses or phisher scams that can pose serious threats to user security and privacy, so it is important for spam filters to continue to be used and improved to keep these kinds of messages from hitting user inboxes.

Phisher scams, if you are not familiar with the term, are emails and/or web pages created by spammers to deceive users into providing their credit card or bank account numbers, account password or other personal information. These scams often borrow the design of legitimate web pages and are advertised in spam, making claims such as "we have lost your account information, please click here to update it."

OutlookPower: Won't a system like Caller ID for Email cause all sorts of ISP problems? ISPs already have problems setting up simple reverse DNS lookups. Isn't enhanced DNS configuration on a mail-server by mail-server basis going to cause lots more confusion?

Webb: The industry at large recognizes that in order to be more effective, filters need additional information that is not available in email messages today. Some relatively simple, but system-wide changes to the email infrastructure are needed to provide greater certainty about the origin of an email message and enable legitimate senders to more clearly distinguish themselves from spammers. Microsoft has had a great response so far by companies interested in participating in the pilot program for the Caller ID for Email proposal, with Amazon.com, Brightmail, EarthLink, Sendmail and others already on board. Microsoft has published the technical specs for CSRI and Caller ID for public feedback at http://www.microsoft.com/spam because the company wants to get as broad of feedback on their proposals as possible, as part of their ongoing effort to work with other key email stakeholders to discuss new ideas and approaches to help put an end to spam. This kind of testing and feedback is essential as part of a natural and necessary evaluation process to quickly identify effective solutions.

OutlookPower: What sorts of authenticating bodies will there be for Caller ID for Email?

Webb: Right now, the industry is simply in a testing phase of the technology. However, as this technology moves forward, Microsoft does ultimately see this kind of authentication technology become something that a standards body like the IETF might institute and manage in the future.

OutlookPower: Is this another way that Microsoft and other large vendors will attempt to gain control of our IT process?

Webb: Quite the opposite, this is a way for customers to gain control of their own IT processes and inboxes.

OutlookPower: Won't certification fees and per-message fees block out smaller, legitimate high-volume mailers like Lockergnome, Slipstick, Woody's Watch and other high-value, lower-revenue content providers?

Webb: Microsoft's Coordinated Spam Reduction Initiative (or CSRI) proposal takes that very issue into account. CSRI is Microsoft's long range industry plan for dramatically reducing spam through technology based on three key proposals to better enable effective filtering:

1. Establishing verifiable identity in email through a caller-ID approach
2. Enabling high volume email senders to demonstrate their compliance with reasonable email policies (such as certification programs you mention)
3. Creating viable identification alternatives for smaller-scale email senders (such as proof-based mechanisms and other ideas outlined in the CSRI document)

I would encourage you to take a look at the CSRI spec itself at www.microsoft.com/spam or the more abbreviated overview document available at http://download.microsoft.com/download/2/3/7/23779C05-D409-46CE-B9D6-C24908789D8B/CSRIOverviewFS.doc.