Whitelists Battle for Market Share

Everyone always talks about whether their e-mail will get through, but no one ever does anything about it — until recently.

At least two companies are selling access to “whitelists” that promise to get corporate e-mail delivered, bypassing the spam filters now used by Internet service providers (ISPs). Suddenly, this idea is making a breakthrough.

Habeas and Bonder Sender Duke It Out

The two most prominent whitelists are known as Habeas and Bonded Sender. These efforts have been in the works for years, but the market for these offerings got a kick start when Microsoft announcedon May 5 that its MSN Hotmail e-mail service will implement Bonded Sender to help it distinguish legitimate e-mail from spam.

Hotmail is a giant win because it’s one of the three largest e-mail services in the world. About 45 million subscribers have signed up for Hotmail in the U.S. alone, compared with 52 million Yahoo users and 40 million AOL users, according to a comScore Media Metrix study. So its selection of Bonded Sender is shaking things up in a big way.

With an average of 19 percentof legitimate, opt-in, business-to-consumer e-mail newsletters now being mistakenly filtered out as “junk” by ISPs, corporations are looking for ways to guarantee that their messages will be received. I examined both of the leading solutions to see which of them is the better bet.

Habeas Tries To Shepherd Your Mail

The Habeas system relies on a short string of words — a haiku — that’s embedded into each e-mail by senders of “opt-in” mailings. This string is invisible to recipients, but it can clearly by seen by e-mail servers in the “headers” that are used to route all messages across the Internet.

Habeas chose the haiku method because, as a short, copyrighted work, it allows the company to sue bulk e-mailers who use it without permission. A few errant souls actually have, in fact, been successfully suedby Habeas.

Relying on copyright and due process, however, has its limits. Because some hard-to-locate spammersare falsely using the haiku to sneak through filters, Habeas is putting more emphasis on a real-time whitelist of IP addresses that it maintains. The addresses of approved senders, who must agree to send only requested mail, are listed in this online roster of “good guys.”

In an interview in his Palo Alto, Calif., offices, Habeas CEO Des Cahill said the new 3.0 version of SpamAssassin — a popular antispam filter that’s due to be updated by late spring — will automatically test any message that claims to be Habeas-compliant.

If the IP address of the sender is found on the online whitelist, 8 points will be deducted from its spam score, helping it to pass through the filter. If, however, the address is on the “bad guy” IP list that Habeas also maintains, the message will get a whopping 16 points addedto its score. Since a score of 5 is usually enough for SpamAssassin to banish a message as “junk,” that’s a kiss of death.

Cahill says 30 different antispam software filters currently recognize Habeas’ approach and that the whitelist is consulted by such major regional ISPs as RoadRunner. Habeas claims that as many as 40% of the consumer inboxes that businesses usually mail to are affected by its system in some way.

But none of the Big Three e-mail providers — Hotmail, Yahoo, or AOL — have officially signed up. That leaves Habeas as something of a hit-or-miss proposition for corporations that rely on e-mail communications.

Bonded Sender Makes the Most of Its Hotmail Roots

Bonded Sender is operated by IronPort Systems, a maker of industrial-strength mail server appliances. A major competitor of Habeas, Bonded Sender requires bulk mail senders to post a cash bond worth several hundred to several thousand dollars, based on volume. Each sender is then required to keep complaints that reach Bonded Sender down to one per month per 1 million e-mails sent. Above that, and a $20 penalty is charged against the bond for each complainant.

One protest per million sounds microscopic. More than one person in a million, after all, probably complains about hearing voices in his head.

But Bonded Sender product manager Richard Dandliker says unfiltered e-mail, including spam, generates only 14 complaints per million (using the company’s particular methodology). Corporations that send e-mail only to people who want it can stay well below that number, he said. Only “15 to 20 penalties have been issued this year,” Dandliker says.

Before the Hotmail announcement, Bonded Sender’s IP address whitelist of reputable senders influenced only 6% to 8% of e-mail inboxes, IronPort Senior Vice President Tom Gillis said in an interview at his San Bruno, Calif., headquarters. But with the addition of Microsoft’s giant e-mail service, that number has suddenly shot up to 30%, he says.

Hotmail’s participation may not be so surprising, considering that its founders started IronPort after selling Hotmail to Microsoft in 1998. But now that Hotmail is officially on board, Bonded Sender plans to use the giant e-mail service’s stamp of approval as a wedge to sell Yahoo, AOL, and other ISPs on the idea, too, Gillis said.

That may not be easy. Unlike Hotmail, Yahoo and AOL have their own well-developed whitelist systems that have been sorting IP addresses into “good guys” and “bad guys” for several years.

But for now, Bonded Sender has enough momentum and market penetration that it just may be able to convince a big swath of the Internet e-mail establishment to join in.

Conclusion

In an ideal world, Internet standards bodies long ago would have worked out how to separate legitimate e-mail senders from the tsunami of spammers.

But lacking an official solution, private companies have taken on the task of building today’s “trusted party” lists — and charging to get on them. Until there’s a better way, Habeas and Bonded Sender will continue to expand wherever they can, and whichever company covers the most inboxes will win.