But there is one bigger problem with SPF. It’s an optional mechanism. i.e. There is no internet standard that says, a domain MUST configure SPF.

The popularity of SPF record fades away once we get past the Alexa top 1 million domains. So if we rely only on SPF record, then the solution may work for the 100th domain, but not gonna work for the 100 millionth domain.

Hot Gates Strategy

Whatever we did so far, just to have the content you are gonna see from this point forward. So pay strict attention.

Have you ever watched the Gerard Butler starred movie 300? If yes, let me ask you a question?

In that movie, King Leonidas and his soldiers battle against 300,000 persian soldiers, near a narrow pass called “Thermopylae aka. Hot Gates”.

My question is, Why Hot Gates? Why not battle in an open ground?

That’s because these spartans strength not only lies on their superior fighting skills, but also lies on their tactical advantage. Without “Hot Gates”, the whole battle would have been an instant massacre.

Challenge/Response mechanism is a weapon that should be used in a narrow battle like “Hot Gates”. But every C/R based spam solution out there, trying to use the C/R mechanism in an open ground battle. That is the main reason why C/R mechanism is flawed and not popular even though it got patented 20 years back.

Email is ubiquitous. You know what else is ubiquitous?

MX Records. They were introduced in 1986.

Let’s refresh our memories.

We classified the mails into three categories. Conversational Mails, Transactional Mails and Promotional Mails.

We offloaded Transactional Mails and Promotional Mails to Domboxes.

Users agree that they are gonna use the Mailboxes only for “Conversational Mails” when “Restricted Mode” is ON.

So… In “Injection” phase, we are dealing with only “Strangers”. Not just any strangers. We are talking about “Conversational Mail Strangers”. Context really matters here.

We already gave unrestricted access to websites and apps in Domboxes via “Isolation”. So, there is no such thing as “Transactional Mail Strangers” or “Promotional Mail Strangers” in our system.

The term “Conversational Mails” can be termed as MX-to-MX Mails.

e.g. When john@example.com sends an email to jane@gmail.com, Gmail.com MX record is queried and then mail will be transferred to one of the Gmail MX servers. When Jane reply to that mail, example.com MX record is queried and then mail will be transferred to one of the example.com MX servers. So Conversational Mails requires MX record on both sides.

So “MX Records” should be the “Hot Gates” of our Challenge/Response based email system. i.e. We actually diverted the spammers to the injection phase by Isolating and Restricting the genuine senders.

Our primary clue for verifying mail genuineness now is “MX Records”. Let’s verify these stranger mails.

MX Records

MX Records can be classified into two categories. Self-Hosted and Third-Party Hosted

Self-Hosted

When a mail coming from richard@piedpiper.com, we are gonna compare the “Incoming mail IP i.e. Client IP” address with the IP addresses extracted from the following records.

dig MX piedpiper.com (MX Records)

dig TXT piedpiper.com (SPF Record)

dig A piedpiper.com (A Record)

Third-Party Hosted

When MX server domain not ends with the same domain, then that domain will be considered as a third-party hosted domain.

In this case, piedpiper.com hosting their mails in Google servers.

So we are gonna compare the “Incoming mail IP i.e. Client IP” address with the IP addresses extracted from the following records.

dig MX piedpiper.com (MX Records Points to google.com)

dig TXT piedpiper.com (PiedPiper SPF Record)

dig TXT google.com (Google SPF Record — The base domain of MX host)

dig A piedpiper.com (A Record)

Strangers

We can classify the Strangers into two categories based on the MX Record check we performed in the last section.

Verified Strangers and Unverified Strangers

Verified Strangers

Challenge/Response mechanism applicable only for verified strangers.

An incoming mail from the “Verified Stranger” will be accepted, but it will be put in the “Pending” folder. This is a system folder and cannot be accessed by the user.

If we display “Pending” folder to the user, then it beats the purpose of the system since “Pending” folder is a replacement for “Spam” folder.

If the sender responded to the challenge correctly, then the mail will be moved to the user inbox. If the sender do not complete the challenge within 30 days, then the mail will be discarded.

Unverified Strangers

If the receiving domain is a Self-Hosted system (e.g. @domboxmail.com), then the mails will be rejected with the following error.

550 Restricted Box. Unauthorized and Unverified Sender. Please configure SPF or Send this mail from one of your MX server IP address

99.99% of the “Unverified Stranger” emails are from either spammers or probably the websites you didn’t want to isolate.

Genuine Senders rarely get caught here. If a genuine sender get caught here, then it’s actually their mistake. Put it this way, they have an address in America for incoming mails, but outgoing mails are originating from Japan. That’s abnormal since we are talking about “Conversational Mails” here.

Small businesses usually don’t go for such abnormal setup. Anyone who go for such abnormal setup probably doing that for better networking policies. These networking professionals most likely knew what is an SPF record.

Besides we are giving crystal clear error message when rejecting the mail.

550 Restricted Box. Unauthorized and Unverified Sender. Please configure SPF or Send this mail from one of your MX server IP address

This is how 550 error message look like on the sender side when the mail gets rejected.

If the mails are third-party hosted (e.g. @gmail.com), then the mails will be moved to Trash directly.

Domain Reputation

In Email 1.0, stranger reputation is tied to the IP address. Emails can be easily forged. If a spam mail says it’s coming from “president@whitehouse.gov”, we can’t just block the whole whitehouse.gov domain. We can only block or rate limit the IP address.

But In Email 2.0, only mails from “Verified Strangers” will be accepted. That means, mail is REALLY coming from the said domain since the domain is either whitelisted the IP address or mail received from one of their MX servers. So, stranger reputation not only tied to the IP address, but also tied to the domain.

So if you send spam mails via our “Injection Phase”, you are converting yourself from “Verified Stranger” to “Verified Spammer”. In such cases, we not only block your domain and IP address, but also build a block list similar to “Spamhaus Block List (SBL)” and then publish your domain and IP address there to help others.

Spam Filters

In our Injection Phase, we use Challenge/Response mechanisms like CAPTCHA. If you don’t want to annoy the sender, then you can stick with the typical Spam Filter.

Keep in mind, injection phase is all about “Verified Strangers” mails. So we use Spam Filter only for scanning “Verified Strangers” mails. Most Spammers are “Unverified Strangers”. So Email 2.0 with spam filter is much better than Email 1.0 with spam filter.

Email 2.0 + Spam Filter = Scan only Verified Mails. The sender owns the domain. So no Phishing or Spam since the owner take full responsibility.

We can also use “Domain Registration Date” to rate limit emails from “Verified Strangers”. i.e. If the domain is fresh, then we can respond with error message like “Your domain is a new domain and you have exceeded the daily limit. Please try again tomorrow or ask the recipient to whitelist your email address”

So Spam Filter based Email 2.0 is a three step process.

Step 1: Is the Sender is a “Unverified Stranger”? If yes, reject mail. Else proceed to next step.

Step 2: Is the domain is a fresh domain and daily limit exceeded? If yes, reject mail. Else proceed to next step.

Step 3: Scan the mail using Spam Filter.

Final Architecture

This is how Email 2.0 system architecture looks like.

White Paper

Whatever you have read so far is a heavily trimmed version of my 300 pages white paper and tries to offer only an overview of my system. My white paper solves many notable problems. Email Spam is one of them. So, There is more to it.

Please take a look at my white paper if you wanna understand my complete system. My white paper can answer the following questions.

What are the Box Types available? What are Dombox Layers? What is Mail Score? What is an Anomaly? What is Parallel Internet? What is a Portal? How Teleport Works? What are the Contract Terms? How Telescribe works? How Dombox works for Mailing Lists? How Dombox can prevent Phishing? How Dombox can help with Data Breach? How Dombox can help with Internet Privacy? What are the benefits of Dombox?

Download full white paper here.

Get Notified

My product is still a work in progress. And, I don’t have the ETA for release. But if you are Interested, I’m happy to notify you for the BETA once it is ready.

Please leave your email address here.

Notes & Links

Official Website: www.dombox.org

White Paper: Our white paper is a ~300 pages document that explains our Email 2.0 system from top to bottom.

For feedback and business enquiries, please send a mail to giri@dombox.org