But that will not fix spam. Spammers are smart, they will figure out a way around or through sender authentication schemes, and will find their way through the various sender accreditation and reputation schemes being bandied about the industry. They are also not very nice people, and in simple fact are criminals who are financially very motivated to practice the fine art of spamming.

Less well known is that ASTA went beyond sender authentication and made several important proposals for best practices that ISPs should follow in the fight against spam. These have a better shot at stemming the tide of unwanted junk e-mail than sender authentication -- much better, and they would work more quickly as well.

The most important one is the proposal to block Port 25, the tag that SMTP uses for sending unsecured e-mail from a server. When a home computer is turned into a spambot zombie by a viral attack, such as the Bagel virus, it sends a torrent of e-mail using Port 25. If that were blocked, the spam-bearing e-mail could not get out, but of course normal e-mail could not get out either. It would be a reasonably simple chore for ISPs to educate their customers to change their mail programs to use Port 587 for secure mail. ISPs are reluctant to do this because of this tech support requirement, but that seems a small price to pay in the interests of protecting the wider community from spam.

A simpler proposal is for ISPs to construct a tar pit that would notice torrential streams of e-mail and stop them cold, or at least slow them down long enough to ascertain whether the stream contains spam or legitimate e-mail. Plug-in appliance products exist that will do this, and it is beyond me why ISPs haven't taken advantage of them.

The bottom line here is that the ISPs can play a significant role in stemming the tide of spam without changing e-mail protocols and DNS records, something that sender authentication requires. And the practices that ASTA proposes for ISPs might actually help solve the biggest problem to plague the Internet since the first major virus attack hit 15 years ago.