Authentication Done Right
May 2006
|
E-mail authentication—clearly identifying, and thereby establishing accountability of an e-mail sender—has moved from the realm of sought-after ideal to executable reality. The implementation of authentication protocols like sender ID and Domain Key Identified Mail quickly is becoming a requirement if marketers expect their campaigns to reach customers’ inboxes. Internet service providers (ISPs) and other domains are checking for authentication, and in many cases penalizing those who are not compliant.
With these changing demands comes the added responsibility of correctly executing authentication. “If it’s done wrong, the consequences can be the same as not doing it at all,” says Dave Lewis, vice president of market development for e-mail infrastructure software provider StrongMail Systems. Lewis offers the following tips to help you optimize your authentication efforts.
• Audit and test your authentication execution. Do a complete inventory of all your different domains and subdomains, and make sure these domains are compliant. Lewis notes, “One of the easiest ways that [mailers] can check that the mail is being delivered is to make sure that the ISPs on the receiving end are responding back, saying yes, this record is properly authenticated.” Also, check your authentication records for syntax errors. Mistakes can cause your record to be rejected.
• Strike the right balance. Do not authenticate those servers and Internet protocol (IP) addresses that don’t send e-mail. “You’re subjecting your company to potential viruses and zombie attacks by over authenticating—authenticating IP addresses and servers that don’t send e-mail—which is the last thing you want to do,” says Lewis.
• Segregate your mailstreams by logical business units. Many companies have several different domains and subdomains sending e-mail. The downside to this, says Lewis, is the consumer’s inability to easily identify an e-mail as coming from you. It also increases the possibility of someone coming up with a look-alike domain and subjecting customers to phishing attacks. It’s best to establish fewer, but clearly recognizable domains from which you send your e-mail campaigns, segregated by brand. “If you’ve got several brands within your company, those brands can clearly have different identities and different reputations,” he adds. “You want them judged separately, so what is done in one doesn’t affect the other.” Having fewer domains will cut down on consumer confusion, as well.
• Collaborate with your IT department on an ongoing basis. “Authentication has to be done with a marketer’s perspective, and what they are trying to achieve in the marketplace in mind,” says Lewis. For that reason, it’s inadvisable to simply hand off the authentication process to IT and walk away. “Companies are continually changing their subdomains, adding IP addresses—it’s a very volatile, fluid type of environment,” he points out. “This is something you need to be auditing and looking at on an ongoing basis.” The success or failure of your e-mail marketing program is going to depend on how well you’ve executed your authentication process. “This is not an issue that the marketer can opt out of,” Lewis concludes.
With these changing demands comes the added responsibility of correctly executing authentication. “If it’s done wrong, the consequences can be the same as not doing it at all,” says Dave Lewis, vice president of market development for e-mail infrastructure software provider StrongMail Systems. Lewis offers the following tips to help you optimize your authentication efforts.
• Audit and test your authentication execution. Do a complete inventory of all your different domains and subdomains, and make sure these domains are compliant. Lewis notes, “One of the easiest ways that [mailers] can check that the mail is being delivered is to make sure that the ISPs on the receiving end are responding back, saying yes, this record is properly authenticated.” Also, check your authentication records for syntax errors. Mistakes can cause your record to be rejected.
• Strike the right balance. Do not authenticate those servers and Internet protocol (IP) addresses that don’t send e-mail. “You’re subjecting your company to potential viruses and zombie attacks by over authenticating—authenticating IP addresses and servers that don’t send e-mail—which is the last thing you want to do,” says Lewis.
• Segregate your mailstreams by logical business units. Many companies have several different domains and subdomains sending e-mail. The downside to this, says Lewis, is the consumer’s inability to easily identify an e-mail as coming from you. It also increases the possibility of someone coming up with a look-alike domain and subjecting customers to phishing attacks. It’s best to establish fewer, but clearly recognizable domains from which you send your e-mail campaigns, segregated by brand. “If you’ve got several brands within your company, those brands can clearly have different identities and different reputations,” he adds. “You want them judged separately, so what is done in one doesn’t affect the other.” Having fewer domains will cut down on consumer confusion, as well.
• Collaborate with your IT department on an ongoing basis. “Authentication has to be done with a marketer’s perspective, and what they are trying to achieve in the marketplace in mind,” says Lewis. For that reason, it’s inadvisable to simply hand off the authentication process to IT and walk away. “Companies are continually changing their subdomains, adding IP addresses—it’s a very volatile, fluid type of environment,” he points out. “This is something you need to be auditing and looking at on an ongoing basis.” The success or failure of your e-mail marketing program is going to depend on how well you’ve executed your authentication process. “This is not an issue that the marketer can opt out of,” Lewis concludes.
Companies Mentioned:
 |
|
Hitting the Email Inbox
The Ultimate Guide to Email Marketing