Vouch by Reference (VBR) is a protocol used in Internet mail systems for implementing sender certification by third-party entities. Independent certification providers vouch for the reputation of senders by verifying the domain name that is associated with transmitted electronic mail. VBR information can be used by a message transfer agent, a mail delivery agent or by an email client.
The protocol is intended to become a standard for email sender certification, and is described in RFC 5518.[1]
Contents |
A user of a VBR email certification service signs its messages using DomainKeys Identified Mail (DKIM) by including a VBR-Info field in the signed header. The sender may also use the Sender Policy Framework, but only the receiving MTA can reliably verify a domain name with this technique. The VBR-Info: header field contains the domain name that is certified, typically the responsible domain in a DKIM signature, the type of content in the message, and a list of domain names of services that the sender expects to vouch for the sender for that kind of content.
Using DKIM, an email receiver can verify that the message is properly signed, thus verifying the domain that is responsible for the message. It can verify, using the Domain Name System, that the vouching service actually vouches for that type of content for that domain. To do so, the receiver queries a TXT resource record for the name composed:
<domain.name>._vouch.<certifier.host.name>
The returned data, if any, is a space-delimited list of all the types that the service certifies, given as lowercase ASCII. The types defined are transaction, list, and all.
OpenDKIM and MDaemon by Alt-N Technologies have been among the first software implementations of VBR. OpenDKIM provides a milter as well as a standalone library. Roaring Penguin Software's CanIt anti-spam filter supports VBR as of version 7.0.8 released on 2010-11-09.[2]
Spamhaus has released The Spamhaus Whitelist[3] that includes a domain based whitelist, the DWL, where a domain name can be queried as, e.g., dwltest.com._vouch.dwl.spamhaus.org. Although the standard only specifies TXT resource records, following a long established DNSBL practice, Spamhaus has also assigned A resource records with values 127.0.2.0/24 for whitelist return codes. The possibility to query an address may allow easier deployment of existing code. However, their techfaq [4] recommends checking the domain (the value of the d= tag) of a valid DKIM-Signature by querying the corresponding TXT record, and their howto [5] gives details about inserting VBR-Info header fields in messages signed by whitelisted domains.