Just recently, a new industry consortium made up of email providers, financial institutions, social media properties and security providers put their heads together and came up with the DMARC (Domain based Message Authentication, Reporting and Conformance) specification.

With a goal of setting up a collaborative effort to help organizations recognize and fight spoofed emails, spam, and phishing attempts, this group is relying on the deployment of the Sender Policy Framework and DomainKeys Identified Mail to complement existing anti-spam solutions.

With industry leaders like Google, Microsoft, PayPal and Bank of America already signed on, along with 11 other companies, DMARC’s work is certain to make a splash in the IT world.

To better help IT departments understand what DMARC is trying to do, and better prepare them to make a decision regarding DMARC, let’s take a little time and refresh our memory on SPF and DKIM.

Sender Policy Framework

One of the major flaws in the Simple Mail Transfer Protocol is that is allows any computer to send an email using a forged email address. For example, anyone exploiting SMTP could send a spoofed email from their computer at home and make it look like it was coming from a bank.

To address this major flaw in SMTP’s security, the Sender Policy Framework was created in 2003 by Meng Weng Wong. Using special DNS records, the owner of a domain has the ability to specify which computers are allowed to send email messages with the sender address in the specific domain.

Should an unauthorized computer attempt to send a message from the domain in question the SMTP server rejects the sender and the unauthorized computer will receive a rejection message.

SPF is not without vulnerabilities though. Spoofing the mail header information such as From or Sender is not something that SPF helps to protect against. It is also open to what is known as a wide mask vulnerability where spammers specify a wide mask of valid server addresses in hope that spam from their botnets become SPF valid and pass through spam filters.

DomainKeys Identified Mail

DKIM came about by merging the DomainKeys and Identified Internet Mail standards with the purpose of associating a domain name to an email message through a digital signature that can be validated by the recipient.

The signer attaches the digital signature to the message being sent using a private key. A verifier that receives the message then relies on the public key to validate the legitimacy of the signature.

So if an email arrives in a person’s inbox from their bank, and their bank uses DKIM then they can feel confident that the message did in fact come from their bank.

If a spammer tries to send a phishing email to the same person and claims to be a representative of the same bank, the message will be rejected and quarantined by the server – never showing up to the intended recipient.

Flaws found in DKIM include the ability to forward a verified message with the content having been modified. Since SPF does not allow for this, it is common to see DKIM and SPF combined.

DKIM is also known to be resource intensive as a result of the cryptographic checksums that validate the digital signature.

SPF, DKIM and DMARC

According to DMARC.org, DKIM and SPF relate to their specification in the following ways:

DomainKeys Identified Mail (DKIM)

• DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication.
• DMARC uses DKIM results as one method (SPF being the other) for receivers to check email./li>

Sender Policy Framework (SPF)

• SPF provides a method for validating the envelope sender domain identity that is associated with a message through path-based authentication.
• DMARC uses SPF results as one method (DKIM being the other) for receivers to check email.

Using the DMARC specification, member organizations can rely on the collaborative efforts of the group to share resources so that spoofed emails can be easily spotted and the amount of resources used in the process can be reduced.

Additionally, they are calling for email senders to sign 100% of their outgoing messages to insure the validity of emails sent.

Get Ready for DMARC – A Review of SPF and DKIM

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Google recently hung a ‘going out of business’ sign on its Message Continuity service for users of Microsoft Exchange. Google will continue to provide the service to its users until their contracts run out, but after that, they’re on their own.

Since the service was launched a little over a year ago, “hundreds” of businesses have subscribed to the offering, which uses Google’s cloud to provide email continuity when a Microsoft Exchange environment is interrupted for any reason.

Hundreds of users, though, can’t compete with the “millions” of businesses that have moved their entire email operation to Google Apps, so Searchzilla has decided to scrap its continuity product for Exchange  and concentrate all its resources on its application suite.

Current users of the continuity product were “encouraged to consider using Google Apps as their primary messaging and collaboration platform” in a company blog written by Vice President of Product Management Dave Girouard.

The brusque departure by Google from the Exchange disaster recovery scene contrasts sharply with how it entered it:

“Google Message Continuity advances our commitment to providing rapidly deployed, cost-effective email management solutions for organizations of all sizes,” Enterprise Product Manager Matthew O’Connor wrote when the continuity product was announced.

Looking back on the announcement, it appears that Google’s “commitment” to the Exchange market was as solid as an adolescent’s commitment to the latest fad.

That’s not to say that Google’s intentions in offering an Exchange product weren’t clear from the start for careful readers of the company’s pronouncements. “Additionally, for organizations interested in eventually moving to Google Apps, Google Message Continuity can provide a smooth bridge to the cloud,” O’Connor slyly observed in his blog item.

O’Connor’s colleague, Rajen Sheth, the group product manager for Google Apps had a similar pitch at the time:

“Google Message Continuity can also help organizations transition to Google Apps down the road,” he wrote. “Since Microsoft Exchange and Gmail are always in sync with one another, there’s no need to migrate email data when eventually deploying Google Apps.”

Little did those who signed on for Google’s continuity solution realize when they did so that if they didn’t “transition” to Google Apps fast enough to suit the Ferret King, they’d be left looking for another business interruption solution within a year’s time.

Google has been criticized in the past for its flighty attitude toward product development. Some detractors maintain that Google often enters markets to be disruptive, not competitive. Like a sea gull boss, it will undercut competitors in a market and when things don’t work, abandon that market, leaving customers who had faith in the Google brand to clean up the mess.

That kind of product management may work with consumers, but it leaves something to be desired in the business world. Google’s competitor in the enterprise market, Microsoft, knows that. While the Redmond crew have suffered a few slings and arrows for sticking with products too long, their commitment to legacy products has been an important, if sometimes overlooked, part of their success in the business market.

Google’s forsaking of Message Continuity brings to mind some remarks by Microsoft Senior Director of Online Services Tom Rizzo in his famous “Google Graveyard Spooks Customers” blog written on Halloween last year:

“Google releases experimental products and tracks adoption to determine whether to continue providing them,” he wrote. “Its products are like spaghetti, Google throws them up against the wall to see if they stick.”

“The burials of de-supported products are more examples of what is convenient for Google and not good for business,” he added.

Google Deserts Exchange Users by Killing Message Continuity

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Estimates show Twitter to have over 300 million users. Facebook is close to 1 billion and Google+ keeps growing every day.

Add to the mix all of the smaller, niche social networks and those numbers continue to climb.

Take into account that all of these platforms offer some type of messaging client you can see why some people can so confidently make the claim that email is dead.

But despite the popularity of instant messaging through social networks, text messages and Tweets, email remains a powerful force. Powerful enough that VisibleGains, a video marketing company, confidently makes the claim that email is here to stay in a recent infographic that they created.

Talking the Talk and Walking the Walk

So Facebook has 750,000,000 friends chatting back and forth over walls and instant messages to the tune of 60,000,000 every day, and Twitter boasts 300,000,000 users sending out communiqués via 140 character blurbs 140,000,000 times every day.

And as for email? Email can stake a claim of 2,900,000,000 accounts sending upwards of 188,000,000,000 messages every day. That’s right, there are three times more email accounts than there are Facebook accounts.

Numbers too big to wrap your head around? Let’s look at these figures on a more personal level:

• The average number of Twitter updates for each account is .47 a day
• Facebook accounts average .08 updates in a 24 hour period
• The average email user sends 64.8 messages per day.

So not only are there more email accounts, but the use of these accounts far outshines the use Twitter and Facebook. In reality, the comparative use numbers aren’t even close enough to present any meaningful threat at this point.

But the big social networks are growing at such a rapid pace that it won’t be too long before one of them passes up email as the primary means of online communication, right?

Not so fast. While no one can argue that using social media for communication is booming, email is still growing as well. In fact, the number of email messages sent in 2010 was up 19% from 2009.

And as for spam taking up a large percentage of email messages, that is something that should definitely be taken into account. Spam does skew the numbers a bit, but considering spam sent via email is at an all time low as scammers and online criminals focus more on deploying spam over the various social channels, this argument may just reinforce the claim that email use is more alive and well than ever before.

Moving Forward

According to their inforgraphic, VisibleGains makes the claim that by the year 2014 there will be 3.8 billion email accounts worldwide and close to half of them, 47%, will be located in Asia and the Pacific.

But when we talk about the future of email, those who will be using it in the future should be consulted shouldn’t they? After all, teens detest email right? To them text speak and Facebook pokes are much more meaningful methods of communication than a long, drawn out email. At least that is what some will have you believe.

Yet when teenagers were asked the question, “will email live on?” only 15% believe that email is dead. 41% didn’t know (or didn’t care) but 44% agreed that email will in fact live on.

Analyzing the Numbers

Even with so many different options for communication out there that are much easier to use, email remains supreme because it is viewed as a professional medium; and in the world of business, projecting a professional image still trumps ease of use.

Yet one aspect of business may be the one thing that moves social communication closer to emails numbers, and that is marketing.

As filters effectively separate junk marketing emails from the inbox the social platforms become more attractive to marketers. Spreading their messages over these networks has increased tremendously over the years and looks to continue to expand as search engine algorithms make social metrics more and more important to their results. Even still, email still has little to worry about.

Should We Say Goodbye To Email?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Back in October of 2009 the City of Los Angeles voted unanimously to outsource their email services to Google. While many other organizations have made similar moves, this move made Los Angeles the largest city in the United States to hand over its messaging services to Google, Inc.

For $7.2 million, all 30,000 city employees would be turning to the cloud for email.

This was a huge win for Google because not only did they beat out their rival, Microsoft, but a successful implementation would easily pave the way for future business with local governments.

Fast forward two years and one Los Angeles city councilman is asking why nearly half of the 30,000 employees haven’t yet moved to the new Google Mail system.

The answer is Google has “been unable to meet the security requirements of the city and LAPD for all data and information.”

Basically, there have been legal obstacles concerning whether or not Google can house law enforcement data, such as criminal histories and data related to investigations, on its servers.

Shame on Google?

From an outsider’s point of view, it looks as if Google is to blame for this catastrophe.

Especially when news stories lead in with headlines like, “Google ‘unable to meet’ security needs of city email.”

However Google isn’t exactly at fault here. They claim that working with the regulations surrounding municipalities, “is so new that the legal requirements around data protection are still evolving — and that some of those regulations came to light only after the contract was signed in late 2009.”

Instead of making the jump, the LAPD and other agencies have remained on their older email system using Novell’s email software with Google footing the bill.

But costs aren’t the only thing at stake. Using two different email systems has caused headaches and productivity problems for city employees, especially the IT department.

Who is to blame?

In all actuality, it is the Los Angeles City Council who is at fault here.

Google provides a product. When a customer wants to use that product, they have to do their research.

Most likely, the question arose at some point, “will our information be secure with you?” And most likely Google answered yes.

But that can’t be sufficient. When you are talking to a salesperson, you need to understand that A) the nature of their job is to sell you a product and B) their legal knowledge will not be on the same level as that of a lawyer’s. Before the vote even came before the city council a thorough review of the product and its adherence to federal, state and local regulations should have been completed by the legal team for the city or an outside agency. End of story.

Best practices

There are plenty of news articles floating around in cyber space about how a school district or government agency dropped the ball when making a huge technology purchase.

A simple search of Google Apps for Government + regulations in the time period of October 2007 to October 2009 returns quite a few results about how Google is ramping up its offerings for government agencies. There are even some pretty high profile publications that covered what Google is doing to get ready for what it hoped would be a wave of government clients.

But if you go past the first few pages of the search results you start to see a different picture. Many more results caution users who need to adhere to specific regulations to stay away from cloud based providers for certain services. Email being one of them.

Of course quite a bit has changed since 2009, and Google has gone a long way to make sure that their products are certified under FISMA (The Federal Information Security Management Act of 2002) so that the federal government regulations that govern email are met.

And while Los Angeles still sorts out its email mess, other municipalities and agencies continue to move email services to the cloud. Some of them successful, some of them plagued by problems.

However one thing that hasn’t changed is that organizations will continue to sign large contract for products and services without getting the whole picture ahead of time.

For Los Angeles, Not Every Cloud Has A Silver Lining

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

It seems like everywhere you go the topic of Google+ vs. Facebook hits you smack in the face. No pun intended.

Much of this debate stems from the reliance of so many people using social tools as their primary method of communication and content curation.

This trend is so popular, in fact, that many people have predicted that social channels will replace email as the primary means of communication.

But before we all make a mad rush to dump our inboxes for Twitter, a new study from the Pew Research Center shows that email is still one of the most popular activities on the Internet.

A look at the numbers

In 2002, when Pew began their yearly study of Internet use, only 49 percent of all people used email daily. In 2011, that number has ballooned to 65 percent.

While it is easy to make the case that the number of people online has grown exponentially in the past nine years as well, that doesn’t easily explain why email use has grown so much.

After all, the methods of communication have grown at a far greater rate than the number of people online in the same time period.

Let’s look at 2002. At that time people communicated through email, chat, instant messaging and forums. There were early adopters of other technologies that we will look at in a minute but for the most part, the majority of communication was done over these mediums.

Now in 2011 there is still email, instant messaging and some forum use. Chat has slowed down to a crawl, but it has been replaced by text messaging, social networks, Twitter (and other micro blogging services) and blog commenting.

So with the pool of communication tools widened, why is it that email is still so popular? Scratch that, why is it that email use continues to grow?

A look at the landscape

Over the years, business communication has changed. Your co-workers are no longer down the hall or a cubicle away. Companies have offices all over the world. Remote workers, consultants and freelancers are often called upon to fill voids in the corporate structure to bring in additional support or save money.

Work is also outsourced on a much more frequent basis to people an ocean away from your headquarters.

While businesses have been quick to adopt the strategies mentioned above, they are still slow to consider social media as a viable business tool. The impressions that most decision makers have is that social tools are toys that high school and college aged kids use to wreck their future career opportunities. They are seen as another distraction; a way for employees to waste time and cut back on productivity.

To keep people on task, and prevent too much information from getting out, social communication tools are often banned in the workplace. So the employee is faced with two options.

1. Skirt the rules and bypass content filtering tools to use social media at work.
2. Use the tools that are in place for effective communication, email.

Another look at the statistics

It is commonly thought that the younger workforce goes with option 1 from above. Tech savvy enough to get around any blocks combined with a youthful arrogance often makes IT and management keep an eye out for any policy breaches.

Surprisingly, those aged 19 to 29 were at the top of the list when it came to daily email use. 64 percent reported using email once a day while 30 to 49 year olds came in at 63 percent.

Income also seemed to play a big role in how often you used email. Households that report income over $75,000 a year claim to access their email on a daily basis at 78 percent followed by 67 percent of people who make between $50,000 to $74,999 per year. Those making less than $30,000 per year have the lowest percentage of daily email use at 47 percent.

What do all these numbers mean?

As email administrators, our jobs are still valued.

But that also means that the responsibility of maintaining the availability of email communication across your organization is more important than ever, and as email use continues to rise so will the expectations placed on us.

Email is Still Most Popular

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Exchange administrators are probably quite familiar with management pressure or subtle ‘suggestions’ to migrate for a cloud-based email service, typically epitomized in the form of Google Apps.  As someone who believes in utilizing the best tool for the job, I am of the opinion that there are businesses and organizations that will certainly benefit from shifting to a cloud-hosted email service.  However, some companies might be opting for Google Apps due to what they hear about its supposed reliability and affordability, but neglecting to perform a factual evaluation.

While some might argue that a comparison of Microsoft Exchange with Google Apps is like trying to compare apples to oranges, there are fundamental similarities in an email service that we can use as a benchmark.

• Reliability

Most readers must have heard of the Gmail Crash that took place on the last weekend of February.  Triggered by an unexpected bug, I suppose it put rest to the idea that cloud-hosted services are infallible.  This incident confirms my personal opinion that a comparison of the system reliability and uptime is only meaningful up to a certain number of 9s, due to an inherent chaos (or Murphy’s Law) that cannot be anticipated.  When seen from this angle, a properly maintained Exchange Server is equivalent to a well-run cloud service, which brings me to the next point.

• Maintenance

A typical on-premise version of Microsoft Exchange requires regular maintenance in the form of software updates and checks to ensure that system readings are within expected parameters.  As you can imagine, smaller businesses could find these tasks a hassle compared to the hands-off nature of a service like Google Apps.  Microsoft is not oblivious to the likelihood of businesses without dedicated administrators ditching Exchange Server however, and now offers the option of Hosted Exchange for businesses that wants the capabilities of Exchange Server without its maintenance overheads.

• Data Backup

Despite the severity of the data corruption bug, Google has pretty much proven that it has a robust off-site backup regime that works.  Of course, this has not stopped a rash of hitherto unknown companies from coming forward to offer various data backup solutions in the wake of the incident, capitalizing on the desires of users and administrators who want more control over their archived data.  This is where Microsoft Exchange wins hands down in terms of management and access to archived email messages.  In contrast, some affected Gmail users were left in the dark for up to four days as Google scrambled to recover and restore from data backups.

• Spam Filtering and Anti-Malware Protection

When it comes to spam filtering, there is no doubt that Gmail incorporates an exceptionally good spam engine.  In addition, users can create their own filters to trash email messages based on custom parameters.  Exchange does offer the ability to install complex server-side filters too; though my personal experience pegs its default spam capabilities as being the weaker of the two.  However, Exchange Server when set up on-premise does offer far greater flexibility when it comes to deploying third party tools, such as using GFI’s MailEssentials for spam filtering and Microsoft’s Forefront Protection 2010 for Exchange Server for a comprehensive security suite.

• Usability

I’ve personally found Google’s Gmail interface to load rather briskly.  In addition, I am generally able to perform better searches via the Gmail search box than in Microsoft Outlook.  Ultimately however, I’ve found that I’m much more productive via Outlook 2010 with its threaded email view and ability to connect simultaneously to multiple Exchange Servers.  Similarly, administrators should also be cognizant that existing users might resist any changes from what they are comfortable with, be it Microsoft Outlook or the Outlook Web App.

• Integration

Some of the business-centric capabilities touted by Google Apps for Business would be BlackBerry and Microsoft Outlook interoperability.  While Google has done an excellent job in creating tools that bridge between its cloud-based systems and end-user software such as Microsoft Outlook, administrators must remember that these tools do not necessarily work perfectly.  Moreover, some of the support is achieved by additional software that must be installed on client-side devices (BlackBerry smartphone support).  I last looked into switching from my Exchange environment to Google Apps late last year, but I was forced to discard the idea after research showed complaints about the presence of software bugs as well as user dissatisfaction on some fronts.

Feel free to chip in below if you have any other comments.

Comparing Microsoft Exchange with Google Apps for Email

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

A flawed storage software update over at Google triggered an unexpected bug over the weekend.  This resulted in data corruption that affected tens of thousands of Gmail accounts, with some users missing old messages or finding their account emptied of all emails, while others have been left unable to log into their mailboxes.

Google was quick to point out that affected users account for a mere 0.02% of its user base even as it launched into the task of restoring affected accounts. At the time of writing this article however, the problems with Gmail have been persisting for some users into the fourth day with no definite timeframe for a final resolution.

Confident of its cloud architecture and sophisticated software systems, Google has recent modified its SLA (Service Level Agreement) to remove provision for planned downtime.  Beyond being an obvious slap in the face for one of the largest email providers in the world, what are some lessons that email administrators can learn from this debacle?

The Value of Offline Backups

Storage technology has advanced tremendously over the years; and not just in terms of raw storage capacity either.  Today, it is possible to purchase business-grade Network Attached Storage (NAS) appliances with advanced capabilities found only in expensive Storage Area Network (SAN) in the past.  Basic RAID and array rebuilding features aside, many NAS have also started to sport appliance-level replication functionality for data backups across geographical locations; some models are even certified for use with Microsoft Exchange.

These various developments might have given some email administrator a false sense of security where data survivability is concerned.  As is demonstrated by the ongoing Gmail outage however, multiple copies over multiple locations are no defense against the insidious threat of data corruption, and no help against malicious sabotage for that matter.  Compliance aside, there is tremendous sense in maintaining offline data backups as a hedge against the scenarios highlighted above, and businesses should not dismiss tape backup or other offline backup systems without due consideration.

Incidentally, I had the opportunity to speak with Business Unit Manager Simon Anderson from Tandberg Data in a phone interview in January, who told me that Google consumes some 50,000 LTO (Linear Tape-Open) tape cartridges every quarter.  You see, even Google Inc., widely acknowledged as operating the most number of servers in the world recognizes the importance of offline backups.

The Complexity of the Cloud

The other lesson that can be gained from this outage is how the scale and redundancy afforded by cloud computing does not automatically render it immune to bugs and problems.  A fully redundant or large-scale Exchange deployment can get pretty complex too, yet the inherent complexity of cloud computing does ironically render the time required for problem rectification especially opaque to businesses.

Now, I would be the first to acknowledge that Google has been most studious in updating the Apps Status Dashboard, and has also been candid about the root cause of the outage.  But while businesses with an on-premise Exchange mail server are unlikely to have anywhere near the tremendous amount of resources at Google’s disposal, senior executives of these businesses will at least be far more aware of the exact bottlenecks to full system recovery.  Compared to the situation with cloud service providers, an in-house team is uniquely positioned to furnish the pertinent information that executives can use to decide on what steps to take next.  Finally, even a mid-sized Exchange Server reinstalled from scratch by a competent team is unlikely to take four days, to put it bluntly.

Have a Business Continuity Plan for your E-mail

Assurances offered by Ben Treynor, VP Engineering and Site Reliability on the official Gmail Blog indicate that the data of affected users is perfectly safe.  However, this is probably of little or no consolation for users still affected by the outage, or businesses that found their operations disrupted by the outage.

Thankfully, the structure of the Internet means that it is possible to engineer business continuity into the email infrastructure via the backup MX record.  I spoke about this in 4 Ways to Supercharge your Exchange Server using the MX record, though some downsides do exist as highlighted by reader Richard Parvass.  My key point today though, is that businesses that host their e-mail servers in the cloud can and should put together business continuity failbacks in the event of a catastrophic or prolonged outage.

The Big Gmail Crash and the Lesson for Email Administrators

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Google two weeks ago announced that it has changed its SLA (Service Level Agreement) for paid versions of its Google Apps suite of products, removing provisions for planned downtime.  The goal, says Google Enterprise product management director Matt Glotzbach, is to deliver service that’s as reliable as telephone dial tone.

Understandably some observers see this as a war of “nines,” since the move pits the strengths of its cloud-based architecture against conventional on-premise deployments.  Detractors might also argue that Google hasn’t always been completely honest where its definition of uptime is concerned, since outages lasting below 10 minutes were simply ignored in the past.  Of course, the recent changes in Google’ SLA now counts intermittent downtime towards the total used to determine the credit customers are entitled to.

Regardless, email administrators are probably left a little worried, understandable since Google’s self-sufficient Gmail email service is part of Google Apps, and which relegates the administrator to simple tasks such as creating user accounts and assigning passwords.  While I’ve previously written about Some Reasons for an On-Premise Deployment of Exchange Server, I wanted to specifically write about why Microsoft Exchange is unlikely to go away anytime soon.

Superior usability

Gmail and Google Calendar have been greatly enhanced over the years.  In fact, Google Calendar now comes with the ability to share “Free/Easy” information, and can handle multiple calendars.  Overall usability still trails that of the desktop based Microsoft Outlook 2010 however, which sports a host of additional capabilities including the ability to access multiple email accounts, send meeting requests, and the laxity to import (or export) PST folders.  And while Google has added offline capability to aspects of its Google Apps, it pales in comparison to the completely seamless offline ability in Microsoft Outlook.

Uncertain legal jurisdiction

The legal jurisdiction for businesses operating across different countries will find that the legal situation is relatively ambiguous where a hosted service like Gmail is concerned.  In fact, Google’s Eric Schmidt, who recently stepped aside as CEO (but will remain as executive chairman), has said that the company and the search engine information that it indexes is subject to the United States Patriot Act and “it is possible that all that information could be made available to the authorities.”

As you can imagine, the conditions under which Google will reveal one’s email data is unclear, as is whether the company will inform the legitimate account holder prior to enabling access to third parties.  In comparison, an on-premise deployment eliminates the opportunity for surreptitious email snooping.

Unequal comparison of downtime

To support its assertion of Gmail’s superior uptime, Google supplied research figures from The Radicati Group that shows the company’s Gmail having zero planned downtime and a very low number of unplanned downtime in 2010.  An entry on the Official Google Enterprise blog hence noted that “Gmail is 32 times more reliable than the average email system, and 46 times more available than Microsoft Exchange.”

Such an assertion is not accurate however.  Because businesses will only schedule downtime late in the night or early in the morning, it hence follows that planned downtime do not affect user productivity and is not a very useful gauge in that regard.  In addition, the figures only measure Gmail’s uptime without considering the ability of users to connect to the service, while downtime in the context of Microsoft Exchange typically includes all factors.  And of course, the fact that Gmail doesn’t offer equivalent features makes it an unequal comparison in the first place.

Unequal reliability

In order to appeal to businesses more, Google have added support for Exchange-like sync with Outlook, as well as mobile devices via Exchange ActiveSync and support for BlackBerry smartphones.  While the various components mentioned above are touted as offering comparable functionality, actual user experience actually varies.

For one, it must be noted that Google has not actually implemented many of the control capabilities inherent to Exchange ActiveSync, which leaves businesses with restricted options in the management and securing of mobile devices.  In addition, the use of plug-ins in order to sync with Outlook results in gaps in terms of stability and deployment – users are burdened with configuration overhead that Exchange does not require.  In fact, a search of various online forums reveals bugs and synchronization problems that have resulted in unhappy users.

The substantial advantages highlighted above means that Microsoft Exchange and email administrators will not be going away soon.  However, the terms of the new SLA from Google does mean that CIOs and IT managers will invariably come under increased pressure to increase their uptime.  On that front, I shall be exploring technologies and deployments geared towards helping businesses attain a high level of uptime next week.

Why Email Administrators need not worry about Google’s new SLA

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Downtime in minutes in major email programs.

Google would like to replace Exchange as the primary email platform in corporate America but, as the song goes, you can’t always get what you want. So the search giant has adopted a backdoor approach to grabbing business from Exchange users. It has launched a service aimed at those users that offers to backup their email to Google’s cloud.

The service, Google Message Continuity, will back up Exchange mailboxes for an annual fee of $25 per user. Only Exchange 2003 and 2007 are supported now, but a version for Exchange 2010 is in the wings.

Google Message Continuity works like this.

Accounts on an Exchange server–including email, calendar and contacts–are mirrored on Google’s Gmail servers. If the Exchange server’s operation is interrupted for any reason–a breakdown, for instance, or scheduled maintenance–users can log on to Gmail, using their Exchange username and password, and continue to send and receive email. Since both systems will be synchronized, users can switch between the two without a hiccup.

While others offer similar Exchange solutions, Google believes it has a leg up on them because its size allows it to more aggressively price its service and it’s better equipped to take advantage of Gmail’s architecture for providing a seamless solution. In addition, Exchange’s openness makes it easy to plug something like the service’s synchronization server into it. In fact, IT pros should be able to integrate the service through an Exchange plug-in that can be installed without any outside support.

Google has been taking potshots at other email solutions for years. As far back as 2008, it boasted of its 99.9 percent reliability rate. That amounts to 10-15 minutes a month. “That 10-15 minutes per month average represents small delays of a couple of seconds here and there,” it asserts.

Citing research from the Radicati Group, Google says companies with on-premise email solutions averaged 30-60 minutes a month in unscheduled downtime and an additional 36-90 minutes a month in planned downtime.

“Looking just at the unplanned outages that catch IT staffs by surprise, these results suggest Gmail is twice as reliable as a Novell GroupWise solution, and four times more reliable than a Microsoft Exchange-based solution that companies must maintain themselves,” it notes.

“Gmail’s reliability jumps to more than four times as reliable as a GroupWise solution and 10 times more reliable than an Exchange-based solution if you factor in the planned outages inherent in on-premises messaging platforms,” it adds.

And of course, there’s the bottom line card. Email downtime can cost a company with 500 employees as much as $90,000 a year.

As good a game as Google talks, there’s plenty to give administrators pause about turning over control of their precious data to the company. Security transparency, for instance, is a concern. Technical support is another friction point. Bragging about how easy your apps are to use is one thing; responding to problems in a timely fashion when they’re being used is quite another.

Of course, Microsoft has its own cloud that it has invested quite a bit of money in. Its 23 data centers, built at a cost of $500 million each, are located around the world to offset any disasters that might occur at a particular locale. Administrators concerned about the performance of their local versions of Exchange, could take advantage of Microsoft’s Exchange in the cloud offering. Because that service creates multiple copies of a user’s data, email downtime is practically zero.

Nevertheless, Google’s move to wean enterprises away from Exchange by giving them a taste of Gmail through a backup solution can be a clever move. It gives Google a chance to prove itself to Exchange users and accumulate street cred with them. Once an organization becomes comfortable with Google as a partner, it might consider giving the search firm a bigger piece of its email pie or deserting Exchange all together.

In recent weeks, Google has perked up its efforts to woo Microsoft corporate customers to the search firm’s cloud. Last month, for instance, it announced a test version of Google Cloud Connect , which allows Microsoft Office 2003, 2007 and 2010 users to sync their documents with Google’s cloud apps from within the Microsoft suite. Once in Google apps, documents can be shared and even simultaneously edited without leaving Office.

Google’s maneuvers may bear some fruit, but it’s tough to change the mindset of administrators. What’s more, Microsoft won’t be standing on the sidelines watching the game that Google’s playing. It’s prepared to do what it takes to preserve its Exchange turf.

Google offers backup service for Exchange

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The release of Google Buzz adds another new step in the ongoing evolution of online communication.  And I hope you’ve been paying attention to the evolution so far.

Buzz, along with Google’s other recent release Google Wave, add real-time communication to traditional email inboxes in ways that, quite frankly, most people will fail to grasp for some time yet.

These new Google releases are part of a long running change in the consumer side of online communications.  Looking back 10 years the average web user had email, newsgroups, and basic instant messaging, all performed on their computers.

Today we have blended platforms such as Facebook that include email-style messaging, real time chat, and broadcast communications such as status updates.  In addition to this more and more content is shared in non-text formats.  Photos and videos are exchanged between friends as often as written messages are.  Business deals are done on Twitter.  And no one ever complained that a sales pitch was too short.

Business communications are charting a similar, but slower evolution.  Email quickly replaced much of our phone and fax communications and became a collaborative workspace, albeit a highly inefficient one.

In recent years collaboration has moved out of the inbox and into document management systems and intranet workspaces.  Faxes go directly to electronic records management systems instead of being dropped on our desk.  And telephony systems are integrating with our real-time communications servers to make voicemail and presence data available to us at our desks or on our mobile devices.Email once made long distance business possible without great expense.  Email put customers within reach of sales people without having to endure the cost and inconvenience of long distance travel.  Now with computing power and bandwidth both inexpensive commodities the long distance face to face meeting has arrived in the form of video conferencing.

Email is fast becoming a time sink, the preferred communications medium of the old guard but too slow and cumbersome for the next generation of business leaders currently learning how to communicate quickly and easily online.

As we roll out the latest enterprise email servers with their amazing new features are we simply delaying the inevitable?  At some point will the generational weight of the workplace tip in favour of those who prefer fast, efficient communications?

At what point will the role of the email server shrink to merely being the place where meeting invites and document workflow alerts are sent?  Will the email administrator disappear?  Or will they evolve into the communications administrator, overseeing the voice, instant messaging, conferencing, and collaboration systems instead?

Will this evolution simplify and improve our business communications?  Or will it add complexity that requires a class of expert not common in today’s industry?  Maybe that complexity will keep us with the systems we use and understand today, at least for a little longer.

On the bright side, at least I’ve never been in a video conference that got interrupted by spam.

What Will Email Be In 10 Years?

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

The City of Los Angeles has proposed using Google Apps for messaging and collaboration. Naturally, the bean-counters in the city office are all agog about the prospect of saving some money, which, during the recession, has taken front row at city council meetings all across the country. Not to put too fine a point on it, cities are going broke, and having to cut back wherever they can–and in some cases, where they shouldn’t.

Fortunately, there are a few dissenting voices in the crowd. Using Google for email may well have its place, but that place isn’t in organizations that are required to provide any degree of security and privacy. The World Privacy Forum expressed some legitimate concerns that transferring city records to a cloud-based provider could violate privacy rights, and possibly even state or federal laws.

The LAPD has also expressed some worry over the deal, and rightfully so, publicly stating that it is concerned about having police records stored on external computers. It’s still possible that even if the city does go ahead with the deal, the police department will opt out.

Granted, the deal will save the city a bundle. The contract would save $6.25 million over five years in licensing fees that would otherwise go to Microsoft and Novell, and that’s not chump change in a state that issues IOUs instead of paying its bills.

According to recent reports, security analysts have found some serious and legitimate reasons to question the move. For one, there will be no external standards for security; rather, security will be defined by Google itself, a practice which really provides for no accountability at all.

Google Apps does provide for some security, including single sign-on, but nothing is foolproof, and putting email in the cloud may just be asking for trouble.

LA proposes using Google Apps, security worries abound

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Email operations and email archiving needs to have safe and secure protocols in place, especially if the corporation is under the purview of a privacy-related piece of legislation, such as HIPAA or Sarbanes-Oxley. Generally, the best way to ensure that those privacy protocols are put in place is to avoid cloud-based email and storage services.

Google continues to try to get a seat at the enterprise with Gmail, and this week, some of the industry’s heavy-hitters took Google to the task over the issue. An open letter to Google’s CEO Eric Schmidt says the company is putting users at risk unnecessarily, and that encryption should be enabled by default on their web-based apps, including Gmail.

Currently, SSL is used only during login, after which, all browsing is unencrypted, unless the user takes an active step to return to the https protocol. Unless that step is taken, which most users will not do, the user is vulnerable to attack and theft. In most cases then, Gmail is run in the clear–which is completely unsuitable for corporate use.

Google should encrypt the cloud

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Google released a synchronization tool this week that allows Microsoft Outlook to front-end Gmail. The synchronization tool, which is available to users of Google Apps Premier, lets users keep their Outlook client and retain the familiar interface, while still using Gmail on the back end, and opening up the possibility of scrapping Exchange altogether. Cool piece of technology? Definitely. Good idea for the enterprise? That’s the million-dollar question, and the answer isn’t quite so clear.

On the surface, it seems like a useful piece of technology, but for corporate email, it may not be conducive to a secure environment. I’ve often noted that cloud-based email, especially the free varieties, are inherently insecure, and make it far too easy to bypass corporate email security policies. Deploying a tool to blend Outlook/Exchange and Gmail would tend to legitimize use of free public webmail systems in a corporate environment, at least in the eyes of users.

Google is of course, trying to take market share away from Microsoft and position the Apps Sync as a game-changer. However, security concerns and compliance issues will keep a lot of enterprises from going the Google route, if for no other reason, than to maintain control over where the emails and attachments are archived. Store and archive email in the cloud? Still not good enough–and compliance and privacy issues relating to cloud email storage are enormous.

Bottom line, Gmail is fine and quite useful for personal use and personal email accounts, but still needs to be kept separate from the corporate environment.

Google syncs Gmail with Outlook

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

This week, a Vietnamese security company reported discovery of a new worm, named W32.Gaptcha.Worm, which breaks Google’s CAPTCHA, and then automatically creates multiple random Gmail accounts which are then used for distributing spam.

The attack sends the new Gmail accounts out to hackers, who use them until Gmail blocks the IP address of the infected machine. According to the report, if your computer becomes infected, you will see Internet Explorer launch itself, and then the Gmail account registration process takes place, with the worm automatically filling in random names and numbers to manufacture a bogus user. The worm is able to circumvent Google’s CAPTCHA system by sending the CAPTCHA image to a remote server, where it is broken. Gmail will later block your computer, preventing you from signing up for any new legitimate Gmail accounts.

The blog entry that highlights the discovery doesn’t specify however, just how the CAPTCHA is broken once it has been sent to the remote server. It is believed that some spammers actually use low-tech means, sometimes even employing low-cost laborers in third world countries to decode CAPTCHAs by the thousand, by hand.

The company discovered the worm in a honeypot trap.

New attack breaks CAPTCHA, creates bogus Gmail accounts

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators

Using public webmail accounts has been in the news ever since Sarah Palin’s infamous Yahoo account. And while I still don’t believe using one of these public webmail accounts for serious business is ever a good idea, there has been some back-and-forth on the issue around the blogosphere. First, Don Reisinger at Cnet wrote a blog detailing five annoying things about using Gmail. This was responded to on ZDNet by Garett Rogers, who sings the praises of Gmail–going so far as to claim that all other mail clients annoy him.

Whether Gmail is annoying or not is missing the point. There is probably something annoying, to someone, about every single mail client, web or otherwise. Gmail may well have more annoying features than most, I don’t know, I don’t use it. I have two email addresses, for one, I use Microsoft Mail on my local PC; and for the other, I access Microsoft Outlook through a corporate VPN using two-factor authentication. I do feel secure with both, am quite happy with the feature sets, and appreciate being in control of my own archives.

One of the things Reisinger gets annoyed at is the fact that Google scans email for the purpose of delivering context-relevant ads. Now in all fairness, Google doesn’t have live people reading everybody’s email, this is all done with a bot. But all the same, it could be seen as an intrusion; and beyond that, do you really want to have your employees looking at ads in every email? It’s counter-productive. Rogers calls desktop clients “old school”, as if that were a bad thing. Easy access to emails from up to a year back is important to me, and for some companies, required by law. While he is correct to say that simply storing these emails on the local drive leaves open the door to a hard drive failure or file corruption, that’s what archives and backups are for. Am I “old school”? Yes, I suppose I am, but in this regard, old school is what’s going to afford the greatest level of security and control. The advantage of access to email from any location also isn’t just limited to webmail, and so the purported Gmail advantage of global access is really no advantage at all. I too can access my email from any location. On my first account, which I access with Microsoft Mail, there is also a web interface, so I can gain password-controlled access from any computer. And for the second, the corporate VPN takes care of that, allowing me to log in from anywhere.

Thinking about using Gmail, or another public webmail? For personal stuff, it’s fine. For sending and receiving ecards from friends, if you want to remain anonymous, or just to have an extra account to use for when you have to give an email address that’s likely to be harvested for spam, it’s great. But I would never use it for business.

Gmail annoyances considered

Free ebook download: Top 10 Most Popular Troubleshooting Posts for Email Administrators