A Short History of Spam, from 1978 to the CAN-SPAM Act

Almost every email user has a spam folder, and almost no one remembers a time without one. The story of how unwanted bulk messages became a permanent part of the internet is a story about economics, culture and the limits of law. It begins with a single message on a network that had only a few thousand users.

The first commercial message

On 3 May 1978, Gary Thuerk, a marketing manager at Digital Equipment Corporation, sent a message to a few hundred users on the ARPANET, inviting them to demonstrations of the company's new computers in California. It was widely seen as the first mass commercial email. The reaction was hostile. The network was meant for research, commercial use was not allowed, and recipients complained. An official from the Defense Communications Agency reportedly asked the sender not to do it again.

The incident shows how the network's early culture shaped its first rules: a clear expectation that the medium was not for advertising.

The use of the word spam for unwanted messages comes from a Monty Python sketch in which a cafe menu includes the canned meat Spam in almost every dish, and a chorus drowns out the conversation by repeating the word. In the 1980s, users of online games and bulletin boards used it for repetitive text that flooded a channel. The term then moved to Usenet, the global discussion system, in the early 1990s.

The Green Card message

The event that made spam notorious was on 12 April 1994, when the law firm Canter and Siegel, of Arizona, posted an advertisement for its help with the US green card lottery to thousands of Usenet newsgroups. The users of Usenet reacted with fury, and the firm received a flood of complaints, some of them aimed at their internet provider. But the lawyers defended what they had done, and later wrote a book about marketing on the internet.

The lesson that other marketers took was that it worked. Sending to thousands of groups cost almost nothing, and some people responded. The economics were the key: once sending a message costs nearly zero, even a tiny response rate is profitable, and the cost is borne by the recipients and the network.

Spam grows with the web

As email became mainstream in the late 1990s, bulk senders moved there. Spammers harvested addresses from websites and newsgroups, used open mail relays to hide their origin, and later used networks of infected computers to send millions of messages. Volumes grew until, by the early 2000s, a large majority of email traffic was unwanted.

Defenders responded with technical tools. Blocklists such as those run by Spamhaus, which was founded in 1998, let mail servers refuse mail from known sources. Content filters improved sharply after 2002, when programmer Paul Graham published an essay, "A Plan for Spam", popularising the use of statistical Bayesian filtering, which learns which words are likely to appear in spam.

The CAN-SPAM Act

In the United States, Congress passed the CAN-SPAM Act, which was signed in December 2003 and took effect on 1 January 2004. Its full name is the Controlling the Assault of Non-Solicited Pornography and Marketing Act. It did not ban unsolicited commercial email. Instead, it set rules for senders.

• Header information and subject lines must not be false or misleading.
• Messages must identify themselves as advertisements, in most cases.
• They must include a valid physical postal address for the sender.
• They must give recipients a clear way to opt out, and the sender must honour requests within ten business days.

This is an opt-out model: you may send until told to stop. European law took a different approach, requiring in general the prior consent of recipients, under rules that came out of the 2002 Directive on privacy and electronic communications.

Did it work?

Many critics said the CAN-SPAM Act had little effect on the volume of spam. Most spam is sent by people who ignore the law, often from outside the country, and who are hard to find. Some of the more significant reductions came from technical measures, such as filtering, authentication and the takedown of large botnets. The law did create a legal basis for action against some large operators, and it set a standard that legitimate businesses follow.

The spam problem drove most of the email standards that site owners now configure. SPF, DKIM and DMARC exist to let a receiving server check that a message really comes from the domain it claims. Without them, forging a sender is trivial. Mail providers increasingly insist on these records, and messages that fail may be rejected or sent to spam folders.

The lesson for site owners today

If you send email from your domain, treat your sending reputation as an asset. Use authentication, send only to people who have asked to hear from you, make unsubscribing easy and watch your complaint rates. Also protect your forms and mailboxes from abuse: a contact form without protection can be turned into a spam relay in a matter of days.

1. Publish SPF, DKIM and DMARC records for your domain.
2. Use a dedicated sender for bulk mail, separate from your normal business mailbox.
3. Add a CAPTCHA or other protection to website forms.
4. Honour unsubscribe requests promptly.

Practical how-to guides are collected in the knowledgebase.

Setting it up

With business email hosting on your own domain, you can publish these records and manage mailboxes in Plesk. Our knowledgebase walks through the settings, and the shared hosting plans include email alongside your site.