Centralized validation of email senders via EHLO name and IP address targeting
A DNS server receives from a receiving email system, a DNS query for an email domain stored at the DNS server, the DNS query including identifying information of a sender of an email. The DNS server extracts the identifying information of the email sender from the DNS query and identifies one of a plurality of delivering organizations from the information. The DNS server determines whether the identified delivering organization is authorized to deliver email on behalf of the email domain. In response to determining that the identified delivering organization is authorized to deliver email on behalf of the email domain, the DNS server generates a target validation record based on the identity of the authorized delivering organization and the email domain, the target validation record including one or more rules indicating to the receiving email system whether the delivering organization is an authorized sender of email for the email domain.
1. A non-transitory computer readable storage medium configured to store instructions, the instructions when executed by a processor cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain; and
generate the email domain validation record to include one or more Sender Policy Framework (SPF) macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include as identifying information at least one of an extended HELO (EHLO) name and Internet Protocol (IP) address of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a query from any server for the DNS TXT record; and
transmit, in response to the receipt of the query, a DNS record to the server for authenticating an email at the receiving email system.
2. The computer readable storage medium of claim 1 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
3. The computer readable storage medium of claim 1 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
4. The computer readable storage medium of claim 1 , wherein the DNS record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
5. A computer-implemented process, comprising:
generating an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the target domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record further comprising:
generating the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain; and
generating the email domain validation record to include one or more macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information of the sender of the email in the second request;
publishing the created email domain validation record as a DNS TXT record of the email domain;
receiving a query from any server for the DNS TXT record; and
transmitting, in response to the receipt of the query, a DNS record to the server for authenticating an email at the receiving email system.
6. The process of claim 5 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
7. The process of claim 5 , wherein the macro statements are Sender Policy Framework (SPF) macros, and the macro statements instruct the receiving email system to include as the identifying information at least one of an extended HELO (EHLO) name and an Internet Protocol (IP) address of the sender of the email.
8. The process of claim 7 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
9. The process of claim 5 , wherein the DNS record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
10. A computing device, comprising:
a processor;
a non-transitory computer readable storage medium, configured to store instructions, that when executed by the processor, cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain; and
generate the email domain validation record to include one or more macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a query from any server for the DNS TXT record; and
transmit, in response to the receipt of the query, a DNS record to the server for authenticating an email at the receiving email system.
11. The computing device of claim 10 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
12. The computing device of claim 10 , wherein the macro statements are Sender Policy Framework (SPF) macros, and the macro statements instruct the receiving email system to include as identifying information at least one of an extended HELO (EHLO) name and an Internet Protocol (IP) address of the sender of the email.
13. The computing device of claim 12 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
14. The computing device of claim 10 , wherein the DNS record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
15. A non-transitory computer readable storage medium configured to store instructions, the instructions when executed by a processor cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain; and
generate the email domain validation record to include one or more macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a query from any server for the DNS TXT record; and
transmit, in response to the receipt of the query, a DNS record to the server for authenticating an email at the receiving email system.
16. The computer readable storage medium of claim 15 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
17. The computer readable storage medium of claim 15 , wherein the macro statements are Sender Policy Framework (SPF) macros, and the macro statements instruct the receiving email system to include as the identifying information at least one of an extended HELO (EHLO) name and an Internet Protocol (IP) address of the sender of the email.
18. The computer readable storage medium of claim 17 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
19. The computer readable storage medium of claim 18 , wherein the target domain parses the received second request using the separating characters as non-ambiguous delimiters.
20. The computer readable storage medium of claim 15 , wherein the DNS record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.