Centralized validation of email senders via EHLO name and IP address targeting
A DNS server receives from a receiving email system, a DNS query for an email domain stored at the DNS server, the DNS query including identifying information of a sender of an email. The DNS server extracts the identifying information of the email sender from the DNS query and identifies one of a plurality of delivering organizations from the information. The DNS server determines whether the identified delivering organization is authorized to deliver email on behalf of the email domain. In response to determining that the identified delivering organization is authorized to deliver email on behalf of the email domain, the DNS server generates a target validation record based on the identity of the authorized delivering organization and the email domain, the target validation record including one or more rules indicating to the receiving email system whether the delivering organization is an authorized sender of email for the email domain.
1. A non-transitory computer readable storage medium configured to store instructions, the instructions when executed by a processor cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain, and
generate the email domain validation record to include one or more Sender Policy Framework (SPF) macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include as identifying information at least one of an extended HELO (EHLO) name and Internet Protocol (IP) address of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a first query from the receiving email system; and
transmit, in response to the first query, the email domain validation record to the receiving email system, the transmitted email domain validation record causing the receiving email system to generate a second query for target domain authentication information that authenticates an email received at the receiving email system transmitted from the target domain.
2. The computer readable storage medium of claim 1 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
3. The computer readable storage medium of claim 1 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
4. The computer readable storage medium of claim 1 , wherein the DNS TXT record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
5. A computer-implemented process, comprising:
generating an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the target domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record further comprising:
generating the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain, and
generating the email domain validation record to include one or more Sender Policy Framework (SPF) macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information at least one of an extended HELO (EHLO) name and Internet Protocol (IP) address of the sender of the email in the second request;
publishing the created email domain validation record as a DNS TXT record of the email domain;
receiving a first query from the receiving email system; and
transmitting, in response to the first query, the email domain validation record to the receiving email system, the transmitted email domain validation record causing the receiving email system to generate a second query for target domain authentication information that authenticates an email received at the receiving email system transmitted from the target domain.
6. The process of claim 5 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
7. The process of claim 5 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
8. The process of claim 5 , wherein the DNS TXT record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
9. A computing device, comprising:
a processor;
a non-transitory computer readable storage medium, configured to store instructions, that when executed by the processor, cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain, and
generate the email domain validation record to include one or more Sender Policy Framework (SPF) macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information at least one of an extended HELO (EHLO) name and Internet Protocol (IP) address of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a first query from the receiving email system; and
transmit, in response to the first query, the email domain validation record to the receiving email system, the transmitted email domain validation record causing the receiving email system to generate a second query for target domain authentication information that authenticates an email received at the receiving email system transmitted from the target domain.
10. The computing device of claim 9 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
11. The computing device of claim 9 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
12. The computing device of claim 9 , wherein the DNS TXT record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.
13. A non-transitory computer readable storage medium configured to store instructions, the instructions when executed by a processor cause the processor to:
generate an email domain validation record to include in a Domain Name System (DNS) record of an email domain, the email domain validation record to be queried by a receiving email system when receiving an email from the email domain, and indicating to the receiving email system whether the sender of an email is an authorized sender for the email domain, the generation of the email domain validation record including instructions that when executed by the processor further cause the processor to:
generate the email domain validation record to include a target domain, the target domain being a domain distinct from the email domain, causing the receiving email system, when querying the email domain validation record, to submit a second request for a validation record to the target domain, and
generate the email domain validation record to include one or more macro statements specifying identifying information, the macro statements causing the receiving email system, when querying the email domain validation record, to include identifying information of the sender of the email in the second request;
publish the created email domain validation record as a DNS TXT record of the email domain;
receive a first query from the receiving email system; and
transmit, in response to the first query, the email domain validation record to the receiving email system, the transmitted email domain validation record causing the receiving email system to generate a second query for target domain authentication information that authenticates an email received at the receiving email system transmitted from the target domain.
14. The computer readable storage medium of claim 13 , wherein the email domain validation record is a Sender Policy Framework (SPF) record.
15. The computer readable storage medium of claim 13 , wherein the macro statements and the target domain in the email domain validation record are separated by separating characters that are not allowed in the formation of a hostname.
16. The computer readable storage medium of claim 15 , wherein the target domain parses the received second request using the separating characters as non-ambiguous delimiters.
17. The computer readable storage medium of claim 13 , wherein the DNS TXT record is further hidden behind one or more DNS Canonical Name record (CNAME) entries.