Authentication of email senders via authorizing DNS server
A DNS server receives from a receiving email system, a DNS query for an email domain stored at the DNS server, the DNS query including identifying information of a sender of an email. The DNS server extracts the identifying information of the email sender from the DNS query and identifies one of a plurality of delivering organizations from the information. The DNS server determines whether the identified delivering organization is authorized to deliver email on behalf of the email domain. In response to determining that the identified delivering organization is authorized to deliver email on behalf of the email domain, the DNS server generates a target validation record based on the identity of the authorized delivering organization and the email domain, the target validation record including one or more rules indicating to the receiving email system whether the delivering organization is an authorized sender of email for the email domain.
1. A system, comprising:
an interface configured to receive one or more inputs for indicating that one or more delivering organizations are organizations that deliver emails on behalf of a domain owner that owns an email domain, wherein a particular delivering organization of the one or more delivering organizations delivers emails via one or more IP addresses; and
a domain name system (DNS) server comprising memory and one or more processors, the DNS server configured to provide one or more DNS responses on behalf of the domain owner, wherein the DNS server, the domain owner, and the particular delivering organization are different entities, wherein the memory comprises instructions that when executed by the one or more processors cause the one or more processors to:
store a deliverer list associated with the domain owner, the deliverer list comprising one or more delivering organizations;
maintain a mapping between the particular delivering organization and the one or more IP addresses used by the particular delivering organization;
serve as an authoritative DNS server for a target domain, wherein the target domain is different from the email domain, the target domain being connected with the email domain through one or more DNS lookup statements;
receive, from a receiving email system attempting to authenticate an incoming email, a DNS query to the target domain, wherein the DNS query to the target domain is generated after the receiving email system first queried the email domain; and
return, responsive to the DNS query, a DNS record that comprises at least one of the IP addresses used by the particular delivering organization to deliver emails, wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email.
2. The system of claim 1 , wherein the target domain has a name that includes both the email domain and a domain of an entity associated with the DNS server as part of the name.
3. The system of claim 1 , wherein the target domain is referenced in DNS information associated with the email domain via an include directive, the include directive comprising a statement that includes the email domain and a domain of an entity associated with the DNS server.
4. The system of claim 1 , wherein the target domain is a subdomain of a domain of an entity associated with the DNS server, and the subdomain has the email domain as a prefix to the domain of the entity.
5. The system of claim 1 , wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email by (i) including an IP address list that includes the one or more IP addresses used by the particular delivering organization to allow the receiving email system to compare a sender IP address to the IP address list or (ii) including a directive that points to another DNS record.
6. The system of claim 1 , wherein the DNS record is generated by retrieving the mapping between the particular delivering organization and the one or more IP addresses.
7. The system of claim 1 , wherein the deliverer list includes a plurality of delivering organizations, each delivering organization has one or more DNS records to list the delivering organization's own IP addresses, and wherein the plurality of delivering organizations, in total and without the DNS record of the target domain, have a total number of DNS records exceeding a lookup limit.
8. The system of claim 1 , wherein the DNS query to the target domain is a second DNS query by the receiving email system, and wherein the receiving email system, upon receiving the incoming email, generates a first DNS query directed to the email domain and, based on an include directive in a DNS response to the first DNS query, the receiving email system generates the second DNS query.
9. The system of claim 1 , wherein the interface is a graphical user interface and the interface and the DNS server are operated by the same entity.
10. The system of claim 1 , wherein the mapping is constructed by going through existing Sender Policy Framework records of the particular delivering organization to collect the one or more IP addresses used by the particular delivering organization.
11. A system comprising:
one or more processors; and
memory configured to store code comprising instructions, wherein the instructions, when executed by the one or more processors, cause the one or more processors to:
receive one or more inputs for indicating that one or more delivering organizations are organizations that deliver emails on behalf of a domain owner that owns an email domain, wherein a particular delivering organization of the one or more delivering organizations delivers emails via one or more IP addresses;
store a deliverer list associated with the domain owner, the deliverer list comprising one or more delivering organizations;
maintain a mapping between the particular delivering organization and the one or more IP addresses used by the particular delivering organization;
cause a domain name system (DNS) server to serve as an authoritative DNS server for a target domain, wherein the target domain is different from the email domain, wherein the target domain is connected with the email domain through one or more DNS lookup statements, and wherein the DNS server, the domain owner, and the particular delivering organization are different entities;
receive, from a receiving email system attempting to authenticate an incoming email, a DNS query to the target domain, wherein the DNS query to the target domain is generated after the receiving email system first queried the email domain; and
return, responsive to the DNS query, a DNS record that comprises at least one of the IP addresses used by the particular delivering organization to deliver emails, wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email.
12. The system of claim 11 , wherein the target domain has a name that includes both the email domain and a domain of an entity associated with the DNS server as part of the name.
13. The system of claim 11 , wherein the target domain is referenced in DNS information associated with the email domain via an include directive, the include directive comprising a statement that includes the email domain and a domain of an entity associated with the DNS server.
14. The system of claim 11 , wherein the target domain is a subdomain of a domain of an entity associated with the DNS server, and the subdomain has the email domain as a prefix to the domain of the entity.
15. The system of claim 11 , wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email by (i) including an IP address list that includes the one or more IP addresses used by the particular delivering organization to allow the receiving email system to compare a sender IP address to the IP address list or (ii) including a directive that points to another DNS record.
16. The system of claim 11 , wherein the DNS record is generated by retrieving the mapping between the particular delivering organization and the one or more IP addresses.
17. The system of claim 11 , wherein the deliverer list includes a plurality of delivering organizations, each delivering organization has one or more DNS records to list the delivering organization's own IP addresses, and wherein the plurality of delivering organizations, in total and without the DNS record of the target domain, have a total number of DNS records exceeding a lookup limit.
18. The system of claim 11 , wherein the DNS query to the target domain is a second DNS query by the receiving email system, and wherein the receiving email system, upon receiving the incoming email, generates a first DNS query directed to the email domain and, based on an include directive in a DNS response to the first DNS query, the receiving email system generates the second DNS query.
19. The system of claim 11 , wherein the one or more inputs are received from a graphical user interface and the interface and the DNS server are operated by the same entity.
20. The system of claim 11 , wherein the mapping is constructed by going through existing Sender Policy Framework records of the particular delivering organization to collect the one or more IP addresses used by the particular delivering organization.
21. A computer-implemented method, comprising:
receiving one or more inputs for indicating that one or more delivering organizations are organizations that deliver emails on behalf of a domain owner that owns an email domain, wherein a particular delivering organization of the one or more delivering organizations delivers emails via one or more IP addresses;
storing a deliverer list associated with the domain owner, the deliverer list comprising one or more delivering organizations;
maintaining a mapping between the particular delivering organization and the one or more IP addresses used by the particular delivering organization;
causing a domain name system (DNS) server to serve as an authoritative DNS server for a target domain, wherein the target domain is different from the email domain, wherein the target domain is connected with the email domain through one or more DNS lookup statements, and wherein the DNS server, the domain owner, and the particular delivering organization are different entities;
receiving, from a receiving email system attempting to authenticate an incoming email, a DNS query to the target domain, wherein the DNS query to the target domain is generated after the receiving email system first queried the email domain; and
returning, responsive to the DNS query, a DNS record that comprises at least one of the IP addresses used by the particular delivering organization to deliver emails, wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email.
22. The computer-implemented method of claim 21 , wherein the target domain has a name that includes both the email domain and a domain of an entity associated with the DNS server as part of the name.
23. The computer-implemented method of claim 21 , wherein the target domain is referenced in DNS information associated with the email domain via an include directive, the include directive comprising a statement that includes the email domain and a domain of an entity associated with the DNS server.
24. The computer-implemented method of claim 21 , wherein the target domain is a subdomain of a domain of an entity associated with the DNS server, and the subdomain has the email domain as a prefix to the domain of the entity.
25. The computer-implemented method of claim 21 , wherein the DNS record leads to the receiving email system determining whether to authenticate the incoming email by (i) including an IP address list that includes the one or more IP addresses used by the particular delivering organization to allow the receiving email system to compare a sender IP address to the IP address list or (ii) including a directive that points to another DNS record.
26. The computer-implemented method of claim 21 , wherein the DNS record is generated by retrieving the mapping between the particular delivering organization and the one or more IP addresses.
27. The computer-implemented method of claim 21 , wherein the deliverer list includes a plurality of delivering organizations, each delivering organization has one or more DNS records to list the delivering organization's own IP addresses, and wherein the plurality of delivering organizations, in total and without the DNS record of the target domain, have a total number of DNS records exceeding a lookup limit.
28. The computer-implemented method of claim 21 , wherein the DNS query to the target domain is a second DNS query by the receiving email system, and wherein the receiving email system, upon receiving the incoming email, generates a first DNS query directed to the email domain and, based on an include directive in a DNS response to the first DNS query, the receiving email system generates the second DNS query.
29. The computer-implemented method of claim 21 , wherein the one or more inputs are received from a graphical user interface and the interface and the DNS server are operated by the same entity.
30. The computer-implemented method of claim 21 , wherein the mapping is constructed by going through existing Sender Policy Framework records of the particular delivering organization to collect the one or more IP addresses used by the particular delivering organization.