# US 10,122,765 B1 · Centralized validation of email senders via EHLO name and IP address targeting

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,765 B1
- Document ID: US10122765B1
- Status: Granted
- Kind: B1
- Application number: 16/012,616
- Filed: 2018-06-19
- Published: 2018-10-18
- Granted: 2018-11-06
- Earliest claimed: 2015-02-14
- Assignees: ValiMail Inc.
- Applicants: ValiMail Inc.
- Inventors: Peter Martin Goldstein
- Web page: https://patentgrep.com/patent/US10122765B1

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 51/04: Real-time or near real-time messaging, e.g. instant messaging [IM]
- H04L 51/212: using filtering or selective blocking
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/126: {the source of the received data}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 2101/33: containing protocol addresses or telephone numbers
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A DNS server receives from a receiving email system, a DNS query for an email domain stored at the DNS server, the DNS query including identifying information of a sender of an email. The DNS server extracts the identifying information of the email sender from the DNS query and identifies one of a plurality of delivering organizations from the information. The DNS server determines whether the identified delivering organization is authorized to deliver email on behalf of the email domain. In response to determining that the identified delivering organization is authorized to deliver email on behalf of the email domain, the DNS server generates a target validation record based on the identity of the authorized delivering organization and the email domain, the target validation record including one or more rules indicating to the receiving email system whether the delivering organization is an authorized sender of email for the email domain.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving, at an authorizing Domain Name System (DNS) system, a redirected target domain DNS query from a receiving email system, the redirected target domain DNS query generated by the receiving email system based on parsing Sender Policy Framework (SPF) macro statements in a DNS TXT record published at a DNS server of an email domain owner system, the redirected target domain DNS query including identifying information of a delivering email system, the identifying information comprising at least one of an extended HELO (EHLO) name, and an (Internet Protocol) IP address of the delivering email system;
extracting the identifying information from the redirected target domain DNS query;
determining an identity of the delivering email system from a list of delivering organizations based on the extracted identifying information by accessing a database that associates identifying information with delivering organizations;
determining whether the delivering email system is authorized to send email on behalf of the email domain owner system by accessing an authorization database that associates one or more authorized delivering organizations or systems with email domains of email domain owner systems;
generating, in response to determining that the identified delivering email system is authorized to deliver email on behalf of the email domain owner system, a DNS record usable in accordance with SPF for indicating that the delivering email system is an authorized sender of email for the email domain owner system; and
transmitting the DNS record to the receiving email system, the DNS record for authenticating an email at the receiving email system.

### Claim 2 (depends on 1)

The method of claim 1, wherein the database is updated by:
accessing header information of a number of authenticated and delivered emails, the number being greater than a threshold value;
generating a plurality of unique entries in the database, each entry in the database including at least one of an EHLO name and an IP address, wherein each entry also includes a delivering organization name parsed from the header information of the emails.

### Claim 3 (depends on 1)

The method of claim 1, wherein the database is updated by:
accessing domain registration information of a number of email domains, the number being greater than a threshold value;
generating a plurality of unique entries in the database, each entry in the database including a domain name, IP address, and delivering organization name parsed from domain registration information of the email domains.

### Claim 4 (depends on 1)

The method of claim 1, wherein the identifying information further includes a local part of the Return-Path address for the email, and wherein the authorization database further associates, for each email domain, one or more local parts of the Return-Path address on behalf of which the one or more delivering organizations are authorized to send email, the method further comprising:
accessing the authorization database to determine whether the delivering email system is authorized to send email on behalf of the identified local part of the Return-Path address for the email of the email domain.

### Claim 5 (depends on 1)

The method of claim 1, wherein the generating the DNS record further comprises:
accessing a regularly updated records database that stores one or more DNS records for authorized delivering email systems, each of the one or more DNS records indicating that a delivering email system is an authorized sender for the email domain owner system, the regularly updated records database updated using automatic polling.

### Claim 6

A non-transitory computer readable storage medium configured to store computer-readable instructions, that when executed by a processor, cause the processor to:
receive, at an authorizing Domain Name System (DNS) system, a redirected target domain DNS query from a receiving email system, the redirected target domain DNS query generated by the receiving email system based on parsing Sender Policy Framework (SPF) macro statements in a DNS TXT record published at a DNS server of an email domain owner system, the redirected target domain DNS query including identifying information of a delivering email system, the identifying information comprising at least one of an extended HELO (EHLO) name, and an (Internet Protocol) IP address of the delivering email system;
extract the identifying information from the redirected target domain DNS query;
determine an identity of the delivering email system from a list of delivering organizations based on the extracted identifying information by accessing a database that associates identifying information with delivering organizations;
determine whether the delivering email system is authorized to send email on behalf of the email domain owner system by accessing an authorization database that associates one or more authorized delivering organizations or systems with email domains of email domain owner systems;
generate, in response to determining that the identified delivering email system is authorized to deliver email on behalf of the email domain owner system, a DNS record that is usable in accordance with SPF for indicating that the delivering email system is an authorized sender of email for the email domain owner system; and
transmitting the DNS record to the receiving email system, the DNS record for authenticating an email at the receiving email system.

### Claim 7 (depends on 6)

The non-transitory computer readable storage medium of claim 6, wherein the non-transitory computer readable storage medium is configured to store further computer-readable instructions for the update of the database, that when executed by the processor, causes the processor to:
access header information of a number of authenticated and delivered emails, the number being greater than a threshold value;
generate a plurality of unique entries in the database, each entry in the database including at least one of an EHLO name and an IP address, wherein each entry also includes a delivering organization name parsed from the header information of the emails.

### Claim 8 (depends on 6)

The non-transitory computer readable storage medium of claim 6, wherein the non-transitory computer readable storage medium is configured to store further computer-readable instructions for the update of the database, that when executed by the processor, causes the processor to:
access domain registration information of a number of email domains, the number being greater than a threshold value;
generate a plurality of unique entries in the database, each entry in the database including a domain name, IP address, and delivering organization name parsed from domain registration information of the email domains.

### Claim 9 (depends on 6)

The non-transitory computer readable storage medium of claim 6, wherein the identifying information further includes a local part of the Return-Path address for the email, and wherein the authorization database further associates, for each email domain, one or more local parts of the Return-Path address on behalf of which the one or more delivering organizations are authorized to send email, and wherein the non-transitory computer readable storage medium is configured to store further computer-readable instructions, that when executed by the processor, causes the processor to:
accessing the authorization database to determine whether the delivering email system is authorized to send email on behalf of the identified local part of the Return-Path address for the email of the email domain.

### Claim 10 (depends on 6)

The non-transitory computer readable storage medium of claim 6, wherein the non-transitory computer readable storage medium is configured to store further computer-readable instructions for the generation of the DNS record, that when executed by the processor, causes the processor to:
access a regularly updated records database that stores one or more DNS records for authorized delivering email systems, each of the one or more DNS records indicating that a delivering email system is an authorized sender for the email domain owner system, the regularly updated records database updated using automatic polling.

### Claim 11

An authorizing Domain Name System (DNS) system, comprising:
an authorization evaluator executing on one or more computing devices that:
receives a redirected target domain DNS query from a receiving email system, the redirected target domain DNS query generated by the receiving email system based on parsing Sender Policy Framework (SPF) macro statements in a DNS TXT record published at a DNS server of an email domain owner system, the redirected target domain DNS query including identifying information of a delivering email system, the identifying information comprising at least one of an extended HELO (EHLO) name, and an (Internet Protocol) IP address of the delivering email system;
extracts the identifying information from the redirected target domain DNS query;
determines an identity of the delivering email system from a list of delivering organizations based on the extracted identifying information by accessing a database that associates identifying information with delivering organizations; and
a target record constructor executing on one or more computing devices that:
determines whether the delivering email system is authorized to send email on behalf of the email domain owner system by accessing an authorization database that associates one or more authorized delivering organizations or systems with email domains of email domain owner systems;
generates, in response to a determination that the identified delivering email system is authorized to deliver email on behalf of the email domain owner system, a DNS record that is usable in accordance with SPF for indicating that the delivering email system is an authorized sender of email for the email domain owner system; and
transmits the DNS record to the receiving email system, the DNS record for authenticating an email at the receiving email system.

### Claim 12 (depends on 11)

The system of claim 11, wherein the authorizing Domain Name System (DNS) system updates the database by:
accessing header information of a number of authenticated and delivered emails, the number being greater than a threshold value;
generating a plurality of unique entries in the database, each entry in the database including at least one of an EHLO name and an IP address, wherein each entry also includes a delivering organization name parsed from the header information of the emails.

### Claim 13 (depends on 11)

The system of claim 11, wherein the authorizing Domain Name System (DNS) system updates the database by:
accessing domain registration information of a number of email domains, the number being greater than a threshold value;
generating a plurality of unique entries in the database, each entry in the database including a domain name, IP address, and delivering organization name parsed from domain registration information of the email domains.

### Claim 14 (depends on 11)

The system of claim 11, wherein the identifying information further includes a local part of the Return-Path address for the email, and wherein the authorization database further associates, for each email domain, one or more local parts of the Return-Path address on behalf of which the one or more delivering organizations are authorized to send email, and wherein the target record constructor further:
accesses the authorization database to determine whether the delivering email system is authorized to send email on behalf of the identified local part of the Return-Path address for the email of the email domain.

### Claim 15 (depends on 11)

The system of claim 11, wherein the target record constructor further:
accesses a regularly updated records database that stores one or more DNS records for authorized delivering email systems, each of the one or more DNS records indicating that a delivering email system is an authorized sender for the email domain owner system, the regularly updated records database updated using automatic polling.

### Claim 16 (depends on 11)

The system of claim 11, wherein the DNS record includes at least one of an IP address or a non-existent domain indicator.