E-mail message authentication and marking extending standards complaint techniques

Abstract

A system and method for e-mail authentication. The method includes aggregating a plurality of headers associated with an e-mail message and transmitting the aggregated plurality of headers to a validation service. A validation response is then received from the validation service. The e-mail is authenticated based on the validation response.

1 . A method of processing an email message sent from a sender to a recipient, the method comprising:
 extracting a sender identity from headers of the email message;   authenticating the sender identity, where authenticating the sender identity includes
 attempting to match addresses from specific ones of the headers of the email message in a predetermined order against a list of registered senders, 
 for at least one address matched against a registered sender in the list, retrieving via a wide area network a sender policy framework (SPF) record published in association with the matched registered sender in the list as part of a domain name record, 
 authenticating the sender identity if the email message was sent by a machine specified by the SPF record, and 
 if the email message does not originate from a machine specified by the SPF record, transmitting an indication of failed authentication via a wide area network to a destination, said indication identifying a source of the email message; and 
   if the email is authenticated, delivering the email to the recipient as an authenticated email.   
     
     
         2 - 3 . (canceled) 
     
     
         4 . The method of  claim 1 , where the source comprises at least one of sending IP address or originating IP address associated with the email message. 
     
     
         5 . The method of  claim 1 , where the method further comprises transmitting the indication to the matched registered sender. 
     
     
         6 . The method of  claim 1 , where transmitting the indication comprises providing information indicating whether a header for the email message is spoofed. 
     
     
         7 . The method of  claim 1 , where authenticating the sender identity includes validating a domain key (DK) signature contained in at least one header of the email message. 
     
     
         8 . The method of  claim 7 , where authenticating the sender identity includes comparing a DK “d=” field with a list of registered senders and authenticating the message if the DK “d=” field matches an address in the list of registered senders. 
     
     
         9 - 10 . (canceled) 
     
     
         11 . The method of  claim 1 , where extracting a sender identity further comprises reducing addresses extracted from the headers to a set of unique addresses. 
     
     
         12 . The method of  claim 1 , where the method further comprises extracting an address from at least two headers selected from the group consisting of a FROM header, a SENDER header, a RESENT header, a REPLY-TO header, a RESENT-FROM header, a RETURN-PATH header or a RECEIVED header. 
     
     
         13 . The method of  claim 12 , where the at least two headers include a FROM header, and where an address from the FROM header is checked first relative to an address extracted from any other one of the headers of the email message. 
     
     
         14 . The method of  claim 1 , where extracting a sender identity includes extracting one of a MAIL-FROM (MFROM) indication, a SENDERID indication, a return path indication, or a domain indication from the email message. 
     
     
         15 . The method of  claim 1 , where notifying a registered sender of failed authentication includes a identifying a specific registered sender and notifying the specific registered sender in the event that the email message fails authentication because the email message does not originate from a machine specified by an SPF record of the specific registered sender. 
     
     
         16 - 17 . (canceled) 
     
     
         18 . The method of  claim 1 , embodied across at least two machines, including in a module run by a server, and in software run by a receiving client machine. 
     
     
         19 . The method of  claim 18 , where extracting a sender identity is performed by the software run by the receiving client machine, where extracted identity is communicated from the receiving client machine to the server, and where the server selectively instructs the receiving client machine to display the email message as an authenticated email based on the results of authenticating. 
     
     
         20 . The method of  claim 1 , where extracting a sender identity is performed by software run by a mail user agent (MUA). 
     
     
         21 . An apparatus comprising a non transitory computer-readable non-transitory storage medium having instructions stored thereon, the instructions when executed to cause a processor to:
 extract a sender identity from headers of an email message;   authenticate the sender identity, by
 attempting to match addresses from specific ones of the headers of the email message in a predetermined order against a list of registered senders, 
 for at least one address matched against a registered sender in the list, retrieving via a wide area network a sender policy framework (SPF) record published in association with the matched registered sender in the list as part of a domain name record, 
 authenticating the sender identity if the email message was sent by a machine specified by the SPF record, and 
 if the email message does not originate from a machine specified by the SPF record, transmitting an indication of failed authentication via a wide area network to a destination, said indication identifying a source of the email message; and 
   if the email is authenticated, deliver the email to the recipient as an authenticated email.   
     
     
         22 - 23 . (canceled) 
     
     
         24 . The apparatus of  claim 21 , where the instructions are to cause a processor to indicate to the matched registered sender in the list at least one of sending IP address or originating IP address associated with the email message. 
     
     
         25 . The apparatus of  claim 21 , where the instructions are to cause a processor to store results of authentication at a validation server for access by the matched registered sender in the list. 
     
     
         26 . The apparatus of  claim 21 , where the instructions are to cause a processor to extract at least two headers of the email message, the at least two headers selected from a group consisting of a FROM header, a SENDER header, a RESENT header, a REPLY-TO header, a RESENT-FROM header, a RETURN-PATH header or a RECEIVED header. 
     
     
         27 . The apparatus of  claim 26 , where the at least two headers include a FROM header, and where the instructions are to cause a processor to check an address from the FROM header first relative to an address from any other one of the headers of the email message. 
     
     
         28 . The apparatus of  claim 21 , where the instructions are to cause a processor to extract the sender identity by extracting one of a MAIL-FROM (M FROM) indication, a SENDERID indication, a return path indication, or a domain indication from the email message. 
     
     
         29 - 30 . (canceled) 
     
     
         30 . (canceled) 
     
     
         31 . The apparatus of  claim 21 , wherein the instructions are at least partially embodied as software run by a mail user agent (MUA). 
     
     
         32 . The apparatus of  claim 21 , where the instructions when executed cause a processor to validate a domain key (DK) signature contained in at least one header of the email message. 
     
     
         33 . The apparatus of  claim 32 , where the instructions when executed are to compare a DK “d=” field with a list of registered senders and to authenticate the message if the DK “d=” field matches an address in the list of registered senders. 
     
     
         34 . The apparatus of  claim 21 , where the instructions when executed are to extract an email address of a first company sending the email message on behalf of a second company. 
     
     
         35 . An apparatus, comprising computer code modules stored on a non transitory machine-readable non-transitory storage medium, the modules including:
 an email header module to extract a sender identity from headers of the email message;   an authentication module to authenticate the sender identity against a list of registered senders, by
 attempting to match addresses from specific ones of the headers of the email message in a predetermined order against a list of registered senders, 
 for at least one address matched against a registered sender in the list, retrieving via a wide area network a sender policy framework (SPF) record published in association with the matched registered sender in the list as part of a domain name record, 
 authenticating the sender identity if the email message was sent by a machine specified by the SPF record, and 
 if the email message does not originate from a machine specified by the SPF record, transmitting an indication of failed authentication via a wide area network to a destination, said indication identifying a source of the email message; and 
   where, if the email is authenticated, the authentication module causes delivery of the email to the recipient as an authenticated email, using a communications module; and   where each module of the header module, the authentication module and the communication module is embodied in at least one of circuitry or instructions stored on a non-transitory computer-readable medium.   
     
     
         36 . The apparatus of  claim 35 , embodied as instructions to be run by at least two machines, including as a module run by a server, and as software run by a receiving client machine. 
     
     
         37 . The apparatus of  claim 36 , where the instructions are to cause the extracted identity to be communicated from the receiving client machine to the server, and where the server is to selectively instruct the receiving client machine to display the email message as an authenticated email based on the results of authenticating. 
     
     
         38 . (canceled) 
     
     
         39 . An apparatus to process an email message sent from a sender to a recipient, the apparatus comprising:
 means for extracting a sender identity from headers of the email message;   means for authenticating the sender identity against a list of registered senders, by
 attempting to match addresses from specific ones of the headers of the email message in a predetermined order against a list of registered senders, 
 for at least one address matched against a registered sender in the list, retrieving via a wide area network a sender policy framework (SPF) record published in association with the matched registered sender in the list as part of a domain name record, 
 authenticating the sender identity if the email message was sent by a machine specified by the SPF record, and 
 if the email message does not originate from a machine specified by the SPF record, transmitting an indication of failed authentication via a wide area network to a destination, said indication identifying a source of the email message; and 
   means for, if the email is authenticated, delivering the email to the recipient as an authenticated email.   
     
     
         40 . The method of  claim 1 , where delivering the email comprises confidence marking the email message with an icon that, by display to the recipient, denotes the sender identity has been authenticated. 
     
     
         41 - 42 . (canceled) 
     
     
         43 . The apparatus of  claim 21 , where the instructions when executed are to cause a processor to mark the email message with an icon that, by display to the recipient, denotes the sender identity has been authenticated. 
     
     
         44 . The apparatus of  claim 35 , where the communications module is to cause a processor to mark the email message with an icon that, by display to the recipient, denotes the sender identity has been authenticated. 
     
     
         45 . The apparatus of  claim 39 , where the means for delivering are to cause a processor to mark the email message with an icon that, by display to the recipient, denotes the sender identity has been authenticated. 
     
     
         46 . The method of  claim 1 , wherein:
 authenticating the sender identity further includes transmitting at least one address to a remote validation service via the wide area network, and responsively receiving a response from the remote validation service;   each entry in the list of registered senders represents a legitimate entity known to the validation service;   the destination corresponds to the validation service; and   the indication identifies the matched registered sender, in addition to the source.