Entity-separated email domain authentication for known and open sign-up domains

Abstract

An email validation system receives an email validation request from a requestor to validate an email, the email validation request indicating at least a sender domain indicating a domain of the sender of the email. The email validation system determines whether the sender domain is in a whitelist of known domains, wherein a known domain is a domain that is linked to an organization whose provenance is known, such that it can be linked to an identifiable entity in the real world. The email validation system generates, in response to determining that the sender domain is not in the list of known domains, a message indicating that the email is not valid. The email validation system generates, in response to determining that the sender domain is in the list of known domains, the message indicating that the email is valid, and transmits the message to the requestor.

1 . A computer implemented method, comprising:
 receiving, at an email validation system, an email validation request from a requestor to validate an email, the email validation request indicating at least a sender domain indicating a domain of the sender of the email;   accessing registration data of the sender domain by querying a registration data protocol;   determining whether the sender domain is in a whitelist of known domains, wherein a known domain is a domain that is linked to an organization whose provenance is known, such that the domain can be linked to an identifiable entity in the real world;   determining an action based on whether the sender domain is in the list of known domains and based on a recipient of the email according to a policy that sets forth actions for different recipients; and   performing the action that is different for different recipients.   
     
     
         2 . The method of  claim 1 , wherein the email validation system is a component of at least one of 1) a third party entity and 2) a receiving email system that receives the email. 
     
     
         3 . The method of  claim 1 , wherein the action comprises one or more security actions that are performed against an email in response to the sender domain not being in the list of known domains, the one or more security actions including at least one of deleting the email, quarantining the email, sending a warning to a recipient of the email, and sending a notification to an administrator. 
     
     
         4 . The method of  claim 1 , wherein the whitelist of known domains is generated by:
 accessing lists of legitimate domains from one or more third party sources, the one or more third party sources including at least one of domain collection organizations, semi-private data sources, private data sources, and public data sources; and   cross-referencing the lists of legitimate domains from the one or more third party sources to generate the list of known domains.   
     
     
         5 . The method of  claim 1 , wherein the list of known domains further includes a list of bad domains, the method further comprising:
 determining that the sender domain is in the list of bad domains; and   generating, in response to determining that the sender domain is in the list of bad domains, a response indicating that the email is not valid.   
     
     
         6 . The method of  claim 1 , wherein the whitelist of known domains is generated by:
 accessing a list of inbound emails received for a subset of organizations;   identifying a plurality of sender domains for the list of inbound emails; and   adding one or more sender domains of the plurality of sender domains that are determined to be legitimate sender domains to the list of known domains.   
     
     
         7 . The method of  claim 6 , further comprising determining that the sender domain is legitimate in response to determining that a threshold number of replies have been made by users of the subset of organizations to the sender domain. 
     
     
         8 . The method of  claim 6 , further comprising determining that the sender domain of is legitimate in response to determining that replies from a threshold number of different organizations have been made to the sender domain. 
     
     
         9 . The method of  claim 1 , further comprising:
 receiving a list of hashed contacts, the list of hashed contacts including hashes of email addresses hashed using a secret key, the email addresses being from open sign-up domains, an open sign up domain being a domain at which any user can sign up for an email address account;   storing the list of hashed contacts;   receiving, from the requestor, a second email validation request to validate an email, the second email validation request including a hash of a sender address of the email, and the requestor transmitting the email validation request in response to receiving the email;   determining whether the hash of the sender address matches a hash of an email address in the list of hashed contacts;   generating, in response to determining that the sender address is not in the list of hashed contacts, a message indicating that the email is not valid;   generating, in response to determining that the sender address is in the list of hashed contacts, the message indicating that the email is valid; and   transmitting the message to the requestor.   
     
     
         10 . The method of  claim 9 , wherein the list of hashed contacts is generated from contact information collected from a contacts manager for one or more users at an organization where the email message was received. 
     
     
         11 . The method of  claim 9 , wherein the list of hashed contacts is generated by:
 normalizing a domain name of an email address in a contacts list of the user to a standard domain name; and   hashing a local part of the email address with the standard domain name using the secret key to include in the list of hashed contacts.   
     
     
         12 . The method of  claim 9 , wherein the list of hashed contacts only includes hashes of email addresses generated from a contacts manager of one or more users of an organization to which the user belongs. 
     
     
         13 . The method of  claim 9 , wherein the determination of whether the hash of the sender address included in the email validation request matches a hash of an email address in the list of hashed contacts is performed in response to determining that a sender domain for the sender address, which is received in the second email validation request, matches an open-sign up domain. 
     
     
         14 . The method of  claim 9 , wherein the hash of the sender address is matched against a subset of the hashed contacts which is associated with a recipient user that matches an indication of the recipient user received in the second email validation request. 
     
     
         15 . A system, comprising:
 an email validation agent configured to:
 receive an email validation request from a requestor to validate an email, the email validation request indicating at least a sender domain indicating a domain of the sender of the email; 
 access registration data of the sender domain by querying a registration data protocol; 
 determine whether the sender domain is in a whitelist of known domains, wherein a known domain is a domain that is linked to an organization whose provenance is known, such that the domain can be linked to an identifiable entity in the real world; 
 determine an action based on whether the sender domain is in the list of known domains and based on a recipient of the email according to a policy that sets forth actions for different recipients; and 
 perform the action that is different for different recipients. 
   
     
     
         16 . The system of  claim 15 , wherein the email validation agent is further configured to:
 receive, from a client device of a user, a list of hashed contacts, the list of hashed contacts including hashes of email addresses hashed using a secret key, the email addresses being from open sign-up domains, an open sign up domain being a domain at which any user can sign up for an email address account;   store the list of hashed contacts;   receive, from the requestor, a second email validation request to validate an email, the second email validation request including a hash of a sender address of the email, and the requestor transmitting the email validation request in response to receiving the email;   determine whether the hash of the sender address matches a hash of an email address in the list of hashed contacts;   generate, in response to determining that the sender address is not in the list of hashed contacts, a message indicating that the email is not valid;   generate, in response to determining that the sender address is in the list of hashed contacts, the message indicating that the email is valid; and   transmit the message to the requestor.   
     
     
         17 . A non-transitory computer readable storage medium, comprising instructions stored thereon, that when executed by a processor, cause the processor to:
 receive an email validation request from a requestor to validate an email, the email validation request indicating at least a sender domain indicating a domain of the sender of the email;   access registration data of the sender domain by querying a registration data protocol;   determine whether the sender domain is in a whitelist of known domains, wherein a known domain is a domain that is linked to an organization whose provenance is known, such that the domain can be linked to an identifiable entity in the real world;   determine an action based on whether the sender domain is in the list of known domains and based on a recipient of the email according to a policy that sets forth actions for different recipients; and   perform the action that is different for different recipients.   
     
     
         18 . The non-transitory computer readable storage medium of  claim 17  comprising further instructions stored thereon, that when executed by a processor, cause the processor to:
 receive, from a client device of a user, a list of hashed contacts, the list of hashed contacts including hashes of email addresses hashed using a secret key, the email addresses being from open sign-up domains, an open sign up domain being a domain at which any user can sign up for an email address account; 
 store the list of hashed contacts; 
 receive, from the requestor, a second email validation request to validate an email, the second email validation request including a hash of a sender address of the email, and the requestor transmitting the email validation request in response to receiving the email; 
 determine whether the hash of the sender address matches a hash of an email address in the list of hashed contacts; 
 generate, in response to determining that the sender address is not in the list of hashed contacts, a message indicating that the email is not valid; 
 generate, in response to determining that the sender address is in the list of hashed contacts, the message indicating that the email is valid; and 
 transmit the message to the requestor. 
 
     
     
         19 . The method of  claim 1 , further comprising:
 determining whether the registration data of the sender domain includes contact information that can be traced to a real would location; and   adding, in response to a determination that the registration data includes contact information that can be traced to a real world location, the sender domain to the whitelist of known domains.   
     
     
         20 . The method of  claim 1 , further comprising:
 determining a duration of time that a registration of the registration data of the sender domain has not been changed; and   adding, in response to a determination that the duration of time exceeds a threshold duration, the sender domain to the whitelist of known domains.