Techniques for determining the reputation of a message sender

• US 20060031314A1
• Filed: 05/28/2004
• Published: 02/09/2006
• Est. Priority Date: 05/28/2004
• Status: Active Grant

• Current Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Original Assignee: IronPort Systems Inc (Cisco Systems, Inc.)
• Inventors: Sprosts, Craig, Quinlan, Daniel, Brahms, Robert
• Granted Patent: US 7,756,930 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Techniques are provided for determining a reputation of a message sender by obtaining two or more lists from two or more list providers; determining which lists of the two or more lists indicate the message sender; and determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender. Techniques are also provided for indicating that a message is unsolicited based on a reputation score.

Claims

1. A method of determining a reputation of a message sender comprising the machine-implemented steps of:

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender; and

determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender.

2. The method of claim 1, wherein the method further comprises the step of storing information from the two or more lists in an aggregate list data structure, and wherein the step of determining what lists indicate the message sender comprises the step of querying the aggregate list data structure.

3. The method of claim 2, wherein a particular list is one of the two or more lists and the particular list contains one or more entries, and wherein the step of storing information from the two or more lists in the aggregate list data structure comprises the steps of:

determining the difference of the particular list with a previous version of the particular list;

storing entries of the particular list that were not in the previous version of the particular list in the aggregate list data structure; and

removing from the aggregate list data structure entries that are not in the particular list but were in the previous version of the particular list.

4. The method of claim 1, wherein the step of determining the reputation score comprises the steps of:

determining an individual score for each list of the two or more lists; and

determining an output score based on the individual score for each list in the two or more lists.

5. The method of claim 4, wherein the step of determining the output score comprises the steps of:

determining an aggregate score based on the individual score for each list of the two or more lists;

determining a normalized score based on the aggregate score; and

determining the output score based on the normalized score.

6. The method of claim 5, wherein the individual score for each list in the two or more lists each comprises an individual probability and a list of probabilities comprises the individual probability for each list in the two or more lists, and wherein the step of determining the aggregate score based on the individual score for each list of the two or more lists comprises performing a Chi Squared calculation on the list of probabilities.

7. The method of claim 1, wherein the method further comprises the step of receiving a request for the reputation of the message sender.

8. The method of claim 7, wherein the step of receiving the request for the reputation of the message sender comprises receiving a request formatted as a DNS request.

9. The method of claim 1, wherein the message sender is associated with a particular IP address and the step of determining what lists of the two or more lists indicate the message sender comprises determining for a particular list of the two or more lists whether the particular IP address of the message sender is contained in an IP address range indicated by the particular list.

10. The method of claim 1, further comprising the step of, if a particular list indicates an IP address range, setting a bit corresponding to the particular list in a particular list bit mask data structure corresponding to the IP address range.

11. The method of claim 10, wherein the step of setting the bit corresponding to the particular list is performed for each list of the two or more lists, and wherein sender corresponds to a particular IP address, the particular IP address is contained within a first IP address range that has associated with it a first list bit mask, the IP address is contained within a second IP address range associated with a second list bit mask, and the method further comprises the step of determining which lists of the two or more lists indicate the message sender by performing the steps of:

performing an or operation on the first list bit mask and second list bit mask to produce a third list bit mask; and

determining what bits are set in the third list bit mask.

12. A method comprising the machine-implemented steps of:

receiving a message from a message sender;

obtaining a reputation score of the message sender, wherein the reputation score of the message sender was determined by performing the steps of;

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender;

determining the reputation score for the message sender based on which lists of the two or more lists indicate the message sender; and

if the reputation score is worse than a first predefined threshold, performing a specified action associated with responding to an unsolicited message.

13. The method of claim 12, wherein the step of performing the specified action comprises indicating that the message is unsolicited.

14. The method of claim 12, wherein the step of performing the specified action comprises deleting the message.

15. The method of claim 12, wherein the step of performing the specified action comprises moving the message into a trash message folder.

16. The method of claim 12, wherein the step of performing the specified action comprises moving the message into a bulk mail message folder.

17. The method of claim 12, wherein the step of performing the specified action comprises associating the message with a first flag, wherein the first flag indicates that the message is estimated to be unsolicited.

18. The method of claim 12, wherein the method further comprises the step of:

if the reputation score is better than a second predefined threshold, performing a second specified action associated with responding to messages that are not unsolicited, wherein the first predefined threshold is different from the second predefined threshold.

19. The method of claim 18, wherein the step of performing the second specified action comprises indicating that the message is valid.

20. The method of claim 18, wherein the message is associated with a message recipient, and wherein the step of performing the second specified action comprises sending the message to the message recipient.

21. The method of claim 18, wherein the step of performing the second specified action comprises performing one or more filter operations on the message.

22. The method of claim 18, wherein the step of performing the second specified action comprises associating the message with a second flag, wherein the second flag indicates that the message is estimated to be valid.

23. The method of claim 18, wherein the method further comprises the step of:

if the reputation score is better than the first predefined threshold and worse than the second predefined threshold, performing a third specified action.

24. The method of claim 23, wherein the step of performing the third specified action comprises indicating that the message has a first quality, where the first quality indicates that the message is not estimated as valid and the message is not indicated as invalid.

25. The method of claim 23, wherein the step of performing the third specified action comprises performing one or more filter operations on the message.

26. The method of claim 23, wherein the message is associated with a message recipient, and wherein the step of performing the third specified action comprises sending the message to the message recipient.

27. The method of claim 23, wherein the step of performing the third specified action comprises associating with the message a third flag, wherein the third flag indicates that the message is not estimated to be either valid or invalid.

28. The method of claim 12, wherein the method further comprises the step of sending a request for the reputation score of the message sender to a service for determining the reputation of the message sender, and wherein the step of obtaining the reputation score of the message sender comprises receiving a response to the request for the reputation score of the message sender from the service for determining a reputation of the message sender.

29. The method of claim 28, wherein the step of sending the request for the reputation score of the message sender comprises sending a DNS request and receiving the response to the request for the reputation score of the message sender comprises receiving a DNS response.

30. A machine-readable medium carrying one or more sequences of instructions for determining a reputation of a message sender, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender; and

determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender.

31. A machine-readable medium as recited in claim 30, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of storing information from the two or more lists in an aggregate list data structure, and wherein the step of determining what lists indicate the message sender comprises the step of querying the aggregate list data structure.

32. A machine-readable medium as recited in claim 31, wherein a particular list is one of the two or more lists and the particular list contains one or more entries, and wherein the step of storing information from the two or more lists in the aggregate list data structure comprises the steps of:

determining the difference of the particular list with a previous version of the particular list;

storing entries of the particular list that were not in the previous version of the particular list in the aggregate list data structure; and

removing from the aggregate list data structure entries that are not in the particular list but were in the previous version of the particular list.

33. The machine-readable medium of claim 30, wherein the step of determining the reputation score comprises the steps of:

determining an individual score for each list of the two or more lists; and

determining an output score based on the individual score for each list in the two or more lists.

34. The machine-readable medium of claim 33, wherein the step of determining the output score comprises the steps of:

determining an aggregate score based on the individual score for each list of the two or more lists;

determining a normalized score based on the aggregate score; and

determining the output score based on the normalized score.

35. The machine-readable medium of claim 34, wherein the individual score for each list in the two or more lists each comprises an individual probability and a list of probabilities comprises the individual probability for each list in the two or more lists, and wherein the step of determining the aggregate score based on the individual score for each list of the two or more lists comprises performing a Chi Squared calculation on the list of probabilities.

36. The machine-readable medium of claim 30, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of receiving a request for the reputation of the message sender.

37. The machine-readable medium of claim 36, wherein the step of receiving the request for the reputation of the message sender comprises receiving a request formatted as a DNS request.

38. The machine-readable medium of claim 30, wherein the message sender is associated with a particular IP address and the step of determining what lists of the two or more lists indicate the message sender comprises determining for a particular list of the two or more lists whether the particular IP address of the message sender is contained in an IP address range indicated by the particular list.

39. The machine-readable medium of claim 30, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of, if a particular list indicates an IP address range, setting a bit corresponding to the particular list in a particular list bit mask data structure corresponding to the IP address range.

40. The machine-readable medium of claim 39, wherein the step of setting the bit corresponding to the particular list is performed for each list of the two or more lists, and wherein sender corresponds to a particular IP address, the particular IP address is contained within a first IP address range that has associated with it a first list bit mask, the IP address is contained within a second IP address range associated with a second list bit mask, and wherein the machine-readable medium further comprises instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of determining which lists of the two or more lists indicate the message sender by performing the steps of:

performing an or operation on the first list bit mask and second list bit mask to produce a third list bit mask; and

determining what bits are set in the third list bit mask.

41. A machine-readable medium carrying one or more sequences of instructions, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a message from a message sender;

obtaining a reputation score of the message sender, wherein the reputation score of the message sender was determined by performing the steps of;

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender;

determining the reputation score for the message sender based on which lists of the two or more lists indicate the message sender; and

if the reputation score is worse than a first predefined threshold, performing a specified action associated with responding to an unsolicited message.

42. The machine-readable medium of claim 41, wherein the step of performing the specified action comprises indicating that the message is unsolicited.

43. The machine-readable medium of claim 41, wherein the step of performing the specified action comprises deleting the message.

44. The machine-readable medium of claim 41, wherein the step of performing the specified action comprises moving the message into a trash message folder.

45. The machine-readable medium of claim 41, wherein the step of performing the specified action comprises moving the message into a bulk mail message folder.

46. The machine-readable medium of claim 41, wherein the step of performing the specified action comprises associating the message with a first flag, wherein the first flag indicates that the message is estimated to be unsolicited.

47. The machine-readable medium of claim 41, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

if the reputation score is better than a second predefined threshold, performing a second specified action associated with responding to messages that are not unsolicited, wherein the first predefined threshold is different from the second predefined threshold.

48. The machine-readable medium of claim 47, wherein the step of performing the second specified action comprises indicating that the message is valid.

49. The machine-readable medium of claim 47, wherein the message is associated with a message recipient, and wherein the step of performing the second specified action comprises sending the message to the message recipient.

50. The machine-readable medium of claim 47, wherein the step of performing the second specified action comprises performing one or more filter operations on the message.

51. The machine-readable medium of claim 47, wherein the step of performing the second specified action comprises associating the message with a second flag, wherein the second flag indicates that the message is estimated to be valid.

52. The machine-readable medium of claim 47, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

if the reputation score is better than the first predefined threshold and worse than the second predefined threshold, performing a third specified action.

53. The machine-readable medium of claim 52, wherein the step of performing the third specified action comprises indicating that the message has a first quality, where the first quality indicates that the message is not estimated as valid and the message is not indicated as invalid.

54. The machine-readable medium of claim 52, wherein the step of performing the third specified action comprises performing one or more filter operations on the message.

55. The machine-readable medium of claim 52, wherein the message is associated with a message recipient, and wherein the step of performing the third specified action comprises sending the message to the message recipient.

56. The machine-readable medium of claim 52, wherein the step of performing the third specified action comprises associating with the message a third flag, wherein the third flag indicates that the message is not estimated to be either valid or invalid.

57. The machine-readable medium of claim 41, further comprising instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of sending a request for the reputation score of the message sender to a service for determining the reputation of the message sender, and wherein the step of obtaining the reputation score of the message sender comprises receiving a response to the request for the reputation score of the message sender from the service for determining a reputation of the message sender.

58. The machine-readable medium of claim 57, wherein the step of sending the request for the reputation score of the message sender comprises sending a DNS request and receiving the response to the request for the reputation score of the message sender comprises receiving a DNS response.

59. An apparatus for determining a reputation of a message sender, comprising:

means for obtaining two or more lists from two or more list providers;

means for determining which lists of the two or more lists indicate the message sender; and

means for determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender.

60. The apparatus of claim 59, further comprising means for storing information from the two or more lists in an aggregate list data structure, and wherein the means for determining what lists indicate the message sender comprises means for querying the aggregate list data structure.

61. The apparatus of claim 60, wherein a particular list is one of the two or more lists and the particular list contains one or more entries, and wherein the means for storing information from the two or more lists in the aggregate list data structure comprises:

means for determining the difference of the particular list with a previous version of the particular list;

means for storing entries of the particular list that were not in the previous version of the particular list in the aggregate list data structure; and

means for removing from the aggregate list data structure entries that are not in the particular list but were in the previous version of the particular list.

62. The apparatus of claim 59, wherein the means for determining the reputation score comprises:

means for determining an individual score for each list of the two or more lists; and

means for determining an output score based on the individual score for each list in the two or more lists.

63. The apparatus of claim 62, wherein the means for determining the output score comprises:

means for determining an aggregate score based on the individual score for each list of the two or more lists;

means for determining a normalized score based on the aggregate score; and

means for determining the output score based on the normalized score.

64. The apparatus of claim 63, wherein the individual score for each list in the two or more lists each comprises an individual probability and a list of probabilities comprises the individual probability for each list in the two or more lists, and wherein the means for determining the aggregate score based on the individual score for each list of the two or more lists comprises means for performing a Chi Squared calculation on the list of probabilities.

65. The apparatus of claim 59, further comprising means for receiving a request for the reputation of the message sender.

66. The apparatus of claim 65, wherein the means for receiving the request for the reputation of the message sender comprises means for receiving a request formatted as a DNS request.

67. The apparatus of claim 59, wherein the message sender is associated with a particular IP address and the means for determining what lists of the two or more lists indicate the message sender comprises means for determining for a particular list of the two or more lists whether the particular IP address of the message sender is contained in an IP address range indicated by the particular list.

68. The apparatus of claim 59, further comprising means for setting a bit corresponding to a particular list in a particular list bit mask data structure corresponding to an IP address range if the particular list indicates the IP address range.

69. The apparatus of claim 68, wherein the means for setting the bit corresponding to the particular list comprises means for setting the bit corresponding to each list of the two or more lists, and wherein sender corresponds to a particular IP address, the particular IP address is contained within a first IP address range that has associated with it a first list bit mask, the IP address is contained within a second IP address range associated with a second list bit mask, and the apparatus further comprises means for determining which lists of the two or more lists indicate the message sender, and the means for determining which lists of the two or more lists indicate the message sender comprises:

means for performing an or operation on the first list bit mask and second list bit mask to produce a third list bit mask; and

means for determining what bits are set in the third list bit mask.

70. An apparatus comprising:

means for receiving a message from a message sender;

means for obtaining a reputation score of the message sender, wherein the reputation score of the message sender was determined by performing the steps of;

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender;

determining the reputation score for the message sender based on which lists of the two or more lists indicate the message sender; and

means for performing a specified action associated with responding to an unsolicited message, if the reputation score is worse than a first predefined threshold.

71. The apparatus of claim 70, wherein the means for performing the specified action comprises means for indicating that the message is unsolicited.

72. The apparatus of claim 70, wherein the means for performing the specified action comprises means for deleting the message.

73. The apparatus of claim 70, wherein the means for performing the specified action comprises means for moving the message into a trash message folder.

74. The apparatus of claim 70, wherein the means for performing the specified action comprises means for moving the message into a bulk mail message folder.

75. The apparatus of claim 70, wherein the means for performing the specified action comprises means for associating the message with a first flag, wherein the first flag indicates that the message is estimated to be unsolicited.

76. The apparatus of claim 70, wherein the apparatus further comprises:

means for performing a second specified action associated with responding to messages that are not unsolicited, if the reputation score is better than a second predefined threshold, wherein the first predefined threshold is different from the second predefined threshold.

77. The apparatus of claim 76, wherein the means for performing the second specified action comprises means for indicating that the message is valid.

78. The apparatus of claim 76, wherein the message is associated with a message recipient, and wherein the means for performing the second specified action comprises means for sending the message to the message recipient.

79. The apparatus of claim 76, wherein the means for performing the second specified action comprises means for performing one or more filter operations on the message.

80. The apparatus of claim 76, wherein the means for performing the second specified action comprises means for associating the message with a second flag, wherein the second flag indicates that the message is estimated to be valid.

81. The apparatus of claim 76, wherein the apparatus further comprises:

means for performing a third specified action, if the reputation score is better than the first predefined threshold and worse than the second predefined threshold.

82. The apparatus of claim 81, wherein the means for performing the third specified action comprises means for indicating that the message has a first quality, where the first quality indicates that the message is not estimated as valid and the message is not indicated as invalid.

83. The apparatus of claim 81, wherein the means for performing the third specified action comprises means for performing one or more filter operations on the message.

84. The apparatus of claim 81, wherein the message is associated with a message recipient, and wherein the means for performing the third specified action comprises means for sending the message to the message recipient.

85. The apparatus of claim 81, wherein the means for performing the third specified action comprises means for associating with the message a third flag, wherein the third flag indicates that the message is not estimated to be either valid or invalid.

86. The apparatus of claim 70, wherein the apparatus further comprises means for sending a request for the reputation score of the message sender to a service for determining the reputation of the message sender, and wherein the means for obtaining the reputation score of the message sender comprises means for receiving a response to the request for the reputation score of the message sender from the service for determining a reputation of the message sender.

87. The apparatus of claim 86, wherein the means for sending the request for the reputation score of the message sender comprises means for sending a DNS request and the means for receiving the response to the request for the reputation score of the message sender comprises means for receiving a DNS response.

88. An apparatus for determining a reputation of a message sender, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender; and

determining a reputation score for the message sender based on which lists of the two or more lists indicate the message sender.

89. The apparatus of claim 88, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of storing information from the two or more lists in an aggregate list data structure, and wherein the step of determining what lists indicate the message sender comprises the step of querying the aggregate list data structure.

90. The apparatus of claim 89, wherein a particular list is one of the two or more lists and the particular list contains one or more entries, and wherein the step of storing information from the two or more lists in the aggregate list data structure comprises the steps of:

determining the difference of the particular list with a previous version of the particular list;

storing entries of the particular list that were not in the previous version of the particular list in the aggregate list data structure; and

removing from the aggregate list data structure entries that are not in the particular list but were in the previous version of the particular list.

91. The apparatus of claim 88, wherein the step of determining the reputation score comprises the steps of:

determining an individual score for each list of the two or more lists; and

determining an output score based on the individual score for each list in the two or more lists.

92. The apparatus of claim 91, wherein the step of determining the output score comprises the steps of:

determining an aggregate score based on the individual score for each list of the two or more lists;

determining a normalized score based on the aggregate score; and

determining the output score based on the normalized score.

93. The apparatus of claim 92, wherein the individual score for each list in the two or more lists each comprises an individual probability and a list of probabilities comprises the individual probability for each list in the two or more lists, and wherein the step of determining the aggregate score based on the individual score for each list of the two or more lists comprises performing a Chi Squared calculation on the list of probabilities.

94. The apparatus of claim 88, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of receiving a request for the reputation of the message sender.

95. The apparatus of claim 94, wherein the step of receiving the request for the reputation of the message sender comprises receiving a request formatted as a DNS request.

96. The apparatus of claim 88, wherein the message sender is associated with a particular IP address and the step of determining what lists of the two or more lists indicate the message sender comprises determining for a particular list of the two or more lists whether the particular IP address of the message sender is contained in an IP address range indicated by the particular list.

97. The apparatus of claim 88, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of, if a particular list indicates an IP address range, setting a bit corresponding to the particular list in a particular list bit mask data structure corresponding to the IP address range.

98. The apparatus of claim 97, wherein the step of setting the bit corresponding to the particular list is performed for each list of the two or more lists, and wherein sender corresponds to a particular IP address, the particular IP address is contained within a first IP address range that has associated with it a first list bit mask, the IP address is contained within a second IP address range associated with a second list bit mask, and wherein the apparatus further comprises one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of determining which lists of the two or more lists indicate the message sender by performing the steps of:

performing an or operation on the first list bit mask and second list bit mask to produce a third list bit mask; and

determining what bits are set in the third list bit mask.

99. An apparatus for determining a reputation of a message sender, comprising:

a network interface that is coupled to a data network for receiving one or more packet flows therefrom;

a processor;

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

receiving a message from a message sender;

obtaining a reputation score of the message sender, wherein the reputation score of the message sender was determined by performing the steps of;

obtaining two or more lists from two or more list providers;

determining which lists of the two or more lists indicate the message sender;

determining the reputation score for the message sender based on which lists of the two or more lists indicate the message sender; and

if the reputation score is worse than a first predefined threshold, performing a specified action associated with responding to an unsolicited message.

100. The apparatus of claim 99, wherein the step of performing the specified action comprises indicating that the message is unsolicited.

101. The apparatus of claim 99, wherein the step of performing the specified action comprises deleting the message.

102. The apparatus of claim 99, wherein the step of performing the specified action comprises moving the message into a trash message folder.

103. The apparatus of claim 99, wherein the step of performing the specified action comprises moving the message into a bulk mail message folder.

104. The apparatus of claim 99, wherein the step of performing the specified action comprises associating the message with a first flag, wherein the first flag indicates that the message is estimated to be unsolicited.

105. The apparatus of claim 99, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

if the reputation score is better than a second predefined threshold, performing a second specified action associated with responding to messages that are not unsolicited, wherein the first predefined threshold is different from the second predefined threshold.

106. The apparatus of claim 105, wherein the step of performing the second specified action comprises indicating that the message is valid.

107. The apparatus of claim 105, wherein the message is associated with a message recipient, and wherein the step of performing the second specified action comprises sending the message to the message recipient.

108. The apparatus of claim 105, wherein the step of performing the second specified action comprises performing one or more filter operations on the message.

109. The apparatus of claim 105, wherein the step of performing the second specified action comprises associating the message with a second flag, wherein the second flag indicates that the message is estimated to be valid.

110. The apparatus of claim 105, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of:

if the reputation score is better than the first predefined threshold and worse than the second predefined threshold, performing a third specified action.

111. The apparatus of claim 110, wherein the step of performing the third specified action comprises indicating that the message has a first quality, where the first quality indicates that the message is not estimated as valid and the message is not indicated as invalid.

112. The apparatus of claim 110, wherein the step of performing the third specified action comprises performing one or more filter operations on the message.

113. The apparatus of claim 110, wherein the message is associated with a message recipient, and wherein the step of performing the third specified action comprises sending the message to the message recipient.

114. The apparatus of claim 110, wherein the step of performing the third specified action comprises associating with the message a third flag, wherein the third flag indicates that the message is not estimated to be either valid or invalid.

115. The apparatus of claim 99, further comprising one or more stored sequences of instructions which, when executed by the one or more processors, cause the one or more processors to carry out the step of sending a request for the reputation score of the message sender to a service for determining the reputation of the message sender, and wherein the step of obtaining the reputation score of the message sender comprises receiving a response to the request for the reputation score of the message sender from the service for determining a reputation of the message sender.

116. The apparatus of claim 115, wherein the step of sending the request for the reputation score of the message sender comprises sending a DNS request and receiving the response to the request for the reputation score of the message sender comprises receiving a DNS response.