Methods and systems for managing delivery of email to local recipients using local reputations

• US 9,258,269 B1
• Filed: 03/25/2009
• Issued: 02/09/2016
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Ashley, Peter
• Primary Examiner(s): Tiv, Backhean
• Application Number:
  US12/411,146
• Time in Patent Office: 2,512 Days
• Field of Search: 709/206, 709/207, 709/217
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/37 E-mail addresses
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A computer-implemented method for managing delivery of email to local recipients. The computer-implemented method may include establishing a local reputation for an email sender address. The method may include storing a domain-name-system record associated with the local reputation on a domain-name system. The domain-name system may be mail-transfer agent agnostic. The method may also include identifying one or more emails sent from the email sender address to one or more local recipients. The method may include forming a spam verdict for each of the one or more emails by analyzing contents of each of the one or more emails. The method may additionally include updating the local reputation for the email sender address based on the one or more spam verdicts.

Claims

1. A computer-implemented method for managing delivery of email to local recipients, at least a portion of the method being performed by a computing system comprising at least one processor, the method comprising:

establishing, at a domain-name system, a local reputation for an email sender address;

storing a domain-name-system record associated with the local reputation on the domain-name system;

receiving, at the domain-name system, from a mail-transfer agent as part of a mail-transfer system, a request for the domain-name-system record associated with the email sender address;

determining, by the domain-name system and based on the local reputation, not to send the domain-name-system record associated with the email sender address to the mail-transfer agent;

determining, by the mail-transfer system, that a response to the request was not received from the domain-name system;

forming a spam verdict, by the mail-transfer system, of an email sent from the email sender address for which the mail-transfer system had failed to receive the domain-name-system record;

transmitting, by the mail-transfer agent to the domain-name system, the spam verdict to the domain-name system as feedback;

updating, by the domain-name system, the local reputation based on the spam verdict received from the mail-transfer agent after the mail-transfer agent failed to receive the domain-name-system record.

2. The computer-implemented method of claim 1, wherein:

the domain-name system is mail-transfer agent agnostic.

3. The computer-implemented method of claim 1, wherein the determining not to send the domain-name-system record is based on the content of the local reputation.

4. The method of claim 1, wherein the mail-transfer system forms the spam verdict of the email by scanning content of the email to determine whether at least one characteristic identifier indicative of spam emails is present in the email.

5. A computer-implemented method for managing delivery of email to local recipients, at least a portion of the method being performed by a computing system comprising at least one processor, the method comprising:

receiving, from a mail-transfer agent, a request for a domain-name-system record associated with an email sender address;

identifying the domain-name-system record;

identifying a local reputation associated with the domain-name-system record;

determining, based on the local reputation, whether to send the domain-name-system record to the mail-transfer agent, wherein a negative local reputation is associated with a higher threshold number for sending the domain-name-system record, where the threshold number indicates a number of times for sending the domain-name-system record until refraining from doing so.

6. The computer-implemented method of claim 5, further comprising:

receiving, at a domain-name system, an internet protocol address of the domain name of the email sender address;

identifying the domain-name-system record on the domain-name system;

wherein;

determining whether to send the domain-name-system record to the mail-transfer agent is performed at the domain-name system.

7. The computer-implemented method of claim 5, further comprising:

receiving, at a domain-name-system proxy, an internet protocol address of the domain name of the email sender address;

sending the internet protocol address from the domain-name-system proxy to a domain-name-system server;

receiving, at the domain-name-system proxy, the domain-name-system record, the domain-name-system record being received from the domain-name-system server;

wherein;

determining whether to send the domain-name-system record to the mail-transfer agent is performed at the domain-name-system proxy.

8. The computer-implemented method of claim 5, further comprising:

receiving feedback information associated with the email sender address;

updating the local reputation based on the feedback information.

9. The computer-implemented method of claim 8, wherein:

the feedback information comprises information about the email sender address obtained by scanning content of at least one email sent from the email sender address.

10. The computer-implemented method of claim 5, wherein:

receiving, from the mail-transfer agent, the request for the domain-name-system record associated with the email sender address further comprises;

receiving, from one or more mail-transfer agents, a plurality of requests for the domain-name-system record associated with the email sender address.

11. The computer-implemented method of claim 10, further comprising:

responding to a first percentage of the plurality of requests by sending the domain-name-system record to the one or more mail-transfer agents;

responding to a second percentage of the plurality of requests by refraining from sending the domain-name-system record to the one or more mail-transfer agents.

12. The computer-implemented method of claim 10, further comprising:

responding to a first number of the plurality of requests by sending the domain-name-system record to the one or more mail-transfer agents;

responding to a second number of the plurality of requests by refraining from sending the domain-name-system record to the one or more mail-transfer agents.

13. The computer-implemented method of claim 5, further comprising:

storing the domain-name-system record on a domain-name system, the domain-name system being mail-transfer agent agnostic.

14. The computer-implemented method of claim 13, wherein:

receiving, from the mail-transfer agent, the request for the domain-name-system record associated with the email sender address is performed by at least one of;

the domain-name system;

a domain-name-system proxy.

15. The computer-implemented method of claim 5, further comprising:

identifying one or more emails sent from the email sender address to one or more local recipients;

forming a spam verdict for each of the one or more emails by analyzing contents of each of the one or more emails;

updating the local reputation for the email sender address based on the one or more spam verdicts.

16. The computer-implemented method of claim 5, wherein:

the local reputation comprises a policy of sending the domain-name-system record to the mail-transfer agent in response to not more than a specified percentage of requests for the domain-name-system record.

17. A system for managing delivery of email to local recipients, the system comprising:

a domain-name-system database that stores a domain-name-system record associated with a local reputation for an email sender address, the domain-name-system database being located on a domain-name system;

a reputation-management module programmed to;

establish the local reputation for the email sender address;

receive, from a mail-transfer agent, a request for the domain-name-system record;

identify the domain-name-system record;

identify the local reputation, the local reputation being associated with the domain-name-system record;

determine, based on the local reputation, whether to send the domain-name-system record to the mail-transfer agent, wherein a negative local reputation is associated with a higher threshold number for sending the domain-name-system record, where the threshold number indicates a number of times for sending the domain-name-system record until refraining from doing so;

an email-transfer module programmed to identify one or more emails sent from the email sender address to one or more local recipients;

an email analysis module programmed to form a spam verdict for each of the one or more emails by analyzing contents of each of the one or more emails;

wherein the reputation-management module is programmed to update the local reputation for the email sender address based on the one or more spam verdicts;

one or more processors configured to execute the reputation-management module, the email-transfer module, and the email analysis module.

18. The system of claim 17, wherein:

the local reputation comprises a policy of sending the domain-name-system record to the mail-transfer agent in response to not more than a specified percentage of requests for the domain-name-system record.

19. The system of claim 17, wherein the reputation-management module is programmed to:

perform a modulation technique by sending the domain-name-system record until the threshold number has been reached and then refraining from sending the domain-name-system record for a specified period.

20. The system of claim 17, wherein the reputation-management module is programmed to:

receive, at a domain-name-system proxy, an internet protocol address of the domain name of the email sender address;

send the internet protocol address from the domain-name-system proxy to a domain-name-system server;

receive, at the domain-name-system proxy, the domain-name-system record, the domain-name-system record being received from the domain-name-system server.