A system and method for domain name system-based metadata extraction in electronic mail authentication protocols

Abstract

A system for domain name system-based metadata extraction in electronic mail authentication protocols is disclosed A receiving mail server module (310) receives an electronic mail from a domain associated with a sender. A domain name system query generation module (315) dynamically expands one or more macro expressions to generate a domain name system query and transmits the domain name system query to a controlled domain name system infrastructure. A controlled domain name system infrastructure module (320) extracts a metadata using a parsing engine during processing of the domain name system query. The metadata is stored in a structured format. A cloud-based logging infrastructure module (325) is configured to store the corresponding domain name system query, and the metadata in a structured data storage system. An analytics and visualization dashboard module (330) displays the corresponding domain name system query, and the metadata to an authorized user.

Description

[0001] A SYSTEM AND METHOD FOR DOMAIN NAME SYSTEM-BASED METADATA EXTRACTION IN ELECTRONIC MAIL AUTHENTICATION PROTOCOLS

[0002] CROSS REFERENCE TO RELATED APPLICATION

[0003] This application is related to Indian Provisional Application 202511036557 filed April 15, 2025, entitled “A SYSTEM AND A METHOD FOR REAL TIME ELECTRONIC MAIL AUTHENTICATION AND SENDER METADATA VALIDATION”, and which are incorporated herein by reference.

[0004] FIELD OF INVENTION

[0005] The present invention relates to the field of electronic mail authentication systems. More particularly, the present invention relates to a system and method for domain name system-based metadata extraction in electronic mail authentication protocols.

[0006] BACKGROUND

[0007] Electronic mail (email) has been a primary form of digital communication since mid-twentieth century and has evolved into an essential tool for both personal and professional interactions. Due to its widespread adoption, email has also become a target for various malicious activities such as phishing, spoofing, and unauthorized access to confidential data. Ensuring the security of the electronic mail is essential for protecting confidential data, preventing fraud, and maintaining trust in the digital communication. Therefore, email security systems have become a cornerstone of protecting the digital communication from the various malicious activities and ensuring secure and reliable communication between a sender and a receiver.

[0008] Conventional email security mechanisms, such as a Sender Policy Framework (SPF) and a Domain-based Message Authentication, Reporting, and Conformance(DMARC), are designed to verify legitimacy of an incoming electronic mail by checking sender Internet Protocol (IP) addresses and domain records. Collectively the above said email security mechanisms protect against phishing attacks and unauthorized use of email by matching a sender's domain with a claimed sender, preventing malicious actors from impersonating legitimate email sources. However, the email security mechanisms has limitations in capturing comprehensive metadata related to email transactions. Specifically, conventional SPF and DMARC security mechanism do not capture sender’s full email address or a recipient’s domain name. This oversight limits the system’s ability to provide a thorough analysis of email communication. The absence of such critical metadata impairs the system’s ability to fully correlate email interactions, making it difficult for security teams to investigate suspicious activities or respond promptly to emerging threats. This lack of detailed visibility into email exchanges represents a significant gap in the current security infrastructure.

[0009] Moreover, in environments with high email traffic volumes or where advanced phishing and spoofing attacks are common, the existing email security mechanisms are not significant with respect to accuracy. Furthermore, without capturing the full email address and receiver’s domain name, security systems cannot track the path of malicious activities across different domains or perform detailed forensic analysis. As a result, even though SPF and DMARC may flag few fraudulent emails, fall short when it comes to detecting sophisticated, multistage attacks that involve carefully crafted email headers and addresses. This creates a gap in the security posture, leaving systems vulnerable to new forms of email-based threats. To address the above limitations, there is a need for a significant and comprehensive solution adapted to address by incorporating detailed monitoring and analysis techniques.

[0010] Existing email security mechanisms, including DMARC, have several limitations with respect to outbound email visibility and spoof detection. DMARC reports are delayed, typically up to 24 hours, preventing real-time monitoring of outbound emails and identification of the actual sender, recipient, or content present withinthe email. Additionally, DMARC is unable to detect or prevent attacks in which a source’s DomainKeys Identified Mail (DKIM) key has been compromised, allowing unauthorized emails to be sent from the domain without immediate detection. Consequently, current systems lack sufficient forensic capabilities to analyse internal spoofing attacks, such as chief executive officer (CEO) frauds or Business Email Compromise (BEC), leaving organizations vulnerable to impersonation and advanced email-based threats.

[0011] Hence, there is a need for an improved a system and method for domain name system-based metadata extraction in electronic mail authentication protocols to address the aforementioned issue(s).

[0012] OBJECTIVES OF THE INVENTION

[0013] The primary objective of the invention is to extract detailed sender and receiver information, complete email addresses and domains, during DNS-based SPF validation to detect unauthorized or spoofed electronic mails.

[0014] Another objective of the invention is to generate real-time logs and reports that allow security teams to monitor, query, and investigate suspicious email activity.

[0015] Yet another objective is to enable instant detection and forensic analysis of outbound email attacks, thereby enhancing security of email communication and preventing impersonation or spoofing attacks.

[0016] SUMMARY

[0017] In accordance with an embodiment of the present disclosure, a system for domain name system-based metadata extraction in electronic mail authentication protocols is disclosed. The system comprising a processor, and a memory coupled to the processor. The memory comprises instructions that when executed by the processor cause the processor to receive an electronic mail from a domain associated with a sender to identify unauthorized electronic mail transmission. The processor is also caused to dynamically expand one or more macroexpressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query. Further, the processor is caused to transmit the domain name system query to a controlled domain name system infrastructure for a sender policy framework validation. Furthermore, the controlled domain name system infrastructure is configured to extract a metadata from the one or more macro expressions pertaining to the sender and a receiver during processing of the domain name system query to correlate the metadata with an authorized sender. Moreover, the controlled domain name system infrastructure is configured to validate consistency between the metadata and the sender to generate a validation result indicative of whether the electronic mail originates from an authorized sender. Additionally, the controlled domain name system infrastructure is configured to verify the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender to determine compliance of the electronic mail. Further, the controlled domain name system infrastructure is configured to store the validation result, the corresponding domain name system query, the metadata and a domain-based message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail. Furthermore, the controlled domain name system infrastructure is configured to display the validation result, the corresponding domain name system query, the metadata, and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user.

[0018] In accordance with an embodiment of the present disclosure, a method for domain name system-based metadata extraction in electronic mail authentication protocols is disclosed. The method includes receiving an electronic mail from a domain associated with a sender to identify unauthorized electronic mail transmission. The method also includes dynamically expanding one or more macro expressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query. Further, the method includes transmitting the domain name system query to a controlled domain namesystem infrastructure for a sender policy framework validation. Furthermore, the method includes extracting a metadata from the one or more macro expressions pertaining to the sender and a receiver during processing of the domain name system query to correlate the metadata with an authorized sender. Moreover, the method includes validating consistency between the metadata and the sender to generate a validation result indicative of whether the electronic mail originates from an authorized sender. Additionally, the method includes verifying the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender to determine compliance of the electronic mail. The method includes storing the validation result, the corresponding domain name system query, the metadata and a domain-based message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail. The method also includes displaying the validation result, the corresponding domain name system query, the metadata, and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user.

[0019] To further clarify the advantages and features of the present disclosure, a more particular description of the disclosure will follow by reference to specific embodiments thereof, which are illustrated in the appended figures. It is to be appreciated that these figures depict only typical embodiments of the disclosure and are therefore not to be considered limiting in scope. The disclosure will be described and explained with additional specificity and detail with the appended figures.

[0020] BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The disclosure will be described and explained with additional specificity and detail with the accompanying figures in which:

[0022] FIG. 1 illustrates a network environment for implementing example techniques of a system for domain name system-based metadata extraction in electronic mailauthentication protocols in accordance with an embodiment of the present disclosure;

[0023] FIG. 2 illustrates a schematic diagram of a user device, in accordance with an example implementation of the present subject matter;

[0024] FIG. 3 illustrates a schematic diagram of a system for domain name system-based metadata extraction in electronic mail authentication protocols of FIG. 1, in accordance with an embodiment of the present disclosure;

[0025] FIG. 4 illustrates an end-to-end sequence diagram of domain-name system-based email authentication of FIG. 1, in accordance with an embodiment of the present disclosure;

[0026] FIG. 5 (a) illustrates a flow chart representing the steps involved in a method for domain name system-based metadata extraction in electronic mail authentication protocols in accordance with an embodiment of the present disclosure; and

[0027] FIG. 5(b) illustrates continued steps of the method of FIG. 4(a) in accordance with an embodiment of the present disclosure.

[0028] Further, those skilled in the art will appreciate that elements in the figures are illustrated for simplicity and may not have necessarily been drawn to scale. Furthermore, in terms of the construction of the device, one or more components of the device may have been represented in the figures by conventional symbols, and the figures may show only those specific details that are pertinent to understanding the embodiments of the present disclosure so as not to obscure the figures with details that will be readily apparent to those skilled in the art having the benefit of the description herein.

[0029] DETAILED DESCRIPTION

[0030] For the purpose of promoting an understanding of the principles of the disclosure, reference will now be made to the embodiment illustrated in the figures and specific language will be used to describe them. It will nevertheless be understoodthat no limitation of the scope of the disclosure is thereby intended. Such alterations and further modifications in the illustrated system, and such further applications of the principles of the disclosure as would normally occur to those skilled in the art are to be construed as being within the scope of the present disclosure.

[0031] The terms “comprises”, “comprising”, or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process or method that comprises a list of steps does not include only those steps but may include other steps not expressly listed or inherent to such a process or method. Similarly, one or more devices or subsystems or elements or structures or components preceded by "comprises... a" does not, without more constraints, preclude the existence of other devices, sub-systems, elements, structures, components, additional devices, additional sub-systems, additional elements, additional structures or additional components. Appearances of the phrase "in an embodiment", "in another embodiment" and similar language throughout this specification may, but not necessarily do, all refer to the same embodiment.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this disclosure belongs. The system, methods, and examples provided herein are only illustrative and not intended to be limiting.

[0033] In the following specification and the claims, reference will be made to a number of terms, which shall be defined to have the following meanings. The singular forms “a”, “an”, and “the” include plural references unless the context clearly dictates otherwise.

[0034] FIG. 1 illustrates a network environment (100) for implementing example techniques of a system for domain name system-based metadata extraction in electronic mail authentication protocols in accordance with an embodiment of the present disclosure. Referring to FIG. 1, a sender (135) corresponding to a first user (140) may be communicatively coupled to a system (105). In an embodiment, thesender (135) typically represents a source of an electronic mail transmission and may correspond to an authorized sender, or, in certain scenarios, an unauthorized or compromised source and the receiver (125) corresponding to a second user (130) configured to receive the electronic mail. However, in various embodiments, each of the sender (135) and the receiver (125) may be configured to both transmit and receive the electronic mail and may interchange roles during communication.

[0035] In an embodiment, the electronic mail is transmitted from the sender (135) to the receiver (125) via a network (110) and a receiving mail server (120) at the receiver (125) performs sender policy framework validation, during which one or more macro expressions are dynamically expanded to generate a Domain Name System (DNS) query. The DNS query is further transmitted to a controlled domain name system infrastructure (145) to extract and validate consistency between metadata and the sender (135). In such an embodiment, the DNS query is recorded in a cloud-based logging infrastructure (150). Yet, in one embodiment, a parsing and extraction engine (155) is configured to process the DNS query to extract structured metadata, which is then stored in a data storage (160). Yet, in another embodiment, the structured metadata data is further analysed to generate insights related to email transmission and authentication behavior, and corresponding results are displayed to an authorized user via an analytics and visualization dashboard (165).

[0036] In one embodiment, examples of the sender (135) and the receiver (125) includes, but is not limited to, a mobile phone, desktop computer, portable digital assistant (PDA), smart phone, tablet, ultra-book, netbook, laptop, multi -processor system, microprocessor-based or programmable consumer electronic system, or any other communication device that the first user (140) and the second user (130) may use. It will be appreciated that the system (105) may be presented to the first user (140) and the second user (130) on a corresponding sender (135) and the receiver (125) as a web application accessed through a browser, through a software application on the sender(135) and the receiver (125), or, particularly for smartphones, through a mobile application installed at the smartphone. It will be appreciatedthat, within the context of the disclosure herein, web application refers to a utility implemented on a networked computing system accessible by the sender (135) and the receiver (125) over the Internet (e.g. through browsers) wherein the bulk of the processing takes place at the networked computing system, mobile applications refer to applications installed on smartphones that may communicate with a networked computing system, and a “software” application refers generally to applications other than web browsers installed on other types of the sender (135) and the receiver (125) that may communicate with a networked computing system over the network (110).

[0037] Further, the network (110) may be a single communication network or a combination of multiple communication networks and may use a variety of different communication protocols. The personalized network may be a wireless network, a wired network, or a combination thereof. Examples of such individual personalized networks include, but are not limited to, Global System for Mobile Communication (GSM) network, Universal Mobile Telecommunications System (UMTS) network, Personal Communications Service (PCS) network, Time Division Multiple Access TDMA) network, Code Division Multiple Access (CDMA) network, Next Generation Network (NON), Public Switched Telephone Network (PSTN) and a satellite-based communication networks. Depending on the technology, the personalized network may include various network entities, such as gateways and routers; however, such details have been omitted for the sake of brevity of the present description.

[0038] The system (105) may have a homepage that is presented to the first user (140) and the second user (130) accessing a top-level web address for web applications presented to the first user (140) and the second user (130) in a browser or a welcome screen for software and mobile applications. The homepage may include links to a user log-in interface or general information about the system (105) and the option to register as the first user (140) and the second user (130). It will be appreciated that the presentation of a homepage may not be necessary, for example, if the first user (140) and the second user (130) bypasses it by directlyinputting a web address corresponding to a user log-in page, or if a separate mobile application is designed for users.

[0039] A new or unregistered agent can access the user log-in interface, fill out the login information corresponding to the agent’s account, and indicate that the first user (140) and the second user (130) wish to sign in. It will be appreciated that any conventional registration and log-in techniques for web applications, software application, and mobile applications may be used, whichever is appropriate for the first user (1 0) and the second user (130). While registering the first user (140) and the second user (130)may be prompted to provide username and corresponding user credentials, not limited to, password, geographical location, and contact information and upon receipt of the foregoing information, a corresponding user-profile may be created and stored on a respective database (355) of the system (105).

[0040] In accordance with an embodiment of the present disclosure, a system for domain name system-based metadata extraction in electronic mail authentication protocols is disclosed. The system (105) includes a processor (170), and a memory (175) coupled to the processor (170). The memory (175) comprises instructions that when executed by the processor (170) cause the processor (170) to receive an electronic mail from a domain associated with a sender (135) to identify unauthorized electronic mail transmission. The processor (170) is also caused to dynamically expand one or more macro expressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query. Further, the processor (170) is caused to transmit the domain name system query to a controlled domain name system infrastructure (145) for a sender policy framework validation. Furthermore, the controlled domain name system infrastructure (145) is configured to extract a metadata from the one or more macro expressions pertaining to the sender (135) and a receiver (125) during processing of the domain name system query to correlate the metadata with an authorized sender (135). Moreover, the controlled domain name system infrastructure (145) is configured to validate consistency between the metadataand the sender (135) to generate a validation result indicative of whether the electronic mail originates from an authorized sender (135). Additionally, the controlled domain name system infrastructure (145) is configured to verify the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender (135) to determine compliance of the electronic mail. Further, the controlled domain name system infrastructure (145) is configured to store the validation result, the corresponding domain name system query, the metadata and a domain-based message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail. Furthermore, the controlled domain name system infrastructure (145) is configured to display the validation result, the corresponding domain name system query, the metadata, and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user.

[0041] It may be noted that the foregoing system is an exemplary system and may be implemented as computer executable instructions in any computing or processing environment, including in digital electronic circuitry or in computer hardware, firmware, device driver, or software. As such, the system is not limited to any specific hardware or software configuration.

[0042] FIG. 2 illustrates a schematic diagram of a user device, in accordance with an example implementation of the present subject matter. Referring to FIG. 2, sender (135) may comprise a processor(s) (170), a memory(s) (175) coupled to and accessible by the processor(s) (170), and an interface (190) coupled to the memory(s) (175). The sender (135) disclosed herein may be same as the sender (135) and the receiver described in FIG. 1. The functions of various elements shown in the figs., including any functional blocks labelled as "processor(s)", may be provided through the use of dedicated hardware as well as hardware capable of executing instructions. When provided by a processor (170), the functions may be provided by a single dedicated processor, by a single shared processor, or by aplurality of individual processors, some of which may be shared. Moreover, explicit use of the term "processor" would not be construed to refer exclusively to hardware capable of executing instructions, and may implicitly comprise, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA). Other hardware, standard and / or custom, may also be coupled to the processor(s). The sender (135) and the receiver (125) may further include a display (180) in addition to other components such as, but not limited to, keyboard, sensors, logic circuits etc. Further, the sender (135) and the receiver (125) may include data (145) that may be stored, utilized or generated during the operation of the sender (135) and the receiver (125).

[0043] The memory(s) may be a computer-readable medium, examples of which comprise volatile memory (e.g., RAM), and / or non-volatile memory (e.g., Erasable Programmable read-only memory, i.e. EPROM, flash memory, etc.). The memory(s) may be an external memory, or internal memory, such as a flash drive, a compact disk drive, an external hard disk drive, or the like. The sender (135) may further include the interface (190) that may allow the connection or coupling of the sender (135) and the receiver (125) with one or more other devices, through a wired (e.g., Local Area Network, i.e., LAN) connection or through a wireless connection (e.g., Bluetooth®, Wi-Fi), for example, for connecting to the system (105) shown in FIG. 1. The interface (190) may also enable intercommunication between different logical as well as hardware components of the sender (135) and the receiver (125).

[0044] FIG. 3 illustrates a system for domain name system-based metadata extraction in electronic mail authentication protocols of FIG. 1, in accordance with an embodiment of the present disclosure. Referring to FIG. 3, the system (105) includes a processor(s) (170), a memory(s) (175) coupled to and accessible by the processor(s) (170) database and an interface (190) coupled to the memory(s) (175).The system (105) disclosed herein is based on the network architecture described in FIG. 1. The functions of various elements shown in the figs., including any functional blocks labelled as "processor(s)", may be provided through the use of dedicated hardware as well as hardware capable of executing instructions. When provided by a processor (139), the functions may be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which may be shared. Moreover, explicit use of the term "processor" would not be construed to refer exclusively to hardware capable of executing instructions, and may implicitly comprise, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA). Other hardware, standard and / or custom, may also be coupled to the processor(s) (170). The system (105) may further include other components such as, but not limited to, keyboard, sensors, logic circuits, input / output interfaces etc. Further, the system (105) may include data (not shown) that may be stored, utilized or generated during the operation of the computer implemented system.

[0045] The memory(s) (175) may be a computer-readable medium, examples of which comprise volatile memory (e.g., RAM), and / or non-volatile memory (e.g., Erasable Programmable read-only memory, i.e. EPROM, flash memory, etc.). The memory(s) (175) may be an external memory, or internal memory, such as a flash drive, a compact disk drive, an external hard disk drive, or the like. The system (105) may further include the interface (190) that may allow the connection or coupling of the system (105) with one or more other devices, through a wired (e.g., Local Area Network, i.e., LAN) connection or through a wireless connection (e.g., Bluetooth®, Wi-Fi)., for example, for connecting to the sender (135) and the receiver (125) as shown in FIG. 1. The interface (190) may also enable intercommunication between different logical as well as hardware components of the system (105).

[0046] The system (105) may be provided with a database (355) to store a metadata (345). In an example implementation of the system (105) including one or more servers,the databases may be local to the server or may be remote to the server. It may be noted that the data (185) in the databases may be stored as a table or may be prestored as a mapping with the other. This application is not limited thereto.

[0047] The system (105) may include module(s). The module(s) may include a receiving mail server module (310), a domain name system query generation module (315), a controlled domain name system infrastructure module (320), a cloud-based logging infrastructure module (325), and an analytics and visualization dashboard module (330).

[0048] In one example, the module(s) may be implemented as a combination of hardware and firmware. In an example described herein, such combinations of hardware and firmware may be implemented in several different ways. For example, the firmware for module(s) may be processor (170) executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the module(s) may include a processing resource (for example, implemented as either single processor or combination of multiple processors), to execute such instructions. Further, the hardware for the module(s) may include communication apparatuses, control circuitries involving electrical and electronics components, sensors, and interface devices, which may be in communication with each other for multi-directional communication therebetween.

[0049] In the present examples, the non-transitory machine-readable storage medium may store instructions that, when executed by the processing resource, implement the functionalities of modules(s). In such examples, the system (105) may include the machine-readable storage medium storing the instructions and the processing resource to execute the instructions. In other examples of the present subject matter, the machine-readable storage medium may be located at a different location but accessible to the system (105) and the processor(s) (170).

[0050] In operation, the receiving mail server module (310) is configured to receive an electronic mail from a domain associated with a sender (135, FIG. 1) to identify unauthorized electronic mail transmissions. In an embodiment, the domaincorresponds to a registered domain name associated with an electronic mail address of the sender (135, FIG. 1). Typically, the domain being a portion of the electronic mail address following a predefined delimiter, for example, a domain “company.com” in the electronic mail address “user@company.com. In such an embodiment, the domain is configured with one or more macro expressions. In such an embodiment, the one or more macro expressions includes placeholder variables that are dynamically expandable based on one or more runtime attributes of an electronic mail transmission.

[0051] In such an embodiment, the unauthorized electronic mail transmissions may include electronic mails that are transmitted from the domain without proper authorization, including those originating from spoofed sources, compromised accounts, or unauthorized sending infrastructures.

[0052] The domain name system query generation module (315) is operatively coupled to the receiving mail server module (310). The domain name system query generation module (315) is configured to dynamically expand the one or more macro expressions embedded in a sender policy framework (SPF) record associated with the electronic mail to generate a DNS query. In an embodiment, the SPF record may be configured with a policy containing the one or more macro expressions. In such an embodiment, the one or more expressions may be defined as following:

[0053] v=spfl include:%{i}. ip. %{d}. domain. %{h}._helo.controlled-domain. com-all.

[0054] where, :%{i}, .%{d} and ,%{h} represent macro expressions,

[0055] where, %{i} represents an internet protocol (IP) address of the sender (135, FIG.

[0056] 1),

[0057] %{d} represents a domain associated with the sender (135, FIG. 1), and

[0058] %{h} represents a HELO / EHLO identity declared by a sending mail server during an SMTP (Simple Mail Transfer Protocol) session.In such an embodiment, the one or more macro expressions such as %{i}, %{ d}, and %{h} is replaced with a corresponding runtime value obtained from the electronic mail (sender (135, FIG. 1), including the internet protocol (IP) address of the sender (135, FIG. 1), the domain associated with the sender (135, FIG. 1), and the HELO / EHLO identity declared by the sending mail server.

[0059] In such an embodiment, the DNS query is represented as the following:

[0060] 230.0.113.5. ip.mail.example.com. domain. Mx. Receiver.com. help. control led-domain.com

[0061] Further, the domain name system query generation module (315) is configured to transmit the domain name system query to a controlled domain name system infrastructure for a sender policy framework validation. In such an embodiment, the controlled domain name system infrastructure (145, FIG. l)may be a controlled authoritative DNS server or a cloud-based DNS logging infrastructure. In such an embodiment, the domain name system query generation module (315) is configured to capture one or more attributes associated with the DNS query. The one or more attributes includes, but is not limited to a query name corresponding to the constructed DNS query, a resolver internet protocol (IP) address indicative of the sender (135, FIG. 1) of the DNS query, a timestamp representing a time of the DNS query generation or receipt, and the metadata (345) derived from the expanded macro expressions.

[0062] A controlled domain name system infrastructure module (320) is operatively coupled to the domain name system query generation module (315). The controlled domain name system infrastructure module (320) is configured to extract the metadata (345) from the one or more macro expressions using a parsing engine module pertaining to the sender (135, FIG. 1) and a receiver (125, FIG. 1) during processing of the domain name system query to correlate the metadata (345) with an authorized sender (135, FIG. 1). Typically, the metadata (345) may include a complete electronic mail address of the sender (135, FIG. 1), domain of the receiver (125, FIG. 1), timestamp associated with the electronic mail, and aplurality of transaction parameters pertaining to the electronic mail. In an embodiment, the authorized sender may be an entity, device, or a server that are explicitly permitted to transmit electronic mail on behalf of the sender domain. By correlating the extracted metadata (345) with the authorized sender (135, FIG. 1), the system (105) may determine legitimacy of the electronic mail, thereby enabling the identification of unauthorized or potentially malicious transmissions in real time.

[0063] As referenced above, the parsing engine module is configured to parse one or more query strings corresponding to the DNS query and simultaneously identifies one or more macro-derived segments embedded within the one or more query strings. Further, the parsing engine module is configured to extract the metadata (345) from the identified one or more macro-derived segments, wherein the metadata (345) includes at least one of an internet protocol (IP) address of the sender (135, FIG. 1), the domain associated with the sender (135, FIG. 1), a HELO / EHLO identity declared by the sending mail server, and a resolver internal protocol address and the timestamp.

[0064] Yet, in another embodiment, the extracted metadata (345) is stored in a Structured database and an Indexed storage systems to enable Efficient querying and Aggregation and analysis.

[0065] Furthermore, the metadata (345) is analysed to identify sending infrastructure patterns, detect repeated evaluation behaviors, analyze resolver distribution and infer email routing characteristics.

[0066] Further, the controlled domain name system infrastructure module (320) is configured to validate consistency between the metadata (345) and the sender (135, FIG. 1) to generate a validation result indicative of whether the electronic mail originates from an authorized sender. Typically, the consistency is performed by comparing an internet protocol (IP) address derived from the metadata (345) with the sender (135, FIG. 1) defined in a sender policy framework record associated with the domain. Typically, the sender policy framework recordincludes a set of authorized internet protocols addresses permitted to transmit the electronic mail from the domain of the sender (135, FIG. 1).

[0067] Further, the controlled domain name system infrastructure module (320) is configured to verify the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender (135, FIG. 1) to determine compliance of the electronic mail. Typically, the Domain-based message authentication, reporting, and conformance (DMARC) is an email authentication mechanism that enables a domain owner to define a policy or a rule for validating the electronic mail.

[0068] In such an embodiment, the domain-based message authentication, reporting, and conformance record includes at least one of a policy definition, an alignment parameter, a reporting parameter, and a failure handling instruction associated with the domain.

[0069] Furthermore, the cloud-based logging infrastructure module (325) is configured to store the validation result, the corresponding domain name system query, the metadata (345) and a domain-based message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail. In such an embodiment, the cloud-based logging infrastructure module (325) is configured to store log entry of the DNS query in a structured format for subsequent processing and analysis. In such an embodiment, the log entry includes a full query string representing the generated DNS query, sender resolver information, and a timestamp representing a time at which the DNS query is generated.

[0070] The analytics and visualization dashboard module (330) is operatively coupled to the cloud-based logging infrastructure module (325). The analytics and visualization dashboard module (330) is configured to display the validation result, the corresponding domain name system query, the metadata (345), and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorizeduser. In such an embodiment, the analytics and visualization dashboard module (330) is configured to display validation statuses associated with each of a plurality of outbound electronic mail transmissions. Typically, the validation statuses include at least one of a sender policy framework (SPF) pass or fail status, a domain keys identified mail (DKIM) pass or fail status, and a domain-based message authentication, reporting, and conformance (DMARC) pass or fail status. In such an embodiment, the analytics and visualization dashboard module (330) is configured to provide a time-series analysis on the DNS query, distribution of sender and resolver entities, and pattern-based insights.

[0071] In such an embodiment, any electronic mail identified as unauthorized is blocked prior to being delivered to the receiver (125, FIG. 1), thereby preventing potentially malicious or non-compliant transmissions from reaching the recipient.

[0072] Yet, in another embodiment, the system (105) is configured to transmit a real-time alert to the authorized user upon identifying the unauthorized electronic mail transmissions.

[0073] Consider a non-limiting example of a system (105), where a User X transmits an electronic mail to a User Y. Upon transmission, the electronic mail is routed through a communication network and received at a receiving mail server (120, FIG. 1) associated with a user Y. Upon receipt of the electronic mail, the receiving mail server (120, FIG. 1) initiates a legitimacy check to determine whether the electronic mail originates from an authorized sender. As part of this process, the receiving mail server (120, FIG. 1) performs sender policy framework (SPF) validation. During SPF validation, one or more macro expressions embedded within a sender policy framework record associated with a domain of user X are dynamically expanded based on runtime attributes of the electronic mail. In particular, the one or more macro expressions are replaced with corresponding sender details, including an internet protocol (IP) address of the sender (135, FIG.

[0074] 1), a domain associated with the sender (135, FIG. 1), and a HELO / EHLO identity of a sending mail server. The expanded macro expressions are utilized to generate a domain name system (DNS) query, wherein the sender information is embeddedwithin the DNS query itself. The generated DNS query is transmitted to a controlled domain name system infrastructure (145, FIG. 1) for validation, where consistency between the extracted metadata and authorized sender defined in the SPF record is verified. Based on the validation outcome, the receiving mail server (120, FIG. 1) determines whether the electronic mail is legitimate or unauthorized. In case of a legitimate match, the electronic mail is considered authenticated; otherwise, it is marked as unauthorized. The entire process is performed transparently without modifying the content of the electronic mail to enable passive authentication of electronic mail transmissions. Further, the DNS query and the metadata (345) is logged and recorded for further analysis.

[0075] FIG. 4 illustrates an end-to-end sequence diagram of domain-name system-based email authentication of FIG. 1, in accordance with an embodiment of the present disclosure. FIG. 4 includes a sender (135), a receiving mail server (120), a controlled domain name system infrastructure (145), and a data storage (160) to facilitate electronic mail authentication. The sender (135) transmits an electronic mail to a receiver (not shown in FIG. 4), a receiving mail server (120) receives the electronic mail. Upon receipt of the electronic mail, the receiving mail server (120) initiates an authentication processing and communicates with a controlled domain name system infrastructure (145) for validation of the sender during which one or more macro expressions are dynamically expanded to generate a Domain Name System (DNS) query and the DNS query is transmitted to the controlled domain name system infrastructure (145) to determine authenticity of the electronic mail based on a sender policy framework (SPF) validation. The controlled domain name system infrastructure (145) is configured to extract metadata, correlate the extracted metadata with a sending source, and transmit a corresponding response to the receiving mail server (120), the response indicating whether the electronic mail message is authorized. Further, the DNS query, the metadata and associated authentication information is transmitted to a data storage (160) for monitoring, enabling real-time tracking and analysis of electronic mail authentication events.FIG. 5 (a) illustrates a flow chart representing the steps involved in a method for domain name system-based metadata extraction in electronic mail authentication protocols in accordance with an embodiment of the present disclosure. FIG. 5 (b) illustrates continued steps of the method of FIG. 5(a) in accordance with an embodiment of the present disclosure.

[0076] The method (500) includes receiving an electronic mail from a domain associated with a sender to identify unauthorized electronic mail transmission at step (510). Typically, the domain is configured with a policy containing one or more macro expressions.

[0077] The method (500) also includes dynamically expanding the one or more macro expressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query at step (520). In one embodiment, the one or more macro expressions include one or more placeholder variables that are dynamically substituted with corresponding runtime values derived from the electronic mail.

[0078] Typically, the one or more macro expressions is replaced with corresponding values including at least an internet protocol (IP) address of a sender, a domain associated with the sender, and a HELO / EHLO identity declared by a sending mail server during a Simple Mail Transfer Protocol (SMTP) session.

[0079] Further, the method (500) includes transmitting the domain name system query to a controlled domain name system infrastructure for a sender policy framework validation at step (530). Typically, the controlled domain name system infrastructure may be a controlled authoritative domain name system (DNS) server or a cloud-based DNS logging infrastructure.

[0080] Furthermore, the method (500) includes extracting a metadata from the one or more macro expressions pertaining to the sender and a receiver during processing of the domain name system query to correlate the metadata with an authorized sender at step (540). Typically, the extraction is performed by a parsing engine module configured to parse one or more query strings corresponding to the domainname system (DNS) query. The parsing engine module is further configured to identify one or more macro-derived segments within the parsed query strings and extract structured metadata from the identified one or more macro-derived segments. In such an embodiment, the metadata may include at least one of an internet protocol (IP) address of the sender, a domain associated with the sender, a HELO / EHLO identity declared by a sending mail server, and a resolver IP address indicative of a source of the DNS query.

[0081] Moreover, the method (500) includes validating consistency between the metadata and the sender to generate a validation result indicative of whether the electronic mail originates from an authorized sender at step (550). In such an embodiment, the validation result may include at least one of a pass result indicating that the sender is authorized, or a failure result indicating that the sender is unauthorized.

[0082] Furthermore, the method (500) includes verifying the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender to determine compliance of the electronic mail at step (560). In such an embodiment, a compliance result is generated upon verifying, wherein the compliance result includes at least one of a compliant result indicating that the electronic mail satisfies the DMARC policy, or a non-compliant result indicating that the electronic mail violates the DMARC policy.

[0083] Moreover, the method (500) includes storing the validation result, the corresponding domain name system query, the metadata and a domain-based message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail at step (570).

[0084] Additionally, the method (500) includes displaying the validation result, the corresponding domain name system query, the metadata, and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user at step(580). In such an embodiment, a query access is provided to the authorized user to the validation result, and the domain-based message authentication, reporting, and conformance verification result.

[0085] Yet in another embodiment, a real-time alert is transmitted to the authorized user upon identifying the unauthorized electronic mail transmissions.

[0086] Thus, various embodiments of a system for domain name system-based metadata extraction in electronic mail authentication protocols provides several benefits. By enabling passive extraction of metadata from electronic mail transmissions through dynamic expansion of one or more macro expressions embedded in a sender policy framework (SPF) record and subsequent domain name system (DNS) query generation, without requiring any modification to a of the electronic mail, thereby preserving message integrity. Further, the system operates without any dependency on client-side execution, as all processing, including metadata extraction, validation, and analysis, is performed at a receiving mail server module (310) and a controlled domain name system infrastructure. Additionally, the system is compatible with existing email infrastructure and standard authentication protocols, including SPF and domain-based message authentication, reporting, and conformance (DMARC), thereby enabling seamless integration without disruption to existing systems. Furthermore, the system supports scalable and distributed data collection by transmitting DNS queries to a controlled infrastructure, capturing and aggregating metadata, validation results, and compliance outcomes in real time for subsequent analysis. Moreover, the system validates consistency between the metadata and the sender, and determines compliance, to facilitate identification of transmission patterns, detection of unauthorized electronic mail transmissions, and enhanced monitoring and security of electronic mail systems through an analytics and visualization interface accessible to an authorized user.

[0087] The techniques described in this disclosure may be implemented, at least in part, in hardware, software, firmware, or any combination thereof. For example, various aspects of the described techniques may be implemented within one ormore processors, including one or more microprocessors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or any other equivalent integrated or discrete logic circuitry, as well as any combinations of such components. The term “processor” or “processing subsystem” may generally refer to any of the foregoing logic circuitry, alone or in combination with other logic circuitry, or any other equivalent circuitry. A control unit including hardware may also perform one or more of the techniques of this disclosure.

[0088] Such hardware, software, and firmware may be implemented within the same device or within separate devices to support the various techniques described in this disclosure. In addition, any of the described units, modules, or components may be implemented together or separately as discrete but interoperable logic devices. Depiction of different features as modules or units is intended to highlight different functional aspects and does not necessarily imply that such modules or units must be realized by separate hardware, firmware, or software components. Rather, functionality associated with one or more modules or units may be performed by separate hardware, firmware, or software components, or integrated within common or separate hardware, firmware, or software components.

[0089] It will be understood by those skilled in the art that the foregoing general description and the following detailed description are exemplary and explanatory of the disclosure and are not intended to be restrictive thereof.

[0090] While specific language has been used to describe the disclosure, any limitations arising on account of the same are not intended. As would be apparent to a person skilled in the art, various working modifications may be made to the method in order to implement the inventive concept as taught herein.

[0091] The figures and the foregoing description give examples of embodiments. Those skilled in the art will appreciate that one or more of the described elements may well be combined into a single functional element. Alternatively, certain elements may be split into multiple functional elements. Elements from one embodimentmay be added to another embodiment. For example, the order of processes described herein may be changed and are not limited to the manner described herein. Moreover, the actions of any flow diagram need not be implemented in the order shown; nor do all of the acts need to be necessarily performed. Also, those acts that are not dependent on other acts may be performed in parallel with the other acts. The scope of embodiments is by no means limited by these specific examples.

Claims

CLAIM:

1. A system for domain name system-based metadata extraction in electronic mail authentication protocols, comprising:a processor; anda memory coupled to the processor, wherein the memory comprises instructions that when executed by the processor cause the processor to:receive an electronic mail from a domain associated with a sender to identify unauthorized electronic mail transmission;dynamically expand one or more macro expressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query;transmit the domain name system query to a controlled domain name system infrastructure for a sender policy framework validation, wherein the controlled domain name system infrastructure is configured to:extract a metadata from the one or more macro expressions pertaining to the sender and a receiver during processing of the domain name system query to correlate the metadata with an authorized sender;validate consistency between the metadata and the sender to generate a validation result indicative of whether the electronic mail originates from an authorized sender;verify the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender to determine compliance of the electronic mail;store the validation result, the corresponding domain name system query, the metadata and a domainbased message authentication, reporting, and verification result in a structured data storage system in real time for subsequent analysis of the electronic mail; anddisplay the validation result, the corresponding domain name system query, the metadata, and the domainbased message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user.

2. The system as claimed in claim 1, wherein the metadata comprises an electronic mail address of the sender, domain of the receiver, timestamp associated with the electronic mail, and a plurality of transaction parameters pertaining to the electronic mail.

3. The system as claimed in claim 1 , to cause the processor to provide a query access to the authorized user to the validation result, and the domain-based message authentication, reporting, and conformance verification result.

4. The system as claimed in claim 1, wherein the domain name system query is parsed to extract the metadata.

5. The system as claimed in claim 1, wherein the metadata is stored in a structured format for analysis.

6. The system as claimed in claim 1, wherein the one or more macro expressions are configured in a domain name system record.

7. The system as claimed in claim 1, wherein the one or more macro expressions are embedded within the one or more domain name system queries.

8. The system as claimed in claim 1, wherein the one or more macro expressions comprises a plurality of variables comprising at least one of the domains, and the Internet Protocol address of the sender.

9. The system as claimed in claim 1, to cause the processor to transmit a realtime alert to the authorized user upon identifying the unauthorized electronic mail transmissions.

10. A method for domain name system-based metadata extraction in electronic mail authentication protocols, comprising:receiving an electronic mail from a domain associated with a sender to identify unauthorized electronic mail transmission;dynamically expanding one or more macro expressions embedded in a sender policy framework record associated with the electronic mail to generate a domain name system query;transmitting the domain name system query to a controlled domain name system infrastructure for a sender policy framework validation;extracting a metadata from the one or more macro expressions pertaining to the sender and a receiver during processing of the domain name system query to correlate the metadata with an authorized sender;validating consistency between the metadata and the sender to generate a validation result indicative of whether the electronic mail originates from an authorized sender;verifying the validation result against a domain-based message authentication, reporting, and conformance verification policy associated with the domain of the sender to determine compliance of the electronic mail;storing the validation result, the corresponding domain name system query, the metadata and a domain-based message authentication, reporting, andverification result in a structured data storage system in real time for subsequent analysis of the electronic mail; anddisplaying the validation result, the corresponding domain name system query, the metadata, and the domain-based message authentication, reporting, and conformance verification result and a plurality of outbound electronic mail transmissions to an authorized user.

Images