Trusted Entity Mediator for Third-Party Email Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Companies face challenges in authenticating emails sent by third parties on their behalf, as these emails often fail SPF and DKIM checks due to missing IP addresses or public keys in the DNS records, leading to security issues and email spoofing concerns.
Innovation Solution
A system and method where a trusted entity adds the third party's email authentication information, such as SPF records and DKIM keys, to the DNS record associated with the company's domain, after verifying the third party's authorization, enabling successful authentication of emails sent on behalf of the company.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a company uses SPF or DKIM authentication to prevent email spoofing, then email security is improved, but emails sent by third parties on behalf of the company fail authentication because the third party's IP addresses or public keys are not in the company's DNS records
Solution Approach 1:
The patent introduces a trusted entity as an intermediary between the company and the third party. This trusted entity holds the company's domain information and can issue authorization tokens that allow third parties to temporarily add their authentication information to the company's DNS records. The trusted entity mediates the authorization process, enabling third-party email sending while maintaining the security of the original SPF/DKIM authentication mechanism.
Solution Approach 2:
The system performs preliminary actions by having the third party add their IP addresses or public keys to the company's DNS records before sending emails. This is done temporarily and automatically removed after the email sending operation, ensuring that the authentication information is in place when needed but not permanently exposed.
2Adaptability or versatility
If the company adds the third party's IP addresses or public keys to their DNS records to enable authentication, then third-party email authentication succeeds, but the company's DNS record security is compromised and email spoofing risks increase
Solution Approach 1:
The third party's authentication information is added to the DNS records temporarily only when needed for email sending, and is automatically removed afterward. This preliminary and temporary addition minimizes the exposure time of the DNS records to potential security threats while still enabling authentication when required.
Solution Approach 2:
The trusted entity acts as a mediator that controls and manages the addition and removal of third-party authentication information from the company's DNS records. This intermediary layer prevents direct manipulation of the DNS records by third parties, maintaining security while enabling necessary authentication functionality.
Solution Approach 3:
The system automatically discards the third party's authentication information from the DNS records after it has served its purpose for email sending. This ensures that sensitive authentication data is not left exposed in the DNS records longer than necessary, reducing the window for potential security breaches.
3Reliability
If the company manually configures SPF records for each third party, then email authentication works, but the complexity of DNS management increases significantly
Solution Approach 1:
The system enables self-service automation where the third party can independently add their authentication information to the company's DNS records by obtaining an authorization token from the trusted entity. This eliminates the need for manual configuration by the company's IT team, reducing DNS management complexity while maintaining authentication reliability.
Solution Approach 2:
The authentication information is automatically added and then automatically removed from the DNS records, eliminating the need for manual management and configuration by the company. This automated lifecycle management significantly reduces the complexity of DNS record maintenance while ensuring proper authentication.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A company may authorize a 3rd party to send emails on behalf of the company's domain. The emails are sent by the 3rd party, but the "From" portion of the email header is populated with the company's email address/domain. Methods are disclosed that, in some embodiments, enable email authentication (e.g. SPF record checks and/or DKIM verification) for emails sent by the 3rd party on behalf of a company's domain. In some embodiments, a trusted entity is enlisted to communicate with the 3rd party and the company. The trusted entity has the proper permissions to request changes in the DNS records of the company. The trusted entity receives the request from the 3rd party to add email authentication information to the DNS record. The trusted entity confirms that the 3rd party is authorized by the company and then adds the information to the DNS record.