US 2010.0011420A1 (19) United States (12) Patent Application Publication (10) Pub. No.: US 2010/0011420 A1 DRAKO et al. (43) Pub. Date: Jan. 14, 2010
(54) OPERATING ASERVICE ON ANETWORKAS (22) Filed: Jul. 2, 2008 ADOMAN NAME SYSTEM SERVER Publication Classification (75) Inventors: DEAN DRAKO, Los Altos, CA (51) Int. Cl. (US); Zachary Levow, Mountain G06F 7/30 (2006.01) View, CA (US) G06F 5/16 (2006.01) Correspondence Address: H04L 9/32 (2006.01) PATENTRY (52) U.S. Cl...... 726/5: 709/245; 707/3; 709/206; P.O. BOX 151616 709/201: 707/E17.014; 707/E17.115; 707/E17.032 SAN RAFAEL, CA 94.915-1616 (US) (57) ABSTRACT (73) Assignee: BARRACUDANETWORKS INC., CAMPBELL, CA (US) Operating a service Such as a remote database as a dins server, receiving inputs such as queries as domain names and trans (21) Appl. No.: 12/167,134 mitting replies in the format of IPv4 or IPv6 addresses.
IP CONNECT EMAIL HEADER PARAMETERS
FORMING FODN AUTHCODE. IPADDRESS. DNS HERARCHY CLIENT.DB SYSTEM
DNS DNS RESOLVER SERVER 20 30
DATABASE
140 Patent Application Publication Jan. 14, 2010 Sheet 1 of 4 US 2010/0011420 A1
IP CONNECT EMAIL HEADER PARAMETERS
FORMING FODN AUTHCODE. IPADDRESS. DNS HERARCHY CLIENT.DB SYSTEM
DNS DNS RESOLVER SERVER 20 30
DATABASE
40
FIG. Patent Application Publication Jan. 14, 2010 Sheet 2 of 4 US 2010/0011420 A1
IP CONNECT EMAIL HEADER PARAMETERS
FORMING FODN AUTHCODE. IPADDRESS. DNS HERARCHY CLIENT.DB SYSTEM
DNS FODN DNS DNS OUERY 121 RESOLVER SERVER
20 30
DATABASE
40
FIG.2 Patent Application Publication Jan. 14, 2010 Sheet 3 of 4 US 2010/0011420 A1
DNS HERARCHY SYSTEM
DNS
DNS RESOLVER SERVER 2O
DATABASE
ANALYZE 40
BYPASS
FIG.3 Patent Application Publication Jan. 14, 2010 Sheet 4 of 4 US 2010/0011420 A1
IP CONNECT EMAIL HEADER PARAMETERS
FORMING FODN AUTHCODE. IPADDRESS. DNS HERARCHY CLIENT.DB SYSTEM
DNS FODN DNS DNS OUERY 121 RESOLVER SERVER 2O
DATABASE
ANALYZE 40
BYPASS
FIG.4 US 2010/001. 1420 A1 Jan. 14, 2010
OPERATING ASERVICE ON ANETWORKAS DOMAIN NAMES SYSTEM BACKGROUND A DOMAN NAME SYSTEM SERVER 0007. A domain name usually consists of two or more parts (technically labels), separated by dots. For example: CO-PENDING APPLICATIONS example.com. 0008. The rightmost label conveys the top-level domain 0001. Three related applications with common inventors (for example, the address www.example.com has the and assignee are/will be pending: querying a database as a dins top-level domain com). client, operating a service e.g. database as a dins server, and 0009. Each label to the left specifies a subdivision, or facilitating email by checking a database with email coordi subdomain of the domain above it. Note:"subdomain' nates. expresses relative dependence, not absolute depen 0002 Docket Number application numbers: file dates: dence. For example: example.com comprises a Subdo main of the com domain, and www.example.com com 0003) Z-PTNTR200808 prises a Subdomain of the domain example.com. In 0004 Z-PTNTR200809 theory, this subdivision can go down to 127 levels deep. 0005 Z-PTNTR200810 Each label can contain up to 63 characters. The whole domain name does not exceed a total length of 255 TECHNICAL FIELD characters. In practice, Some domain registries may have shorter limits. 0006. The field of the invention is internet based informa 0010. A hostname refers to a domain name that has one tion technology operations and an application to facilitating or more associated IP addresses; ie: the www.example. the transmission of email. com’ and example.com domains are both hostnames, however, the “com domain is not. O011 DNS Servers 0012. The Domain Name System consists of a hierarchical Definition List 1 set of DNS servers. Each domain or subdomain has one or more authoritative DNS servers that publish information Term Definition about that domain and the name servers of any domains Email parameter A text string which is either part of an “beneath” it. The hierarchy of authoritative DNS servers argument of a mail protocol command or a component of a TCP packet header matches the hierarchy of domains. At the top of the hierarchy connecting between email servers. Not stand the root nameservers: the servers to query when looking limited to but includes IP addresses and up (resolving) a top-level domain name (TLD). domain names. The present application 0013 Users generally do not communicate directly with defines and uses this term. IP address An internet protocol (IP) address is DNS. Instead DNS-resolution takes place transparently in e.g. 151.207.245.67 defined in RFC-791 IPv4 standard of the client-applications such as web-browsers, mail-clients, and Internet Engineering Task Force. RFC other Internet applications. When an application makes a 791 defines a replacement IPv6. request which requires a DNS lookup, Such programs send a Domain name Defined in RFC-1034, 1035, 1085, a e.g. www.uspto.gov domain name is a memorable host name resolution request to the local DNS resolver in the local that stands in for a numeric IP address. operating system, which in turn handles the communications DNS Domain Name System defined in RFC required. 1035, includes resolvers and servers 0014. The DNS resolver likely has a cache containing which respond to questions about domain names. The most basic task of recent lookups. If the cache can provide the answer to the DNS is to translate hostnames to IP request, the resolver will return the value in the cache to the addresses. The Domain Name System program that made the request. If the cache does not contain consists of a hierarchical set of DNS the answer, the resolver will send the request to one or more SeWes. SMTP Simple Mail Transfer Protocol designated DNS servers. documented in RFC 2821 0015. When a DNS client needs to look up a name used in DNSBL DNSBL is an abbreviation that usually a program, it queries DNS servers to resolve the name. Each stands for DNS blacklist. Typically query message the client sends contains three pieces of infor entails a domain, a nameserver for that domain, and a list of addresses to mation, specifying a question for the server to answer: publish. Generally returns either an 0016 A specified DNS domain name, stated as a fully address, indicating that the client is qualified domain name (FQDN) listed; or an “NXDOMAIN” (“No such 0.017. A specified query type, which can either specify a domain') code. DNSBL provides resources to support blocking spam. resource record by type or a specialized type of query Fully qualified A fully qualified domain name has at operation. domain name least a host and domain name, including 0.018. A specified class for the DNS domain name. top-level domain. (0019 For example, the name specified could be the FQDN A FQDN always starts with a host name and continues all the way up to the top for a computer, Such as "host—a.example.com., and the level domain name and includes query type specified to look for an address (A) resource intermediate level domains to provide an record by that name. Think of a DNS query as a client asking unambiguous path which specifies the exact location of a host in the Domain a question, Such as "Do you have any A resource records for Name System's tree hierarchy through to a computer named hostname.example.com.?' When the cli a top-level domain ent receives an answer from the server, it reads and interprets the answered A resource record, learning the IP address for the computer it asked for by name. US 2010/001. 1420 A1 Jan. 14, 2010
0020 DNS queries resolve in a number of different ways. deliver e-mail for a particular address. The domain to mail A client can sometimes answer a query locally using cached exchanger mapping provided by DNS MX records tells where information obtained from a previous query. The DNS server to deliver email for a domain. can use its own cache of resource record information to 0034 Sender Policy Framework and DomainKeys instead answer a query. A DNS server can also query or contact other of creating their own record types were designed to take DNS servers on behalf of the requesting client to fully resolve advantage of another DNS record type, the TXT record. In the name, then sendananswer back to the client. This process these cases the TXT record contains a policy or a public key. is known as recursion. 0035. Protocol Details 0021. In addition, the client itself can attempt to contact 0036 DNS primarily uses UDP on port 53 to serve additional DNS servers to resolve a name. In general, the requests. Almost all DNS queries consist of a single UDP DNS query process occurs in two parts: request from the client followed by a single UDP reply from 0022. A name query begins at a client computer and is the server. TCP comes into play only when the response data query beg p size exceeds 512 bytes, or for Such tasks as Zone transfer. passed to a resolver, the DNSClient service, for resolution. Some operating systems such as HP-UX are known to have 0023. When the query cannot be resolved locally, DNS resolver implementations that use TCP for all queries, even servers can be queried as needed to resolve the name. when UDP would suffice. 0024. In the initial steps of the query process, a DNS 0037 Important categories of data stored in DNS include domain name is used in a program on the local computer. The the following: request is then passed to the DNS service for resolution using 0.038 An A record or address record maps a hostname locally cached information. If the queried name can be to a 32-bit IPv4 address. resolved, the query is answered and the process is completed. 0039. An AAAA record or IPv6 address record maps a If the query does not match an entry in the cache, the resolu hostname to a 128-bit IPv6 address. tion process continues with the client querying a DNS server 0040 ACNAME record or canonical name record is an to resolve the name. alias of one name to another. The A record to which the 0025 Querying a DNS Server alias points can be either local or remote 0026. A positive response can consist of the queried RR or 0041 on a foreign name server. This is useful when a list of RRs (also known as an RRset) that fits the queried running multiple services (such as an FTP and a web DNS domain name and record type specified in the query server) from a single IP address. Each service can then message. The resolver passes the results of the query, in the have its own entry in DNS (like ftp.example.com.and form of either a positive or negative back to the requesting www.example.com.) program and caches the response. 0.042 An MX record or mail exchange record maps a domain name to a list of mail exchange servers for that 0027. How Caching Works domain. 0028. As DNS servers process client queries using recur (0.043 A PTR record or pointer record maps an IPv4 sion or iteration, they discover and acquire a significant store address to the canonical name for that host. Setting up a of information about the DNS namespace. This information is PTR record for a hostname in the in-addr.arpa domain then cached by the server. that corresponds to an IP address implements reverse 0029 Caching provides away to speed the performance of DNS lookup for that address. DNS resolution for Subsequent queries of popular names, 0044 An NS record or name server record maps a while substantially reducing DNS related query traffic on domain name to a list of DNS servers authoritative for the network. that domain. Delegations depend on NS records. 0030. As DNS servers make recursive queries on behalf of 0.045 An SOA record or start of authority record speci clients, they temporarily cache resource records (RRS). fies the DNS server providing authoritative information Cached RRS contain information obtained from DNS servers about an Internet domain, the email of the domain that are authoritative for DNS domain names learned while administrator, the domain serial number, and several making iterative queries to search and fully answer a recur timers relating to refreshing the Zone. sive query performed on behalf of a client. Later, when other 0046. An SRV record is a generalized service location clients place new queries that request RR information match record. ing cached RRs, the DNS server can use the cached RR 0047 A TXT Record was originally intended to carry information to answer them. arbitrary human-readable text in a DNS record. Since 0031 When information is cached, a Time-To-Live (TTL) the early 1990s, however, this record is more often used value applies to all cached RRs. As long as the TTL for a to carry machine-readable data such as specified by RFC cached RR does not expire, a DNS server can continue to 1464, opportunistic encryption, Sender Policy Frame cache and use the RR again when answering queries by its work and DomainKeys such as public keys or a policy. clients that match these RRs. Caching TTL values used by (0.048 AnNAPTR record (“Naming Authority Pointer) RRS in most Zone configurations are assigned the Minimum is a newer type of DNS record that support regular (default) TTL which is set used in the Zone's start of authority expression based rewriting. (SOA) resource record. By default, the minimum TTL is 3,600 seconds (1 hour) but can be adjusted or, if needed, SMTP Background individual caching TTLs can be set at each RR. 0049. The simple mail transfer protocol (smtp) standard 0032 Other Applications ized as RFC2821, is widely used in most stages of delivering 0033. There are many uses of the domain name system e-mail across the internet. The smtp protocol is built on the (DNS) besides translating names to IP addresses. For TCP or transmission control protocol discussed in RFC 1180, example, mail transfer agents use DNS to find out where to and consists of commands, code, parameters, and data US 2010/001. 1420 A1 Jan. 14, 2010
exchanged between clients and servers. A TCP service trans 0056. The first DNSBL was created in 1997 by Paul Vixie mits packets whose headers contain the internet protocol (IP) and Dave Rand as part of the Mail Abuse Prevention System address of the sending host and the receiving host. (MAPS). Initially, there was a list of commands that could be 0050 Although the SMTP protocol provides for relay used to program routers so that network operators could through a serial chain of clients and servers, in practice today, “blackhole' all TCP/IP traffic for machines used to send spam the sender client makes a direct connection to the receiver's server. Thus the IP header used to establish the handshake or host spam Supporting services, such as a website. This was cannot be forged. a reference to a theoretical physical phenomina whose gravi 0051. The envelope sender email address (sometimes also tational force was intense enough to absorb all incident light called the return-path) is used during the transport of the and emit no information, the ultimate blackbox of informa message from mail server to mail server, e.g. to return the tion theory. Vixie, an influential Internet programmer, net message to the Sender in the case of a delivery failure. It is work administrator and ChiefTechnology Officer, was able to usually not displayed to the user by mail programs. install these blackhole routines in key routers so that people 0052. The header sender address of an e-mail message is would not be able to connect to these machines, even if they contained in the “From' or “Sender header and is what is wanted to. The purpose of the RBL was not simply to block displayed to the user by mail programs. Generally, mail serv spam it was to educate Internet service providers and other ers do not care about the header sender address when deliv Internet sites about spam and related problems. Such as open ering a message. Spammers can easily forge these. SMTP relays, spam vertising, etc. Before an address would be listed on the RBL, Volunteers and MAPS staff would attempt DNSBL. Background repeatedly to contact the persons responsible for it and get its 0053 An early and initially successful attempt to control problems corrected. Such effort was considered ethical unsolicited bulk messages transmitted by email, commonly before blackholing all network traffic, but it also meant that called spam, was called RBL. Generally, RBL's can be spammers and spam Supporting ISPs could intentionally thought of as lists of IP addresses which had been found to delay being put on the RBL. have a history of transmitting spam. There are more proper 0057. Later, the RBL was also released in a DNSBL form definitions of RBL and more generic terms which are not and Paul Vixie encouraged the authors of sendmail and other historical or trademarked but common usage refers to queries mail software to implement RBL clients. These allowed the that check lists of “bad” IP addresses as RBL-like. mail software to query the RBL and reject mail from listed 0054 Early attempts to block spam started with the devel sites on a per mail server basis instead of blackholing all opment of a “blacklist of known IP addresses that sent spam. traffic. This blacklist would be referenced and any email originating 0058 Soon after the advent of the RBL, others started from one of the IP addresses on the blacklist would be developing their own lists with different policies. One of the rejected. The IP address is obtained from the TCP/IP packet information and cannot beforged. As people began to develop first was Alan Brown's Open Relay Behavior-modification larger blacklists and share them amongst themselves the need System (ORBS). This used automated testing to discover and for a more dynamic method or centralized blacklist was list mail servers running as open mail relays—exploitable by developed. The answer to this was what is known as the spammers to carry their spam. ORBS was controversial at the traditional Remote Black List (RBL) or Domain Name Sys time because many people felt running an open relay was tem. Black List (DNSBL). A DNSBL, is a means by which an acceptable, and that scanning the Internet for open mail serv Internet site may publish a list of IP addresses that people may ers could be abusive. In 2003, a number of DNSBLs came want to avoid, in a format which can be easily queried by under denial-of-service attacks. Since no party has admitted computer programs on the Internet. The technology is builton to these attacks nor been discovered responsible, their pur top of the Internet Domain Name System (DNS). DNSBLs pose is a matter of speculation. However, many observers are chiefly used to publish lists of addresses associated with believe the attacks are perpetrated by spammers in order to spamming. Most mail transport agent (mail server) software interfere with the DNSBLs operation or hound them into can be configured to reject or flag messages which have been shutting down. In August 2003, the firm Osirusoft, an opera sent from a site listed on one or more such lists. RBL origi tor of several DNSBLs including one based on the SPEWS nated as an abbreviation for "Real-time Blackhole List’. data set, shut down its lists after Suffering weeks of near “RBL was the trademarked name of the first system to use continuous attack. this strategy, the proprietary MAPS DNSBL. 0059. It is possible to serve a DNSBL using any general 0055 Developers of mail software have adopted configu purpose DNS server software. However this is typically inef ration parameters that use “RBLs” or “RBL domains when ficient for Zones containing large numbers of addresses, par any DNSBLs can be used, not just the MAPS RBL. The term ticularly DNSBLs which list entire Classless Inter-Domain “rejectlist' has also been used, as well as Right Hand Side Routing netblocks. DNSBL specific software—such as Blacklist (RHSBL), similar to a DNSBL but it listing domain names rather than IP addresses. The term comes from the Michael J. Tokarev's rbldnsd, Daniel J. Bernstein's rbldns, or “right-hand side' of an email address—the part after the (a) the DNS Blacklist Plug-In for Simple DNS Plus is faster, sign—which clients look up in the RHSBL. Several services uses less memory, and is easier to configure for this purpose. manage and maintain a list of domains used by spammers. 0060. The hard part of operating a DNSBL is populating it Unfortunately, RHSBL cannot address, the growth of bots with addresses. DNSBLs intended for public use usually have which has resulted in spammers infecting the domains of specific, published policies as to what a listing means, and legitimate email senders and mixing their spam with non must be operated accordingly to attain or keep public confi spam from infected domains. dence. US 2010/001. 1420 A1 Jan. 14, 2010
0061. When a mail server receives a connection from a tiveness of spam filters. Under the merged proposal, organi client, and wishes to check that client against a DNSBL (let's zations would have published information about their outgo say, dinsbl.example.net), it does more or less the following: ing e-mail servers, such as IP addresses, in the Domain Name 0062 Take the client’s IP address say, 192.1 68.42. System (DNS) using the industry-standard XML format. The 23—and reverse the bytes, yielding 23.42.168.192. converged specification included testing at both the message 0063. Append the DNSBLs domain name: 23.42.168. transport (SMTP) level, or envelope, as originally proposed in 192.dnsbl.example.net. SPF, as well as in the message body headers, as originally 0064. Look up this name in the DNS as a domain name proposed in Caller ID. Testing for spoofing at the message (“A record). This will return either an address, indicat transport level was suggested to block some spam messages ing that the client is listed; or an “NXDOMAIN” (“No before they are sent. In cases in which a deeper examination Such domain”) code, indicating that the client is not. of the message contents is required to detect spoofing and 0065 Optionally, if the client is listed, look up the name as phishing attacks, the Caller ID-style header check would a text record (“TXT record). Most DNSBLs publish infor apply. However the MARID working group self-terminated mation about why a client is listed as TXT records. without Success. 0066. There is an informal protocol for the addresses (0072. The main benefit of SPF is to people whose e-mail returned by DNSBL queries which match. Most DNSBLs addresses are forged in the Return-Paths. They receive a large return an address in the 127.0.0.0/8 IP loopback network. The mass of undeserved and worrisome error messages and other address 127.0.0.2 indicates a generic listing. Other addresses auto-replies, making it difficult to use e-mail normally. (Am I in this block may indicate something specific about the list infected with a virus, did someone access my computer with ing—that it indicates an open relay, proxy, or spammer out authorization, shall I change all my passwords?) If Such owned host. people use SPF to specify their legitimate sending IPs with a 0067 Conventional real-time blackhole list (RBL) filter FAIL result for all other IPs, then receivers checking SPF can ing comprises prepending an IP address to an RBL domain, reject forgeries, possibly reducing the amount ofback-scatter. querying a Domain Name System (dins) server, and receiving This is an indirect benefit and has not been sufficiently moti a result. That result may be used to take action Such as block Vating to cause adoption. ing an email received from a certain IP address. 0073 SPF may offer advantages beyond potentially help 0068. Other proposed solutions shift the burden of estab ing identify unwanted e-mail. In particular, if a sender pro lishing credibility onto innocent senders. Examples include vides SPF information, then receivers can use SPF PASS adding sender policy framework policies or domainkey Pub results in combination with a white list to identify known lic Keys into the dins TXT fields. reliable senders. (0074 The Sender Policy Framework (SPF) standard DomainKeys specifies a technical method to prevent sender address forg ery. Present implementations of the SPF concept protects the 0069. In DomainKeys, U.S. Pat. No. 6,986,049 assigned envelope sender address, which is used for the delivery of to Yahoo!, the receiving SMTP server uses the name of the messages. domain from which mail originated, the string domainkey, 0075 SPF allows the owner of an Internet domain to use a and a selector from the header to perform a DNS lookup. The special format of DNS TXT records to specify which IP returned data includes the domain's public key. The receiver addresses are authorized to transmit e-mail for that domain. can then decrypt the hash value in the header field and at the SPF allows software to identify and reject forged addresses in same time recalculate the hash value for the mail body that the SMTP MAIL FROM (Return-Path), a typical nuisance in was received, from the point immediately following the e-mail spam. SPF is defined in RFC 4408. In using SPF “DomainKey-Signature: header. If the two values match, domains identify the machines authorized to send e-mail on this cryptographically proves that the mail originated at the their behalf. Domains do this by adding additional records to purported domain and has not been tampered with in transit. their existing DNS information. Some examples of policies: DomainKeys is primarily an authentication technology and 0076 TXT V=Spf1 include:spf-a.hotmail.com include: does not itself filter spam. It also adds to the computational spf-b.hotmail.com include:spf-c.hotmail.com include:spf burden of both sender and receiver in encrypting/decrypting d.hotmail.com ~all and computing/comparing hash values. 0077. TXT spf2.0/praip4:152.163.225.0/24 ip4:205.188. 139.0/24 ip4:205.1 88.144.0/24 ip4:205.188.156.0/23 ip4: Sender Policy Framework 205.188.159.0/24 ip4:64.12.136.0/23 ip4:64.12.138.0/24 0070. The Sender Policy Framework (SPF) is another ip4:64.12.143.99/32 ip4:64.12.143.100/32 ip4:64.12.143. emerging standard pertinent to security. Adopting SPF 101/32 ptr.mx.aol.com Pall requires the owner of the example.org domain to designate 0078. The format which has been adopted as a standard which machines are authorized to send e-mail whose sender has been criticized as awkward. The distributed nature of e-mail address ends with “(a)example.org. Receivers check DNS records could be advantageous if widely adopted but has ing SPF can reject messages from unauthorized machines limited value to early converts. SPF requires widespread before receiving the body of the message. SPF uses the adoption to yield results and the cost and degree of effort has authority delegation scheme of the Domain Name System. A gained limited penetration. Early adopters have not achieved syntax defines a policy in a domain's DNS records, typically enough critical mass to attract the mainstream. TXT. (0079. One can see that the SPF solution which requires the (0071. A proposal to merge Microsoft Caller ID and SPF publishing of IP addresses from which legitimate email can was submitted to the IETF MARID working group. Caller ID originate for a DOMAIN could eliminate the forged and SPF aimed to prevent spoofing by confirming what addresses that spammers use in email. SPF, however, requires domain a message came from and thereby increase the effec that each individual domain owner publish such a list. This US 2010/001. 1420 A1 Jan. 14, 2010
requires significant time for each of millions of people to name as the query name in a dns query from a dins client; and adopt. Publishing SPF policies is complex and prone to error. determining a first query argument and a second query argu Many DNS service providers do not support it. ment from the fully qualified domain name. I0087. The present invention selects email from legitimate What is Needed is . . . senders and facilitates its transmission to receivers more effi ciently while reducing the load on spam Scanners. The 0080. The blacklist solution is objectionable to legitimate method comprises: querying a database with a set of email email users sharing the same IP addresses used by spammers parameters, and transmitting email according to the result of and makes RBL lists less than ideal by harming innocent the query. The method further comprises transmitting the set users. Increasingly, spam is emitted from bot networks which of email parameters as concatenated labels in a string. The consist of computers which have been penetrated by mali method further comprises extracting the email parameters by cious senders. The email sent from a bot may contain a mix analyzing a TCP/IP header and an MAIL “FROM command ture of spam caused by the infection and legitimate mail. from an email envelope where the email parameters comprise Unfortunately putting a bot infected IP address on an RBL at least an IP address of a client and a sender which is at least punishes the victim more than the criminal. It would be one of a local-part and a domain. In other words, the argument desireable to block only the spam emitted from a bot network. of the MAIL FROM command correctly includes
0094 FIG. 3 is a flow chart of a query within the dins arguments which may have an implied AND or an implied OR system. if the arguments can be concatenated with delimiters such as 0095 FIG. 4 is a process flow of email through the system. a dot. 0110. An email filter embodied as an apparatus or as a DETAILED DISCLOSURE OF OPERATING A process preceding an SMTP server may substantially reduce SERVICE SUCH ASA DATABASE the load on the server by preventing SMTP sessions with spammers to reach the point where data is transferred via the 0096. The present invention is a method for operating a SeVe. service Such as a database on a network comprising: receiving 0111. The invention may be used to reduce the load on a a dns query, extracting a plurality of arguments from said spam Scanner by preprocessing email. Email that originates query, retrieving information associated with said arguments, from known good senders bypasses the spam Scanner and transmitting a reply formatted in IP syntax. entirely. A further embodiment of the invention further 0097. A method for operating a service (e.g.database) reduces the load on a spam Scanner by terminating a mail comprising the following steps: session which been initiated from a set of email email param 0.098 listening on a port in an embodiment port 53 for a eters of a known spammer in a database containing spam dins request class=IN from a dins client; CS. 0099 stripping the suffix off the dns queryname=fully qualified domain name which corresponds to the domain Method Embodiments in a Computer System name of the website; 0100 determining at least two arguments from the 0112 An embodiment of the invention is an article of remainder of the dns query name; manufacture comprising computer readable media encoded 0101 accessing a database according to the arguments; with instructions to adapt the operation of a processor. and 0113. An embodiment of the invention is an apparatus 0102 transmitting the result as a dns query response to comprising a computing system and the above article of the dns query client. manufacture. 0114. The present invention can be realized in hardware, 0103) In an embodiment the result is a text string or an IP Software, or a combination of hardware and Software. An address. The result may be coded as an IP address. The result implementation of the method and system of the present may be multiple terms which are encoded by setting the octets invention can be realized in a centralized fashion in one or groups of an IP address. computer system, or in a distributed fashion where different 0104. In an embodiment the result may be encoded using elements are spread across several interconnected computer either two to the 32 power unique values of the IPv4 system or systems. Any kind of computer system, or other apparatus two to the 128 power unique values of the IPv6 system. adapted for carrying out the methods described herein, is 0105. In an embodiment, the dns query response is cached suited to perform the functions described herein. by a distributed domain name system and served to a client. 0115 A typical combination of hardware and software 0106 The method may further comprise determining an could be a general purpose computer system with a computer authentication code component of the remainder of the dins program that, when being loaded and executed, controls the queryname, validating the authentication code before access computer system such that it carries out the methods ing a stored IP address, and transmitting the stored IP address described herein. The present invention can also be embedded as a dns query response. An authentication code may be in a computer program product, which comprises all the tracked for usage, allow a limited number of queries, cause an features enabling the implementation of the methods invalid response if incorrect or expired, cause no response if described herein, and which, when loaded in a computer invalid. It may consist of a checksum. The method further system is able to carry out these methods. comprises receiving an authentication code as a query argu 0116 Computer program or application in the present ment and checking its validity. The method further comprises context means any expression, in any language, code or nota storing a first use of an authentication code and associating it tion, of a set of instructions intended to cause a system having with the IP address of the query sender. This allows an authen an information processing capability to perform a particular tication code to be tied to the first user. function either directly or after either or both of the following 0107 The dns query response may be cached in a domain a) conversion to another language, code or notation; b) repro name system and served to a second client. duction in a different material form.
INDUSTRIAL APPLICABILITYAEMBODIMENTS CONCLUSION 0108. The IPv4 and IPv6 system have very large capacity 0117 The present invention is distinguished by concat and can thus encode from two to the power of 32 up to two to enating a plurality of query arguments into a string with a the power of 128 unique values. A multidimensional database suffix to form a fully qualified domain name. The present query is Submitted as a string forming a fully qualified domain invention is distinguished by sending a query with a plurality name to a dins server. If the exact query is soon repeated it will ofarguments to a domain name system. The present invention be served locally from a dins cache. The query may contain its is further distinguished by appending an authentication code own authentication code. to a query Submitted to a domain name system. The present 0109 Text can also be served by a database in response to invention is distinguished by operating on the arguments such a domain name system query. Text fields may be requested by as performing a computation, controlling a process, request querying TXT instead of A or AAAA. The present invention ing a service, or matching a plurality of query arguments in a applies to any query of a database which has a plurality of database and replying with a response in the form of a dins US 2010/001. 1420 A1 Jan. 14, 2010 query reply. Performance may be improved due to caching of determining at least two arguments from the remainder of the reply in the domain name system. the dns queryname; 0118. The method assumes the existence of a database operating on the arguments; and generated and managed outside of the scope of the present transmitting the result as a dns query response to the dins invention. The method of operating Such a database in query client. response to queries is also outside of the scope of this patent 12. The method of claim 11 wherein a plurality of query application and is known to those skilled in the art of database arguments comprises at least a first query term and a second administration. The present invention is distinguished from query term separated by a dot. conventional systems by preparing, and transmitting a multi 13. The method of claim 11 wherein the reply comprises a dimensional query in contrast to a uni-dimensional IP address plurality of groups separated by dots wherein groups are one query. of binary numbers, decimal numbers, hexadecimal numbers 0119 The above discussion and description includes illus and octal numbers. trations to Support the understanding and appreciation of the 14. The method of claim 11 wherein an argument com invention but should be recognized as not limiting the scope prises an authentication code, whereby billing records may be which is defined by the claims following: checked or updated and users of the database may be vali 0120 Significantly, this invention can be embodied in dated or rejected. other specific forms without departing from the spirit or 15. The method of claim 11 wherein an argument com essential attributes thereof, and accordingly, reference should prises an authentication code, whereby usage is tracked. be had to the following claims, rather than to the foregoing 16. The method of claim 11 wherein an argument com specification, as indicating the scope of the invention. prises an authentication code comprising a checksum. What is claimed is: 17. The method of claim 11 wherein the dns query response 1. A method for operating a service on a network compris is an IP address comprising one of two to the 32 power unique ing: receiving a dns query string, extracting a plurality of values of the IPv4 system (four octets). arguments from said query string, operating on said argu 18. The method of claim 11 wherein the dns query response ments, and transmitting a reply formatted in IP syntax. is an IP address comprising one of two to the 128 power 2. A method for operating a database comprising the fol unique values of the IPv6 system (eight groups of 4 hexadeci lowing steps: mal digits). listening for a dins request class=IN from a dins client; 19. The method of claim 11 wherein the result is one of a stripping the hostname off the dns queryname “fully quali text string and an IP address. fied domain name': 20. The method of claim 11 wherein the result is a domain determining at least two arguments from the remainder of aC. the dns query name: 21. The method of claim 11 wherein operating on the accessing the database according to the arguments; and arguments comprises a computation or string manipulation. transmitting the database result as a dns query response to 22. The method of claim 1 wherein the dns query response the dns query client. is cached by a distributed domain name system and served to 3. The method of claim 2 further comprising listening for a a client. dins request selected from the following: type A, 23. The method of claim 1 further comprising determining type=AAAA, type=spf, type=CNAME, and type=TXT. an authentication code component of the remainder of the dins 4. The method of claim 2 wherein the dns query response is query name, validating the authentication code before access an IP address comprising one of two to the 32 power unique ing a stored IP address, and transmitting the stored IP address values of the IPv4 system (four octets). as a dns query response. 5. The method of claim 2 wherein the dns query response is 24. The method of claim 1 wherein the dns query response an IP address comprising one of two to the 128 power unique is cached by a distributed domain name system and served to values of the IPv6 system (eight groups of 4 hexadecimal a second client. digits). 25. A method for operating a service on a network com 6. The method of claim 2 wherein the dns query response is prising: receiving a dns query string, extracting a plurality of cached in a distributed domain name system and served to a arguments from said query string, operating on said argu dins resolver. ments, and transmitting a reply formatted in IP syntax, further 7. The method of claim 2 wherein the dns query response comprising receiving an authentication code as a query argu represents a value to be used in a computation. ment and checking its validity. 8. The method of claim 2 wherein the dns query response 26. The method of claim 25 further comprising sending no represents that a certain message should be displayed. response if the authentication code is bad. 9. The method of claim 2 wherein the dns query response 27. The method of claim 25 further comprising transmit represents that an email should be allowed without spam ting an “invalid response if the authentication code is bad. Scanning. 28. The method of claim 25 further comprising counting 10. The method of claim 2 wherein the dns query response and controlling the number of queries allowed for each represents one of a Subjective probability on a scale, an action authentication code. Suggested, and a degree of additional handling. 29. The method of claim 25 further comprising storing a 11. A method for operating a service comprising the fol first use of an authentication code and associating it with the lowing steps: IP address of the query sender. listening for a dins request class=IN from a dins client; 30. A method for operating a service on a network com stripping the hostname off the dns query name="fully prising: receiving a dns query string, extracting a plurality of qualified domain name: arguments from said query string, operating on said argu US 2010/001. 1420 A1 Jan. 14, 2010
ments, and transmitting a reply formatted in IP syntax transacting a sale. Voting, asking a question, answering a wherein operating on said arguments comprises one of the question, requesting assistance, and stopping a process. following, eliciting a response, initiating a process, measur ing a value, controlling a machine, dispensing a product, ck