System and method to customize dns replies based on connection identity

RELATED APPLICATIONS

p-0002The present application claims priority from U.S. Provisional Application Ser. No. 61/445,159, filed on Feb. 22, 2011, which is incorporated herein by reference.

BACKGROUND

p-0003In the Internet, domain names allow users to navigate by remembering words rather than numbers to get to specific web sites or other Internet resources. Each Internet connected domain has at least one domain name and/or corresponding Internet Protocol (IP) address. The Domain Name System (DNS) keeps track of the domain names and each of the associated IP addresses along with other information associated with the Internet domains. The DNS is configured to receive requests or queries for information about the domains and to respond to the queries with replies that contain the requested information. The DNS includes a number of Internet connected domain name servers with memory for storing the domain information. The DNS can store and supply several types of records for each domain, such as: A (Address record) queries, NS (Name Server) queries, MX (Mail eXchange) queries TXT (Text record), and others. These records can be used for various purposes including email and determining the IP address for the associated domain.

p-0004The DNS operates to reply to queries from querying entities with a reply that contains the requested information about a specific domain. Querying entities can be, for example, a host, client, domain, or other entity that is connected to the Internet and which can query for information from the DNS. The DNS can be used when sending emails by providing MX and/or TXT records information related to the receiving domain of the email. During an exemplary conventional operation of the DNS, a query is made to the DNS from a querying entity for the TXT record associated with the domain “example.com. ” The DNS finds the TXT record for the domain in the DNS memory and returns the requested TXT record to the querying entity. The DNS replies to queries for the TXT record of the domain with the same information regardless of the identity of the querying entity. While in certain infrequent instances, the DNS may reply to the query for the TXT record of the domain with incorrect information that is different from other replies that contain the correct information, this reply of incorrect information is not based on any meaningful information or parameter.

p-0005Email is an asynchronous expedient to communicate over the Internet. Email remains popular despite the rise in instant digital-communication standards such as cell-phone texting. Businesses like to send email because complex information may be digested by the reader at the reader's leisure. Two risks common to all email are spam (unsolicited email) and phishing (fraudulently masquerading email). Several standards have been adopted in attempting to reduce these risks and will continue to be adopted. Among the currently used standards are DKIM (a method to digitally sign email so that the identity of the sender may be found and so that the email message cannot be transformed during transit without detection) and sender policy framework or SPF (Sender Policy Framework, a method to state the IP addresses of the email sender's email sending machines to prevent fraudulent emails).

p-0006In order to implement reduction of email associated risks, email sending policy can be encapsulated in the DKIM, SPF and other standards. The standards are based on DNS, and each policy can be a text record (type TXT) looked up using DNS. For instance, DKIM is looked up based on concatenating a special prefix to the sender's domain. For DKIM that prefix is formed by a selector followed by a dot and then the string constant “_domainkey.” As another example, in SPF the text record is looked up by querying the domain name. A new standard recommends that SPF data be looked up using a DNS SPF type of record. The common aspect to all these and at least some future standards is that they are based on DNS.

p-0007The appeal and usefulness of email is diminished if the email recipient cannot trust that a message is from the person or business that it purports to be from. Typically, the source address of an email is displayed on the recipient's email program to allow the user to see whom the email is supposed to be from. This display allows the recipient to decide whether to open the email if it is from a trusted source or to delete the email if it is from an unknown or untrustworthy source. However, like other computerized systems, email has been subjected to disruption and attack by computer hackers. Hackers are able to replace the source address of emails, thereby making an illegitimate email appear to be from a trusted source. This practice is referred to as email spoofing. The illegitimate emails are frequently fraudulent, which refers to unsolicited commercial advertisements (spoofed or not), often sent in mass mailings. The hackers replace the source address so the unsuspecting recipient believes that the email is from a known or trusted source and opens the email.

p-0008In the early days of email, there existed no compelling reason for email to all be sent from a central email server. Many businesses routinely sent email directly from regional centers to customers. With the rise of spam and phishing, however, a need has developed for a business to create a single central email sending identity. Part of that change requires the business to undergo an email audit (to insure no unforeseen email is sent from outside the email center) and to install software to force all email be sent through the email center. As part of centralization, the business can adopt or later adopt one or more of the existing or proposed email authentication standards.

p-0009Applicants recognize that even with the introduction of the single email sending identity and the adoption of email authentication standards, risk continues to exist because of the different ways email receiving sites handle bad email. Some email receiving sites will reject or discard bad email. Other sites will merely move bad email into a “spam” folder. If a sending business is just beginning to sign all out-bound email, that business may not want failed signatures to be discarded because some of the emails with failed signatures may still be legitimate in this transitional stage. Part of the standards is a preference for how the sender wants failed email to be handled. This information can be obtained through a query to the DNS about the sender. However, these conventional standards are believed by Applicants to be unable to address the situation where some legitimate emails from a sender are discarded because of failed signatures while other legitimate emails with valid signatures from the sender are not discarded.

p-0010The present invention provides a highly advantageous apparatus and method that are submitted to resolve the foregoing problems and concerns while providing still further advantages, as described hereinafter.

SUMMARY OF THE INVENTION

p-0011The present invention overcomes the limitations of a conventional domain name system. In one embodiment, according to the present disclosure, a method is disclosed in an Internet connected Domain Name System (DNS) that is configured for receiving and replying to queries for information associated with at least one Internet connected domain from a plurality of querying entities each having an entity indicator that uniquely identifies the entity. In the method, information associated with the domain is defined to have at least two different subsets of the information associated with the domain. One of the subsets of information is selected for use in replying to a query based at least in part on the entity indicator of the querying entity.

p-0012In another embodiment, a method is disclosed which involves an Internet connected Domain Name System (DNS) that is configured to receive and reply to information queries about at least one Internet connected domain from a plurality of querying entities each having an entity indicator that is usable to determine an identity of the querying entity. Information associated with the domain to be used for replying to the information queries about the domain is configured into subsets of information. At least one subset is configured with special response information for replying to at least one querying entity that is predetermined to receive the special response information based on the entity indicator of the querying entity. At least one other subset is configured with general response information for replying to at least one querying entity that is not predetermined to receive the special response information based on the entity indicator of the querying entity. The configured information is stored in a memory device.

p-0013Yet another embodiment involves an Internet connected Domain Name System (DNS) that is configured to receive and reply to information queries about at least one Internet connected domain from a plurality of querying entities each having an entity indicator that is usable to determine an identity of the querying entity. This embodiment includes a memory device for storing domain information associated with the domain to be used for replying to the information queries about the domain. A computer is included that is communicatively connected to the memory device and arranged to allow for configuration of the domain information in the memory device into at least two different subsets. At least one of the subsets is configured for replying to a query for information about the domain based at least in part on the identity of the querying entity.

p-0014Other objects, features and advantages of the present invention will be apparent from the accompanying drawings and from the detailed description that follows.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0015<figref idrefs="DRAWINGS">FIG. 1</figref> is a block diagram which illustrates a system arranged according to an embodiment of the present disclosure.

p-0016<figref idrefs="DRAWINGS">FIG. 2</figref> is a flow diagram illustrating an embodiment of a method for the operation of a customized DNS.

p-0017<figref idrefs="DRAWINGS">FIG. 3</figref> is a flow diagram illustrating an embodiment of a method involving identification of a querying entity.

p-0018<figref idrefs="DRAWINGS">FIG. 4</figref> is a flow diagram illustrating an embodiment of a method for determining a reply in an emailing.

p-0019<figref idrefs="DRAWINGS">FIG. 5</figref> is a flow diagram illustrating an embodiment of a method for determining a reply to a query based on an identification of the querying entity.

p-0020<figref idrefs="DRAWINGS">FIG. 6</figref> is a block diagram which illustrates an embodiment of a customized DNS server.

p-0021<figref idrefs="DRAWINGS">FIG. 7</figref> is a flow diagram illustrating an embodiment of a method for modification of a conventional DNS server.

p-0022<figref idrefs="DRAWINGS">FIG. 8</figref> is a block diagram which illustrates another embodiment of a customized DNS server.

p-0023<figref idrefs="DRAWINGS">FIG. 9</figref> is a flow diagram illustrating an embodiment for retrieving information from a delegated DNS server.

p-0024<figref idrefs="DRAWINGS">FIG. 10</figref> is a flow diagram illustrating an embodiment for delegating information to a new server from a conventional DNS server.

DETAILED DESCRIPTION OF THE INVENTION

p-0025While this invention is susceptible to embodiment in many different forms, there are shown in the drawings, and will be described herein in detail, specific embodiments thereof with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention and is not to be limited to the specific embodiments described. Descriptive terminology may be adopted for purposes of enhancing the reader's understanding, with respect to the various views provided in the figures, and is in no way intended to be limiting.

p-0026Referring to the drawings, wherein like components may be indicated by like reference numbers throughout the various figures, <figref idrefs="DRAWINGS">FIG. 1</figref> illustrates a block diagram of an Internet environment generally referred to by the reference numeral <b>10</b>. Internet <b>12</b> represents the numerous interconnected servers and other hardware that makes up the Internet. Connected to or integral with Internet <b>12</b> is Domain Naming System (DNS) <b>14</b>. DNS <b>14</b> is communicatively connected to the Internet by a communication line <b>16</b> which carries communication data to and from the Internet. DNS <b>14</b> includes a customized DNS server <b>18</b> and a DNS memory <b>20</b> that is communicatively coupled to server <b>18</b> through communication line <b>22</b> for storing subsets of information <b>24</b>. DNS memory <b>20</b> can be part of DNS server <b>18</b> or separate from DNS server <b>18</b> Other DNS servers can be connected to or included in Internet <b>12</b> and can be considered to be part of the overall DNS. These servers can include one or more DNS servers such as those described herein and can include a number of conventional Internet connected domain name servers. These conventional domain name servers operate to reply to queries with domain information that is not dependent on the identity of the querying entity. Customized DNS server <b>18</b> operates to provide replies to queries to the DNS based on the identity of the querying entity, as will be discussed in greater detail below.

p-0027Domains <b>26</b>, <b>28</b> and <b>30</b> are communicatively connected to Internet <b>12</b> by communication lines <b>32</b>, <b>34</b> and <b>36</b>, respectively. Domains <b>26</b>, <b>28</b> and <b>30</b> are representative of one or more Internet connected domains. Information related to domains <b>26</b>, <b>28</b> and <b>30</b> is stored in memory <b>20</b> of the DNS. Memory <b>20</b> can store and supply several types of records for each domain, such as: A (Address record) queries, NS (Name Server) queries, MX (Mail eXchange) queries TXT (Text record), and others. These records can be used for various purposes including email policy and determining the IP address for an associated domain. This information can include the domain name, the IP address of the domain, email information, and other information.

p-0028Querying entities <b>40</b>, <b>42</b> and <b>44</b> are communicatively connected to Internet <b>12</b> by communication lines <b>46</b>, <b>48</b> and <b>50</b>, respectively, and each have a unique entity indicator <b>52</b>, <b>54</b> and <b>56</b>, respectively. The querying entities can be domains and/or hosts or other Internet entities that access the Internet and which query DNS <b>14</b> for information about domains <b>26</b>, <b>28</b> and <b>30</b>. The querying entities can query the DNS for information used for navigating to the domain through a web browser, for email delivery instructions for emails from the domain and other information available in the records stored in the DNS. The entity indicator can be a host name, host IP address, domain name, domain IP address or other information that uniquely identifies the querying entity with which the entity indicator is associated. While domains <b>26</b>, <b>28</b> and <b>30</b>; querying entities <b>40</b>, <b>42</b> and <b>44</b>; and DNS <b>14</b> are shown separate from Internet <b>12</b>, these can also be considered to be part of the Internet. When a query is made to the DNS from a querying entity about one of the domains, the DNS can determine the identity of the querying entity.

p-0029As can be understood in view of the embodiments brought to light herein, stored information concerning the various domains can be customized or configured based on the identity of the querying entity. This customized information can then be used to reply to queries for information about the domains based at least in part on the identity of the querying entity. Replying to queries based on the identity of the querying entity allows the DNS to provide different customized domain information to different entities. A domain administrator, or other person having authority in this regard, can define customized information that will be used for replies to queries for the domain or domains under their administration based on the identity of the querying entity. In some instances the customized information can relate to the delivery of emails from a domain or email sender for which the administrator sets email delivery policy. For example, a special response subset of the information can be designated to be sent in the case of a query by selected entities, whereas a general response subset of the information can be designated to be sent in the case of a query from unknown or non-selected entities. Different special response subsets of the information can be designated to be sent to different querying entities.

p-0030As an example, in a situation in which an email sender is the domain with special response subsets of information stored in the DNS, if the email sender knows that some email will be badly signed, that email sender might want to have one preference stated to the email receiving site that discards bad messages, and to have a different preference stated to the email receiving site that moves bad messages into a “spam” folder. Such an arrangement is currently not available. None of the existing standards of which Applicants are aware allow such DNS queries to be answered one way for some receiving sites and in other ways for other receiving sites.

p-0031As another example, where a bank has a domain email sender and might wish to DKIM sign its email with a weak <b>512</b> bit signing key when sending emails bank-to-bank over a TLS (Transport Layer Security) connection. This would be an example of a first type of special response subset of information. That same bank might wish to DKIM sign using a stronger <b>1024</b> bit signing key when sending email to customers. This would be an example of a second type of special response subset of information. The bank then may have a general response subset of information that is used when sending emails that are not bank-to-bank emails or customer emails. Because there are different receiving sites of emails that the bank sender wishes to handle differently, the DNS information can have different subsets of information that are supplied depending on the different receiving site.

p-0032<figref idrefs="DRAWINGS">FIG. 2</figref> illustrates an embodiment of a method that is generally referred to by reference number <b>60</b>, which can be used for setting up DNS server <b>18</b> in <figref idrefs="DRAWINGS">FIG. 1</figref> for replying to queries for information based on the identity of the querying entity. Method <b>60</b> begins at <b>62</b> and proceeds to a step <b>64</b> where the information associated with at least one of domains <b>26</b>, <b>28</b> and <b>30</b> is defined to have at least two different subsets. The subsets of information associated with the domain can be stored in DNS memory <b>20</b> for later access by DNS <b>18</b> in response to a query from one or more of the querying entities <b>40</b>, <b>42</b> or <b>44</b>. Method <b>60</b> then proceeds to step <b>66</b> where one of the subsets of information is designated for use in replying to a query based at least partially on the entity indicator of the querying entity. The selected subset can be a subset of the information that is customized specifically for a particular one of the querying entities, or can be a subset of the information customized for particular groups of querying entities. Method <b>60</b> ends at step <b>68</b>. By defining at least two different subsets of information for at least one of the domains, the DNS can reply to queries about the domain with a selected one of the subsets based on the identity of the querying entity.

p-0033<figref idrefs="DRAWINGS">FIG. 3</figref> illustrates a method that is generally referred to by reference number <b>74</b>, which can operate in the DNS server <b>18</b> in <figref idrefs="DRAWINGS">FIG. 1</figref>. Method <b>74</b> begins at <b>76</b> and proceeds to step <b>78</b> where a query for information is received from a querying entity having an IP address for information regarding a domain. Method <b>74</b> then proceeds to step <b>80</b> where a decision is made as to whether the IP address of the querying entity is a known IP address or an unknown IP address. If the IP address is known, then method <b>74</b> proceeds to step <b>82</b> where a reply is sent that contains the special response subset of information about the domain and which is intended for the known IP address. Method <b>74</b> then proceeds to <b>84</b> where the method ends. On the other hand, if at step <b>80</b> the IP address is not a known IP address, method <b>74</b> proceeds to step <b>86</b> where a reply is sent to the querying entity that contains general response subset of information that is intended for unknown IP addresses. Method <b>74</b> then proceeds to step <b>84</b> where the method ends. In this embodiment, by determining if the IP address of the querying entity is known or unknown, method <b>74</b> can reply to the query with a special response subset of the information or with a general response subset of the information. Of course, the DNS can reply to at least some known IP addresses with the general response subset of the information when those IP addresses have been designated to receive the general response subset of information. Also, different querying entities with known IP addresses can receive different or the same subsets of information.

p-0034A receiving network or receiver in an email application is an example of a querying entity. In the transfer of an email from a sender to a receiver, the appropriate receiver can be determined by the sender from a plurality of different receivers using the DNS and the recipient's email address, obtained from the header of the message. Once the appropriate receiver receives the email, the receiver looks up information in the DNS on how the email should be handled. In this situation the receiver is the querying entity and queries the DNS by looking up the information in the DNS on how the email from the sender, should be handled. Different information for the handling of the email can be supplied by the DNS depending on the identity of the receiver. In one embodiment, the email sender can define the information in the DNS so that different receivers get different subsets of information in replies from the DNS. For example, different special response subsets of information can be associated with different receivers. <figref idrefs="DRAWINGS">FIG. 4</figref> illustrates a method involving emailing that is generally referred to by the reference number <b>90</b>, which can operate in DNS <b>18</b> shown in <figref idrefs="DRAWINGS">FIG. 1</figref>. Method <b>90</b> begins at <b>92</b> and proceeds to step <b>94</b> where a query is received for information from a querying entity that is identifiable by a specific IP address that can be obtained by the query. Method <b>90</b> then proceeds to step <b>96</b> where a determination is made as to whether the IP address of the querying entity is an IP address that belongs to a specific receiver “A”. If the determination is that the IP address is for receiver “A”, then method <b>90</b> proceeds to step <b>98</b> where a reply is sent to the querying entity that contains a special response subset of information specific to receiver “A”. Method <b>90</b> then proceeds to <b>106</b> where the method ends.

p-0035If the determination at step <b>96</b> is that the IP address is not receiver “A” then method <b>90</b> proceeds to step <b>100</b> where a determination is made as to whether the IP address of the querying entity is an IP address that belongs to a specific receiver “N”. There can be numerous different receivers in method <b>90</b> and these are represented by “A” to “N”. The “A” receiver represents a first receiver and “N” represents the last receiver, any number of IP addresses can be determined for receivers in between receiver “A” and receiver “N”. If the determination is that the IP address is for receiver “N”, then method <b>90</b> proceeds to step <b>102</b> where a reply is sent to the querying entity that contains a different special response subset of information specific to receiver “N”. Method <b>90</b> then proceeds to <b>106</b> where the method ends. If the determination at step <b>100</b> is that the IP address is not receiver “N” then method <b>90</b> proceeds to step <b>104</b> where a reply is sent to the querying entity that contains a general response subset of the information. Method <b>90</b> then proceeds to <b>106</b> where the method ends. Receivers “A” and “N” are exemplary of specific email receivers.

p-0036An embodiment of a method for replying to queries based on the querying entity's identification is shown in <figref idrefs="DRAWINGS">FIG. 5</figref> and is generally indicated by the reference number <b>110</b>. Method <b>110</b> is illustrative of the operation of a customized DNS server <b>130</b> in <figref idrefs="DRAWINGS">FIG. 6</figref>. DNS server <b>130</b> can be a part of DNS system <b>14</b> shown in <figref idrefs="DRAWINGS">FIG. 1</figref> which is communicatively connected to the Internet <b>12</b> through communication line <b>16</b>. The customized DNS in this embodiment includes a selection layer <b>134</b> that is inserted between a server <b>132</b> and a memory <b>136</b>. Memory <b>136</b> can be a memory cache and can be read/write or read-only memory media such as a disk or other type of memory. In this instance, cache memory <b>136</b> is shown as integral to customized DNS server <b>130</b> however the memory can be separate from customized DNS server <b>130</b>.

p-0037Method <b>110</b> begins at <b>112</b> and proceeds to a step <b>114</b> where DNS server <b>132</b> receives a query through DNS <b>14</b> and communication line <b>16</b> from querying entity <b>40</b>, <b>42</b> or <b>44</b> over Internet <b>12</b> for information regarding one of Internet connected domain <b>26</b>, <b>28</b>, or <b>30</b>. The query includes the identity indicator <b>52</b>, <b>54</b> or <b>56</b> respectively depending on which querying entity <b>40</b>, <b>42</b> or <b>44</b> is making the query. Method <b>110</b> then proceeds to step <b>116</b> where DNS server <b>132</b> refers to inserted selection layer <b>134</b> for the queried information. Method <b>110</b> then proceeds to step <b>118</b> where inserted selection layer <b>134</b> receives the identity indicator of the querying entity, such as the host IP address or host name, from the server <b>132</b>.

p-0038Method <b>110</b> then proceeds to step <b>120</b> where a decision is made as to whether the querying entity is a known entity or an unknown entity. A known entity can be an entity that is designated to receive a special information subset in response to queries. An unknown entity can be an entity that is not recognized by the DNS server and is therefore not designated to receive a special information subset in response to queries. If it is determined that the querying entity is known, then method <b>110</b> proceeds to step <b>122</b> where the memory is accessed for the subset of information that is designated for that particular querying entity. Method <b>110</b> then proceeds to step <b>124</b> where a reply is sent to the querying entity with the appropriate information, in this instance, the special response subset of information. Method <b>110</b> then proceeds to step <b>126</b> where method <b>110</b> ends.

p-0039If it is determined that the querying entity is unknown at step <b>120</b>, then method <b>110</b> proceeds to step <b>128</b> where the memory is accessed for the general response subset of information. Method <b>110</b> then proceeds to step <b>124</b> where a reply is sent to the querying entity with the appropriate information, in this instance, the general response subset of information. Method <b>110</b> then proceeds to step <b>126</b> where method <b>110</b> ends. A conventional, un-modified DNS server, would look up the queried information directly from the memory cache instead of accessing or referring to the inserted selection layer, and would return the same reply regardless of the identity of the querying entity.

p-0040Another embodiment of a method for replying to queries based on the querying entities identification is shown in <figref idrefs="DRAWINGS">FIG. 7</figref> and is generally indicated by reference number <b>140</b>. Method <b>140</b> is illustrative of the operation of a customized DNS <b>156</b> in <figref idrefs="DRAWINGS">FIG. 8</figref>. DNS <b>156</b> can be a portion of the overall DNS system <b>14</b> serving the Internet which is illustrated as communicatively connected to the Internet by communication line <b>16</b>. The customized DNS in this embodiment includes a customized server <b>158</b> that has a software hook <b>160</b>. As will be seen, the hook can be arranged to intercept and redirect the lookup of information in response to a query in the customized DNS.

p-0041Method <b>140</b> begins at <b>142</b> and proceeds to step <b>144</b> where a query for information relating to a domain is received. Method <b>140</b> then proceeds to step <b>146</b> where the software hook intercepts or hooks the lookup of information that a conventional DNS would otherwise perform in response to the received query. Method <b>140</b> then proceeds to step <b>148</b> where the query is redirected from the hook to a process and/or function <b>164</b> over a link <b>162</b>. In one embodiment where the intercepted query is redirected to a function, the function can be a function call. In another embodiment, the query is redirected to a process, the process can be one or more of a command-line argument, inter-process communication, semaphore and/or token exchange as will be recognized by one of ordinary skill in the art having this overall disclosure in hand. Method <b>140</b> then proceeds to step <b>150</b> where the process or function looks up the information from memory for the received query based on the identity of the querying entity. The information has a subset of special response information for at least one known querying entity and a subset of general response information for at least one unknown querying entity. Step <b>150</b> can involve one or more of the following embodiments for looking up the queried information.

p-0042In one embodiment, the information can be looked up at step <b>150</b> from a network service <b>166</b> over a network link such as a socket connection <b>168</b>. In another embodiment, the information can be looked up from a disk cache <b>172</b> over a disk link <b>174</b>. The disk cache can include a database or one or more files on one or more disk based storage devices. In another embodiment, the information can be looked up from a memory cache <b>176</b> over a memory link <b>178</b>. The memory cache can comprise non-volatile memory or some other type of memory having a memory based database. The memory can be a shared memory. Once the appropriate information is obtained from memory based on the identity of the querying entity, method <b>140</b> proceeds to step <b>152</b> where the information is supplied to the querying entity in a reply. In one embodiment, the information can be passed back to hook <b>160</b> from process or function <b>164</b> over link <b>162</b> and then the DNS server <b>158</b> can use the information to reply to the query. Method <b>140</b> then proceeds to step <b>154</b> where method <b>140</b> ends.

p-0043The customized DNS server, just as is the case with the customized DNS servers described above, can be configured to reply to the full range of possible DNS queries from known and unknown querying entities; or can be configured to reply to queries for select information, such as by way of example, TXT or other types of records.

p-0044In an embodiment illustrated by <figref idrefs="DRAWINGS">FIG. 9</figref>, a method in which the DNS is able to reply to a query for information that has been delegated by an administrator to a different server is generally indicated by the reference number <b>180</b>. In some instances, certain portions of DNS records or information related to a domain may be delegated to a different DNS server than other portions of the information. One or more subsets of the information can be configured to include one or more preferences that are selectable by a domain administrator. For example, a domain administrator may want to have TXT, or other records delegated to a different server so that special response subsets of the TXT information can be provided to certain querying entities while a general response subset of the TXT information can be provided to other querying entities. In this situation, a querying entity may not know where the information sought or queried information can be found, i.e. whether the queried information has been delegated or not.

p-0045Method <b>180</b> begins at <b>182</b> and proceeds to step <b>184</b> where a query for TXT information, by way of example, is received by the DNS regarding a domain. Method <b>180</b> then proceeds to step <b>186</b> where information regarding the queried domain is returned within the DNS in response to looking up the TXT record for the domain name. Method <b>180</b> then proceeds to step <b>188</b> where a decision is made as to whether the returned information indicates that the TXT record for the domain has been delegated to another server or if the TXT record is in the current server. In this instance, if the returned information indicates that the TXT record is in the current server, then the decision at <b>188</b> is negative and the returned information includes the queried information. Method <b>180</b> then proceeds to step <b>190</b> where the information is sent to the querying entity in a reply. Method <b>180</b> then proceeds to step <b>192</b> where the method ends.

p-0046If the decision at step <b>188</b> is that the TXT record has been delegated to another DNS server based on the information retrieved by step <b>186</b>, then method <b>180</b> proceeds to step <b>194</b> where the information is retrieved from the delegated server. By delegating a portion of the DNS information to a different server, the delegated portion of information, in this instance the TXT record, can be defined as subsets of information in the server to which the portion of information is delegated without affecting the remainder of the information which was retrieved by step <b>186</b> and includes, for example, the location of the delegated portion of information, as will be further described below. From step <b>194</b>, method <b>180</b> then proceeds to step <b>190</b> where the subset of TXT information appropriate to the querying entity is sent to the querying entity in a reply. Method <b>180</b> then proceeds to step <b>192</b> where the method ends.

p-0047An Internet domain is a name assigned to an entity, where that entity may or may not physically exist. Two or more fields of a domain name are separated from each other by a single period character between each field. The fields are read left to right, becoming less specific toward the right. Top level (most general) domains are at the right, such as “.com” and “.gov”. An Internet domain name is composed of at least two fields: a local identifier; and a top level domain. For example, the Internet domain name “example.com” has two fields, each separated from the other by a single period character. The local part (field) is “example”; the top level part (field) is “com”.

p-0048Delegation of a portion of the information can in some instances be accomplished using existing DNS software. In the example illustrated by <figref idrefs="DRAWINGS">FIG. 9</figref>, a TXT or other type of information record can be delegated to a different name server using Unix BIND software. While the present examples can use the framework of Unix Bind software, it should be appreciated that other suitable software of this kind, either currently available or yet to be developed can be used by one of ordinary skill in the art having this overall disclosure in hand. An SPF record can form part of the TXT record returned by the DNS server to the querying entity when looking up a TXT record for the domain name. In this instance, a first line returned in response to a query to an initial (e.g., current) DNS server using BIND can be:

p-0049@IN TXT v=spf1 include:_spf1

p-0050In this example, the “@” symbol represents the current DNS server domain name specified by the query. If the current DNS server domain is “example.com”, the “@” represents “example.com”. The SPF TXT record returned is: “v=spf1 include:_spf” which means that additional SPF information can be found at the host “_spf”. Because the “_spf” lacks a dot, the statement indicates that the SPF information in the current DNS server domain, the “@” domain, and therefore the SPF information has not been delegated to another domain or server. It should be appreciated by those having ordinary skill in the art that other records such as spf2 and others can replace spf1 in this example. A second line returned in response to a query to a DNS server using BIND can be:

p-0051_spf IN NS ns.example.com.

p-0052In this instance, the second line is the record for the “_spf' name. Its value is a NS (name server) record which states that the name server is “example.com”. If the current domain, the “@”, is xxx.yyy, the query will be made for a TXT record for the host “_spf.xxx.yyy” which will be looked up at the name server “ns.example.com.” A third line can be:

p-0053sel._domainkey IN NS ns.example.com.

p-0054The third line illustrates a DKIM record. DKIM records are usually TXT records, but here the DKIM record for “sel._domainkey” is an NS record. The result of the third line is that a lookup of the TXT record for “sel._domainkey.xxx.yyy” will be made at the name server “ns.example.com”. In this instance in <figref idrefs="DRAWINGS">FIG. 9</figref>, at step <b>188</b> the decision would be that the record has been delegated to “example.com”. By delegating TXT or other records to another name server, those records can be custom returned based on the entity indicator of the querying entity, such as the IP address.

p-0055A sub-domain is a naming convention whereby a more local field is added to the left of the local part. For example, “morelocal.example.com” has three fields: “morelocal”, “example”, and “com”. The “morelocal” field is the most local field (the leftmost field) and so is considered to be under “sub” the higher domain “example.com”. Thus, as a naming convention, “morelocal.example.com” is a sub-domain of “example.com”.

p-0056The term “sub-domain” is called a naming convention because there is no way to determine, merely by its name, if a multi-part domain name is the name of a host or the name of a domain containing one or more hosts. Using the Domain Naming System (DNS), one may differentiate between a host and a domain by querying for NS (Name Server) records. A host will lack such records, but a domain will contain such records. If the information associated with the name “morelocal.example.com”, includes a NS record when the DNS is queried, then it is a sub-domain of “example.com”. If the information associated with the name “morelocal.example.com”, does not include NS records when the DNS is queried then it is the name of a host inside the “example.com” domain. In no way should the use of specific standards in the examples herein be construed as limiting the scope of this application to the specific standard. Other standards including other email authentication and/or authorization standards and those standards yet to be developed or adopted may be used as can be appreciated by those of ordinary skill in the art.

p-0057In an embodiment illustrated by <figref idrefs="DRAWINGS">FIG. 10</figref>, one embodiment of a method by which a sub-domain can be delegated to a new server is generally indicated by the reference number <b>196</b>. Method <b>196</b> begins at <b>198</b> and proceeds to step <b>200</b> where the current DNS server for a sub-domain named “subdomain” is determined. Method <b>196</b> then proceeds to step <b>202</b> where a determination is made as to whether the sub-domain is to be delegated to a new or different server. If the determination at step <b>202</b> is that it is not to be delegated then method <b>196</b> proceeds to step <b>204</b> where the method ends. If the determination at step <b>202</b> is that the sub-domain is to be delegated to a new or different server then method <b>196</b> proceeds to step <b>206</b> where the new or different server is defined. Method <b>196</b> then proceeds to step <b>204</b> where the method ends. By way of example, when using Unix BIND software, the subdomain can be changed by using the following line 4:

p-0058subdomain IN NS ns.example.com.

p-0059In this instance, the name of the sub-domain is “subdomain” and line 4 causes the DNS records to be looked up at the name server “ns.example.com”. By delegating the sub-domain, all records of that sub-domain will be found at another, different server “ns.example.com”. By delegating records to another name server, TXT records, among other types of records, can be custom returned based on later querying IP addresses or other querying entity identities.

p-0060The advanced DNS server of the present disclosure can be communicatively connected to the memory device and arranged to allow for configuration of the domain information in the memory device through the DNS server or through another computer. The domain information can be configured into subsets of information where different subsets can be used for replying to queries from different querying entities. A domain administrator, DNS administrator or other person having authority can access the information and define the information into the subsets for various querying entities. Access to the information can be controlled so that only authorized persons can configure the information. Access to the information for configuration purposes can also be provided without going through the DNS server. That is, for example, other computers may be connected to the memory device storing the information and can be used for accessing and configuring the information. Various types of access can be provided, including through a keyboard, mouse or other interface and configuration software can be used to manipulate and define the information to be used for various replies to various queries from various querying entities.

p-0061The special response information can be configured specifically for one or more selected querying entities while unknown querying entities can receive general response information that can be configured specifically for unknown querying entities or the general response information can be information that would otherwise be used for replies from a conventional DNS server for the queried domain. The special response information can be stored in one location and the general response information can be stored in another, different location. For instance, the general response information can be stored in the DNS cache while the special response information can be stored in a network accessed database that is at a separate site from the DNS cache. In these instances, the domain administrator may have access to the special response information through an interface that is connected directly to the database. In this situation, the domain administrator may have physical access to the network database.

p-0062The ability to provide special response information to select querying entities can be provided on a payment basis. In this embodiment, domains can subscribe to a service which allows different responses to queries about the domain to different querying entities. Separate customized DNS servers can be used to provide the special response information to queries from known entities.

p-0063In one or more embodiments disclosed, modifying the cache used by DNS servers so that replies can be custom constructed based on the querying IP address or its corresponding domain name has been discussed. Although it may be impractical to modify all DNS servers worldwide, if an email sender or other administrator wants to have its DNS thusly handled, that administrator may delegate DNS services for that record to a business that performs this customized DNS reply. Delegation can be performed on a record by record basis, or the administrator may prefer to delegate an entire sub-domain. By arranging for all DNS queries to be delegated to a single DNS server, the administrator can thereafter offer one DNS reply having a subset of information to one or more receiving sites, and another DNS reply having at least another subset of information to one or more other receiving sites.

p-0064Other embodiments also disclose replying to DNS queries one way for some querying IP addresses or their corresponding domain names, and replying differently for other querying IP addresses. This system can be further defined by subscriber customer preferences, where those preferences determine the nature of each DNS reply. The administrators of the domains where queries are replied based on the querying entity can be customers of a provider of this service. These customers may be paying or non-paying.

p-0065Another embodiment involves modifying the way a DNS server looks up its replies. Normally the DNS server finds reply data or information in its cache. Another method for finding that data is by making a call to a separate process or function. In this method the cache of the DNS server is unmodified, and instead a software hook is installed so that the DNS server performs its lookup using an external process or a function compiled or linked into the DNS server. Since modification of all DNS servers worldwide may be difficult, one or more such customized DNS servers can be offered as a service to customers with need for them.

p-0066Although IP addresses may have been discussed as separate from a host name, nothing prevents IP address from being hosts and/or host names from being IP addresses. For example, a host name may have more than one IP address associated with it. Also, a given IP address may have more than one physical host associated with it, as represented by different ports.

p-0067While a number of exemplary aspects and embodiments have been discussed above, those of skill in the art will recognize certain modifications, permutations, additions and sub-combinations thereof. It is therefore intended that the following appended claims and claims hereafter introduced are interpreted to include all such modifications, permutations, additions and sub-combinations as are within their true spirit and scope.