Guides
Email authentication glossary
The terms that appear in every DMARC report, DNS record and deliverability conversation, explained once.
- SPF
- Sender Policy Framework. A TXT record listing the servers allowed to send mail using your domain in the envelope sender. Limited to 10 DNS lookups.
- DKIM
- DomainKeys Identified Mail. A cryptographic signature on each message, verified against a public key at selector._domainkey.yourdomain.
- DMARC
- Domain-based Message Authentication, Reporting and Conformance. Ties SPF and DKIM to the From header and tells receivers what to do on failure: none, quarantine or reject.
- Alignment
- The requirement that the SPF domain or DKIM signing domain matches the From header domain. Relaxed allows subdomains; strict requires an exact match.
- p= policy
- The DMARC tag that sets the action on failure. p=none monitors, p=quarantine spam-folders, p=reject refuses delivery.
- pct=
- The percentage of failing messages the policy applies to. Used to ramp enforcement from 25 to 100.
- RUA
- Aggregate report address (rua=mailto:). Receivers send daily XML summaries of every source that sent as your domain, with counts and pass/fail results.
- RUF
- Forensic report address. Per-message failure reports; few receivers send them and they can contain message content.
- Aggregate report
- The XML file receivers send to the RUA address, usually gzipped or zipped, one per receiver per day.
- Selector
- The label that names a DKIM key, for example google or selector1. A domain can publish many keys under different selectors.
- MX
- Mail exchanger records: the hosts that accept incoming mail for a domain, in priority order.
- Null MX
- An MX record of "0 ." that declares the domain never receives mail.
- MTA-STS
- Mail Transfer Agent Strict Transport Security. A DNS record plus an HTTPS policy file that require senders to deliver to you over TLS to listed MX hosts.
- TLS-RPT
- TLS Reporting. A DNS record asking senders to report TLS negotiation failures to you.
- BIMI
- Brand Indicators for Message Identification. Shows your logo next to messages in supporting mailboxes; requires enforced DMARC and usually a Verified Mark Certificate.
- PTR
- Reverse DNS record mapping an IP address back to a hostname. Mail servers expect the sending IP's PTR to resolve forward to the same IP.
- DNSBL
- DNS-based blacklist. A zone that answers for IPs known to send spam; receivers query it at connection time.
- Lookalike domain
- A domain registered to imitate yours by typo, homoglyph, added word or different TLD. Dangerous when it gains MX records and can receive replies.
- Posture score
- EmailSecOps's 0 to 100 score weighting DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT, reverse DNS and blacklist status.
See these terms applied to your domain.
Free, no account.
No card for the free plan · Billing by Stripe · We never send mail on your behalf · Privacy