Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

Glossary

The terms, defined

One page per term. Each says what it is, what it proves, and the thing about it that most often goes wrong.

  • BIMIBrand Indicators for Message Identification: a DNS record pointing at a logo and, for most providers, a verified mark certificate, so that participating mailbox providers display the logo beside authenticated mail. Currently an Internet-Draft, not an RFC.
  • DANEDNS-Based Authentication of Named Entities: a TLSA record in DNSSEC-signed DNS that states which certificate a mail server must present, removing reliance on public certificate authorities. Defined in RFC 6698 and RFC 7672 for SMTP.
  • DKIMDomainKeys Identified Mail: a cryptographic signature added to outgoing messages and verified against a public key published in the sending domain's DNS. Defined in RFC 6376.
  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • DMARC alignmentThe DMARC requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header, either exactly (strict) or allowing subdomains (relaxed). Defined in RFC 9989 section 4.4.
  • DNSSECDomain Name System Security Extensions: cryptographic signatures on DNS records that let a validating resolver confirm an answer came from the real zone and was not altered. Defined in RFC 4033 through RFC 4035.
  • MTA-STSSMTP MTA Strict Transport Security: a policy published over HTTPS and announced in DNS that tells sending servers to require TLS and to accept only named mail exchangers for a domain. Defined in RFC 8461.
  • p=rejectThe DMARC policy instructing receivers to refuse messages that fail authentication for the From domain, rather than delivering or quarantining them. Defined in RFC 9989 section 4.7.
  • PermErrorThe SPF result meaning the record could not be evaluated because it is invalid or exceeds a processing limit. It is a failure, not a neutral outcome, and applies to every message the domain sends. Defined in RFC 7208 section 2.6.
  • PTR and FCrDNSA PTR record maps an IP address to a hostname; forward-confirmed reverse DNS (FCrDNS) is the check that the hostname resolves back to the same address. Receivers use it to distinguish configured mail infrastructure from arbitrary hosts.
  • SPFSender Policy Framework: a DNS TXT record listing the servers authorised to send mail using a domain in the SMTP envelope sender. Defined in RFC 7208.
  • TLS-RPTSMTP TLS Reporting: a DNS record asking sending servers to send daily reports about failures to establish a secure connection to a domain's mail servers. Defined in RFC 8460.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.