Email Authentication Glossary
Understand the terms and concepts behind DMARC, DKIM, SPF, BIMI, and other email security protocols.
A
Alignment
The match between the domain in the email From header and the domain verified by SPF or DKIM. DMARC checks alignment to determine if a message is authenticated.
Authentication-Results
A header added by receiving mail servers showing the results of SPF, DKIM, and DMARC authentication checks for a given message.
B
BIMI
Brand Indicators for Message Identification. An email standard that lets domain owners display a verified logo next to their messages in supported inboxes.
BIMI Selector
The label in the DNS record name that identifies which BIMI record applies. The default selector is commonly set to default._bimi.
C
Compliance
Meeting the email authentication requirements set by regulations, industry standards, or mailbox provider policies such as SPF, DKIM, and DMARC enforcement.
CNAME
A DNS record type that maps one domain name to another. CNAME records are sometimes used to delegate DMARC reporting to a third-party service.
D
DKIM
DomainKeys Identified Mail. An email authentication method that adds a cryptographic signature to messages so receiving servers verify the content was not altered in transit.
DKIM Selector
The name included in the DKIM signature header that tells the receiving server which public key to look up in DNS for verification.
DMARC
Domain-based Message Authentication, Reporting and Conformance. An email authentication protocol built on SPF and DKIM that lets domain owners set policies and receive reports.
DMARC Policy
The instruction in a DMARC record telling receiving servers what to do with unauthenticated mail. Options are none (monitor), quarantine (send to spam), or reject.
DNS
Domain Name System. The global directory that translates domain names into IP addresses and stores TXT records used by SPF, DKIM, DMARC, and BIMI.
Domain Alignment
The requirement that the domain in the email From header matches the domain authenticated by SPF or DKIM. DMARC uses alignment to prevent spoofing.
E
Email Spoofing
Forging the sender address of an email to make it appear as if it came from a trusted domain. DMARC enforcement blocks spoofed messages from reaching recipients.
Envelope From
The return path address used in the SMTP conversation to identify the message sender. SPF validates the envelope From domain.
F
Forensic Report
A detailed report sent when a message fails DMARC authentication. Also called a failure report, it includes message headers and authentication results.
G
GDPR
General Data Protection Regulation. An EU regulation requiring organizations to protect personal data, including email addresses and communication records.
H
Header From
The email address visible to recipients in the From field of a message. DMARC checks whether the header From domain aligns with SPF and DKIM domains.
HIPAA
Health Insurance Portability and Accountability Act. A US law requiring healthcare organizations to protect patient data, including email communication security.
I
Identifier Alignment
Another term for domain alignment in DMARC. It confirms the domain in the From header matches the domain verified by SPF, DKIM, or both.
M
MTA-STS
Mail Transfer Agent Strict Transport Security. A standard that tells sending servers to use TLS when delivering mail to your domain, preventing downgrade attacks.
MX Record
A DNS record that specifies the mail servers responsible for receiving email for a domain. MX records direct incoming messages to the correct server.
P
PCI DSS
Payment Card Industry Data Security Standard. A set of security standards for organizations handling credit card data, including email authentication requirements.
PermError
A permanent DNS error indicating the SPF or DMARC record is invalid or malformed. Receiving servers treat PermError as a failed authentication result.
Phishing
A social engineering attack where criminals send fraudulent emails pretending to be from a trusted source to steal credentials, data, or money.
R
RUA
Reporting URI for Aggregate reports. The tag in a DMARC record specifying the email address where aggregate authentication reports get sent.
RUF
Reporting URI for Forensic reports. The tag in a DMARC record specifying the email address where forensic or failure reports get sent.
Reputation
A score assigned to a sending domain or IP address based on email authentication results, spam complaints, and sending behavior.
S
Selector
A string in the DKIM signature header that identifies which public key to retrieve from DNS for message verification.
SPF
Sender Policy Framework. A DNS-based email authentication method that specifies which IP addresses are authorized to send email on behalf of a domain.
SPF Flattening
The process of resolving nested SPF include statements into a single list of IP addresses to keep the total DNS lookups under the 10-query limit.
Subdomain Policy
The DMARC sp tag that defines the enforcement level for subdomains without their own DMARC record. It inherits the main domain policy by default.
T
TLS-RPT
TLS Reporting. A mechanism for domains to request reports about TLS connection successes and failures from sending mail servers.
TXT Record
A DNS record type that holds text data. SPF, DKIM, DMARC, and BIMI records are all published as TXT records in DNS.
V
VMC
Verified Mark Certificate. A digital certificate proving the BIMI logo is a registered trademark owned by the sending organization.
Secure your domain today
DMARC+ monitors your DMARC reports, identifies unauthorized senders, and guides you to full enforcement.
Start Your 14-Day Trial