Email security glossary

A

Alignment

A DMARC condition: the domain validated by SPF (technical sending address) or by DKIM (signing domain d=) must match the domain displayed in the "From" field. In relaxed mode (r), a subdomain is enough; in strict mode (s), the domains must be identical.

all qualifier

The ending of an SPF record, which says what to do with servers that are not listed: -all (reject), ~all (mark as suspicious), ?all (neutral) or +all (accept everything, never to be used).

B

Blacklist (DNSBL)

A public list of IP addresses known to send spam, which can be queried through DNS. Emails from a listed address are rejected or sent to the junk folder by many recipients.

D

Deliverability

The ability of your emails to reach the inbox, rather than ending up in the junk folder or being rejected. It depends in particular on SPF, DKIM, DMARC and the reputation of your sending IP addresses.

DKIM

DomainKeys Identified Mail (RFC 6376): a cryptographic signature added to every outgoing email. It proves that the email was sent by a server authorised by the domain and that it has not been altered on the way. See the DKIM guide.

DKIM public key

The public half of the DKIM key pair, published in DNS (the p= tag of the TXT record). Recipients use it to check the signature produced with the private key, which only your sending service holds. A 2048-bit RSA key is the standard today.

DKIM selector

The name of a DKIM key, chosen by the sending service. The key is published at <selector>._domainkey.<domain>, and the selector appears in the s= value of the DKIM-Signature header.

DMARC

Domain-based Message Authentication, Reporting and Conformance (RFC 7489): a DNS record that requires the displayed address to be validated by SPF or by DKIM, tells recipients what to do with emails that fail and asks for reports. See the DMARC guide.

DMARC policy

The instruction in the p= tag for emails that fail DMARC: none (monitor only), quarantine (send to the junk folder) or reject (refuse). The sp= tag sets the policy for subdomains.

DNS

Domain Name System: the directory of the internet. It links a domain name to public information, such as the address of its website, its mail servers (MX) or its SPF, DKIM and DMARC records.

DNS lookup limit

A rule of the SPF standard (RFC 7208): evaluating an SPF record must not trigger more than 10 DNS lookups (include, a, mx, ptr, exists and redirect, including in the included records). Beyond that, the SPF record is invalid.

DNS-over-HTTPS (DoH)

Querying DNS over an encrypted HTTPS connection. This is what allows Domain Check to query DNS directly from your browser, through the public resolvers of Cloudflare and Google.

F

Filtering gateway

A service placed in front of the email service (Mailinblack, Vade, Mimecast, Proofpoint…) that receives emails, filters them and then passes them on. The domain's MX then points to the gateway rather than to the email service.

I

include

An SPF mechanism that authorises the servers listed in another domain's SPF record, for example include:spf.protection.outlook.com for Microsoft 365. Each include costs at least one DNS lookup.

M

MX

Mail Exchanger: a DNS record that designates the servers that receive a domain's email, each with a priority. The lowest value is tried first.

N

Null MX

A single MX record, with priority 0 pointing to the target "." (RFC 7505), which declares that a domain receives no email. Senders then give up immediately instead of retrying.

O

Organisational domain

The domain registered with a registry, just below the extension: exemple.nc for mail.exemple.nc. DMARC uses it for relaxed alignment and to apply its policy to subdomains that do not publish one.

P

pct

A DMARC tag that sets the percentage of failing emails subject to the policy (100 by default). It is useful during the step-by-step rollout, but must go back to 100.

Phishing

A fraudulent email that imitates a trusted sender (bank, supplier, manager) to obtain a password, a payment or the opening of a booby-trapped attachment. A DMARC p=reject policy prevents your own domain from being used for these attacks.

R

rua

A DMARC tag that gives the address (mailto:) where daily aggregate reports are sent: volumes, sending IP addresses and SPF, DKIM and DMARC results.

ruf

A DMARC tag that gives the address for detailed failure reports, sent one email at a time. Few email providers send them, for privacy reasons.

S

SPF

Sender Policy Framework (RFC 7208): a TXT record that lists the servers allowed to send email for a domain. See the SPF guide.

SPF mechanism

A term in an SPF record that designates authorised servers: ip4, ip6, a, mx, include, exists, ptr, and all, which applies to all the others. Each one can be preceded by a qualifier.

Spoofing

Sending an email that claims to come from your domain without your permission. SPF, DKIM and above all DMARC at p=reject allow recipients to detect it and refuse it.

T

TTL

Time To Live: the length of time, in seconds, during which resolvers may keep a DNS response in their cache. It sets the delay before a change is visible everywhere.

TXT record

A DNS record that contains free text. SPF, DKIM and DMARC are published in this form. A value longer than 255 characters is split into several strings, which servers join back together.