Terminology

The basic DNS record type that points a hostname straight at an IP address, e.g. for a website. It says nothing about who is allowed to send email – see SPF | A and MX Records for why that matters.

The extra check DMARC adds on top of SPF and DKIM’s own pass/fail results: whether the domain that actually passed matches the domain a reader sees in the “From” address. See DMARC | Alignment in Depth for the full explanation.

Brand Indicators for Message Identification: lets a mailbox provider show a company’s logo next to its email, but only once DMARC is already properly enforced. See BIMI | Guidelines.

A type of DNS record that points one name to another, like a forwarding address. Instead of publishing a value directly, a CNAME says “look at this other name instead” – useful when someone else needs to control what the actual value is.

DomainKeys Identified Mail: a digital signature added to outgoing email that proves it was not altered in transit and genuinely came from the domain it claims to. The other check DMARC relies on. See DKIM | Guidelines.

The policy layer on top of SPF and DKIM: it tells mailbox providers what to do with a message that fails authentication, and asks for reports on what they saw. See DMARC | Guidelines.

The internet’s phonebook: a global directory that translates human-readable names like example.com into the technical addresses and records computers actually use to find each other, including the records SPF, DKIM, DMARC and BIMI all rely on.

The address a mail server actually uses to route and bounce a message, carried in a separate, mostly invisible part of the SMTP conversation (also called the return-path). It does not have to match the “From” address a reader sees, and it is what SPF checks.

The first thing a mail server says when it connects to another one: essentially “hello, this is my hostname.” EHLO is the modern, capability-announcing version of the older HELO greeting.

Mail Transfer Agent: the software that actually sends and receives email between servers, as opposed to the mail app (like Outlook or Gmail) a person reads it in.

A DNS record that tells the world which mail servers are responsible for receiving email for a domain. It controls incoming mail, not who is allowed to send it – see SPF | A and MX Records for why that matters.

A domain’s top-level registered name, e.g. example.com, as opposed to any subdomain built on top of it, like mail.example.com. DMARC alignment often only requires matching down to this level – see DMARC | Alignment in Depth.

A DMARC policy (p=quarantine) that tells mailbox providers to treat a failing message as suspicious, typically by routing it to spam, rather than blocking or delivering it normally.

The strictest DMARC policy (p=reject): mailbox providers are told to refuse a failing message outright, so it never reaches an inbox or a spam folder.

Request for Comments: the numbered technical documents that define how internet standards like SPF, DKIM and DMARC are actually supposed to work. Despite the name, an accepted RFC is the closest thing the internet has to an official specification.

A label in a DKIM record’s name that lets a domain publish more than one signing key at once, so a sender can add or rotate keys without breaking the ones already in place. See DKIM | Guidelines for how selectors are used in practice.

Sender Policy Framework: a DNS record that lists which servers are allowed to send email for a domain. One of the two checks DMARC relies on. See SPF | Guidelines.

A DNS record type built to hold a short piece of text. SPF, DKIM and DMARC all publish their settings as TXT records, since none of them needed a dedicated record type of their own.

Verified Mark Certificate: proof, issued by a small number of trusted authorities, that a company legally owns the logo it wants mailbox providers to display next to its email via BIMI. See BIMI | Guidelines for the full requirements.