Glossary: SPF, DKIM, DMARC, DNSSEC & more explained

Email authentication

SPF Sender Policy Framework: SPF is a DNS record that defines which servers may send email on behalf of a domain. Receiving mail servers check it for every incoming message.
DKIM DomainKeys Identified Mail: DKIM cryptographically signs outgoing email. Receivers verify the signature with a public key from DNS and so detect forged or altered messages.
DMARC Domain-based Message Authentication, Reporting and Conformance: DMARC ties SPF and DKIM to the visible sender address and defines what happens to forged email: nothing (none), spam folder (quarantine) or rejection (reject).
DMARC alignment Domain match in DMARC: Alignment means that the domain verified by SPF or DKIM matches the visible From domain. Without alignment a message fails DMARC even if SPF and DKIM pass.
BIMI Brand Indicators for Message Identification: BIMI lets mail clients such as Gmail or Apple Mail show the brand logo next to a message – but only if the domain is strictly protected by DMARC.

MX Mail Exchanger record: MX records define which servers accept email for a domain. A domain that receives no mail should say so explicitly with a null MX record.
Reverse DNS (PTR) Reverse lookup of an IP address: Reverse DNS maps an IP address to a host name (PTR record). Mail servers without matching reverse DNS end up in spam or are rejected by many receivers.
MTA-STS SMTP MTA Strict Transport Security: MTA-STS forces sending mail servers to deliver email to your domain only encrypted and only to your real mail servers with a valid certificate.
TLS-RPT SMTP TLS Reporting: TLS-RPT makes large mail providers send you daily reports on whether encrypted deliveries to your domain succeeded or failed.
DANE DNS-based Authentication of Named Entities (TLSA): DANE publishes the fingerprint of the mail server certificate in a DNSSEC-signed TLSA record. Sending servers use it to enforce an encrypted connection to the real server.
Blocklist (DNSBL) DNS-based blocklists: DNS blocklists (DNSBL) list IP addresses and domains that have been seen sending spam. Many mail servers reject or spam-filter mail from listed senders.

HTTPS & TLS Website encryption: HTTPS encrypts the connection between browser and website using TLS. It needs a valid certificate, current TLS versions and a redirect from HTTP to HTTPS.
HSTS HTTP Strict Transport Security: HSTS is an HTTP header with which a website tells the browser: only call me via HTTPS for a certain time. This prevents attacks via unencrypted first requests.
Security headers HTTP security headers: Security headers are HTTP response headers with which a website instructs the browser to block attacks such as cross-site scripting, clickjacking and data leakage.
CAA Certification Authority Authorization: A CAA record defines which certificate authorities may issue certificates for a domain. All public certificate authorities must check it before issuing.

Nameservers Authoritative DNS servers of a domain: Nameservers answer all DNS queries about a domain. If they fail or are misconfigured, website and email become unreachable.
DNSSEC Domain Name System Security Extensions: DNSSEC cryptographically signs DNS answers, so resolvers detect forged answers from DNS spoofing or cache poisoning. DNSSEC is also a prerequisite for DANE.
RDAP Registration Data Access Protocol: RDAP is the successor of WHOIS and provides a domain's registration data in machine-readable form: registrar, status, locks and expiry date.
Registrar lock Transfer, delete and update locks: Registrar locks are status flags on a domain that prevent an unwanted transfer, deletion or nameserver change – an important protection against domain hijacking.