The records
- SPF (Sender Policy Framework)
- A DNS record listing the servers allowed to send mail as your domain. Explained here.
- DKIM (DomainKeys Identified Mail)
- A cryptographic signature on each message you send, verified against a key in your DNS. Explained here.
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- The record that ties SPF and DKIM to the address the reader sees and says what to do on failure. Explained here.
- MX record
- Names the servers that receive mail for your domain. Governs incoming mail only.
- BIMI
- A record pointing at your logo, so supporting inboxes show it beside your mail. Requires DMARC enforcement first.
- MTA-STS
- A policy requiring other servers to encrypt mail they deliver to you, instead of silently falling back to plain text.
- TLS-RPT
- A record asking other providers to report failed encrypted deliveries to you, so downgrades are visible.
- DNSSEC
- Cryptographic signing of your DNS answers, so they cannot be forged in transit.
The vocabulary
- Alignment
- DMARC’s requirement that SPF or DKIM passes for the domain in the From line - not merely for some domain.
- Policy (
p=) - The DMARC instruction:
none,quarantineorreject. - Enforcement
- A DMARC policy of quarantine or reject - that is, a policy that actually acts.
- Subdomain policy (
sp=) - The DMARC policy applied to your subdomains. Omit it and they inherit the main policy.
- Rollout percentage (
pct=) - The proportion of failing mail the policy is applied to. Defaults to 100.
- Aggregate report (
rua=) - A daily XML summary from a receiving provider listing every source that sent as your domain and whether it passed.
- Forensic report (
ruf=) - A per-message report. Rare - most large providers never send them, for privacy reasons.
- Selector
- The short name a DKIM key is published under, letting one domain hold several keys.
- Include chain
- The tree of SPF records your record pulls in through
include:, and what the ten-lookup limit is counted across. - Lookup budget
- The ten DNS lookups an SPF evaluation is allowed. Exceed it and receivers stop honouring your SPF entirely.
- Nameservers
- The servers holding the authoritative copy of your DNS records - whoever runs them is where a fix is published.
- Zone
- All the DNS records for one domain, taken together.
- Spoofing
- Sending mail that claims to be from a domain you do not control. It requires no hacking and no access to anything of yours.
- Lookalike domain
- A different domain registered to resemble yours. Outside what DMARC can govern.
- Display name spoofing
- Putting your company name in front of somebody else’s address. The name is what people read; the address is what is checked.
The product
- Check
- One run of the thirteen tests against one domain, at one moment. Explained here.
- Verdict
- One check’s outcome: pass, warn, fail, or not applicable.
- Not applicable
- The check does not apply to this domain. It is left out of the score and is never treated as a failure.
- Score
- A weighted mark out of 100 across the checks that applied. Authentication carries the most weight.
- Organisation
- The owner of domains, members and tokens. Everything belongs to one. Explained in full by organisations, seats and roles in your panel’s help, once you have an account.
- Seat
- A place on an organisation that a person occupies. Plans sell seats.
- Scope
- A permission on an API token, written
resource:action. One never implies another. Explained in full by API tokens in your panel’s help, once you have an account. - DMARC Credit
- The unit usage beyond a plan allowance is metered in. See the pricing page.