DNS and email-security terms in plain language
Technical standards keep their names, but their purpose and typical problems should not require a separate search.
DNS — Domain Name System
- What it is
- The naming system that maps a domain to Internet services.
- What it does
- Maps a domain to public services.
- Why it matters
- Broken DNS can affect several services at once.
- Typical problem
- Delegation and authoritative answers disagree.
MX — Mail Exchanger
- What it is
- A DNS record that names incoming mail servers.
- What it does
- Names the servers that receive email.
- Why it matters
- Senders use it to route incoming mail.
- Typical problem
- A target is missing or unreachable.
SPF — Sender Policy Framework
- What it is
- A DNS policy for permitted SMTP envelope senders.
- What it does
- Lists envelope senders authorized by a domain.
- Why it matters
- It supports email authentication.
- Typical problem
- More than one record or too many lookups.
DKIM — DomainKeys Identified Mail
- What it is
- A public-key signature system for email.
- What it does
- Publishes a public key for email signatures.
- Why it matters
- It lets receivers verify signed message content.
- Typical problem
- The selector record is missing or malformed.
DMARC — Domain-based Message Authentication, Reporting and Conformance
- What it is
- A policy that aligns visible From with SPF or DKIM.
- What it does
- Sets handling guidance for unauthenticated visible From mail.
- Why it matters
- It is the main public anti-impersonation control.
- Typical problem
- p=none never requests enforcement.
SMTP — Simple Mail Transfer Protocol
- What it is
- The protocol mail servers use to transfer email.
- What it does
- Transfers email between mail systems.
- Why it matters
- Mail cannot arrive if receiving SMTP is unavailable.
- Typical problem
- The MX server rejects or times out.
STARTTLS — STARTTLS
- What it is
- An SMTP command that upgrades a connection to TLS.
- What it does
- Upgrades SMTP to encrypted TLS.
- Why it matters
- It protects transport when both sides support it.
- Typical problem
- Advertised TLS fails the handshake.
TLS — TLS
- What it is
- The protocol providing encrypted, authenticated transport.
- What it does
- Encrypts and authenticates a network connection.
- Why it matters
- Invalid certificates can prevent secure transport.
- Typical problem
- Expired certificate or hostname mismatch.
CAA — Certification Authority Authorization
- What it is
- A DNS authorization record for certificate issuers.
- What it does
- Limits which CAs may issue certificates.
- Why it matters
- It can reduce unintended certificate issuance.
- Typical problem
- An expected CA is absent.
DNSSEC — DNS Security Extensions
- What it is
- Cryptographic signatures for DNS records.
- What it does
- Signs DNS data for validation.
- Why it matters
- It helps detect DNS tampering.
- Typical problem
- A signed zone becomes BOGUS.
MTA-STS — MTA-STS
- What it is
- An HTTPS policy for SMTP TLS delivery.
- What it does
- Publishes a TLS delivery policy for supporting senders.
- Why it matters
- It makes authenticated SMTP TLS enforceable for supporters.
- Typical problem
- TXT exists but HTTPS policy fails.
TLS-RPT — TLS-RPT
- What it is
- A DNS record that names SMTP TLS report recipients.
- What it does
- Collects reports about SMTP TLS failures.
- Why it matters
- It helps reveal delivery failures.
- Typical problem
- No valid report destination.
DANE — DNS-based Authentication of Named Entities
- What it is
- DNSSEC-protected TLS authentication using TLSA.
- What it does
- Associates TLS service data with DNSSEC-protected TLSA records.
- Why it matters
- It can strengthen mail transport authentication.
- Typical problem
- TLSA does not match the service.
PTR — Pointer record
- What it is
- A reverse-DNS record from IP address to hostname.
- What it does
- Maps an IP address back to a hostname.
- Why it matters
- It supports mail-server identity checks.
- Typical problem
- No reverse DNS record.
FCrDNS — Forward-confirmed reverse DNS
- What it is
- A consistency check between PTR and forward DNS.
- What it does
- Checks forward and reverse DNS agree.
- Why it matters
- It provides stronger server-identity evidence.
- Typical problem
- Forward lookup does not return the original IP.
RBL — RBL
- What it is
- A reputation list for IP addresses.
- What it does
- Lists IP reputation in blocklists.
- Why it matters
- Listings may affect mail acceptance.
- Typical problem
- A provider’s listing is stale or disputed.
BIMI — Brand Indicators for Message Identification
- What it is
- A standard for displaying a verified brand logo in mail.
- What it does
- Associates a verified brand indicator with email.
- Why it matters
- It may improve brand display after authentication.
- Typical problem
- DMARC enforcement is not ready.