This glossary defines the core terms of email authentication, from the standards that DMARC builds on to the reporting and related protocols that surround it. Use it as a quick reference while reading DMARC records or aggregate reports.
Core standards
- DMARC: Domain-based Message Authentication, Reporting, and Conformance. Defined in RFC 7489, it ties SPF and DKIM to the visible From domain, sets a policy for failures, and enables reporting.
- SPF: Sender Policy Framework, defined in RFC 7208. A DNS TXT record listing the IPs and services authorized to send mail for a domain. Subject to a 10 DNS lookup limit.
- DKIM: DomainKeys Identified Mail. Adds a cryptographic signature to each message, verified against a public key published in DNS, proving the message was not altered and came from the signing domain.
- Alignment: The DMARC requirement that the domain that passed SPF or DKIM matches the domain in the From header. Alignment can be relaxed (organizational domain match) or strict (exact match).
- Policy (p): The DMARC instruction for handling failing mail: none (monitor), quarantine (send to spam), or reject (block).
- Organizational domain: The registrable base domain (for example example.com) used to determine relaxed alignment across its subdomains.
DMARC record tags
- v: Protocol version. Always v=DMARC1 and must appear first in the record.
- p: Domain policy: none, quarantine, or reject.
- sp: Subdomain policy. Overrides p for subdomains; if omitted, subdomains inherit p.
- rua: Address for aggregate reports, written as a mailto URI.
- ruf: Address for forensic failure reports.
- adkim: DKIM alignment mode, r for relaxed (default) or s for strict.
- aspf: SPF alignment mode, r for relaxed (default) or s for strict.
- pct: Percentage of failing mail the policy applies to, from 1 to 100.
- fo: Forensic reporting options controlling when RUF reports are generated (0, 1, d, or s).
- ri: Aggregate reporting interval in seconds; default 86400 (daily).
- rf: Reporting format for forensic reports, normally afrf.
Reporting
- RUA: Aggregate reports. Daily XML summaries grouping messages by sending source with SPF, DKIM, and DMARC results. The primary tool for reaching enforcement.
- RUF: Forensic reports. Per-message failure samples in AFRF format that can include headers; sent by few providers due to privacy concerns.
- AFRF: Authentication Failure Reporting Format, defined in RFC 6591, the structure used for DMARC forensic reports.
- Disposition: The action a receiver actually applied to a message: none, quarantine, or reject.
- External destination verification: A DNS record that authorizes reports to be sent to a domain other than the one being reported on.
- PII redaction: Removing personally identifiable information from forensic reports before storage or display, which EmailAuth performs on RUF data.
Related standards
- BIMI: Brand Indicators for Message Identification. Displays a domain's verified logo in supporting inboxes; requires an enforced DMARC policy of quarantine or reject.
- VMC: Verified Mark Certificate. A certificate proving trademark ownership of a logo, required by some mailbox providers for BIMI.
- MTA-STS: Mail Transfer Agent Strict Transport Security. Enforces encrypted TLS connections between mail servers to prevent downgrade attacks.
- TLS-RPT: TLS Reporting, defined in RFC 8460. Sends reports about TLS connection failures so you can detect delivery and encryption problems.
- ARC: Authenticated Received Chain. Preserves authentication results across intermediaries like mailing lists so DMARC survives forwarding.
- Return-Path: The bounce address, also called the envelope sender or MAIL FROM, whose domain SPF checks.
- From header: The visible sender address DMARC aligns against. The address recipients see.
- SmartSPF: EmailAuth's SPF flattening feature that resolves includes into direct IPs to stay under the 10 lookup limit.
- CNAME delegation: Pointing your DMARC, SPF, DKIM, or BIMI records to a provider by CNAME so records can be managed without editing DNS each time.
Quick record reference
v=DMARC1; p=reject; rua=mailto:rua@example.com; ruf=mailto:ruf@example.com; adkim=s; aspf=s; fo=1
To check which of these your domain has in place, run a free domain scan from EmailAuth. It reports your SPF, DKIM, DMARC, and BIMI status and points to the terms above that need attention.
Frequently asked questions
What is the difference between the From header and the Return-Path?
The From header is the visible sender address recipients see, and DMARC aligns against it. The Return-Path, also called the envelope sender or MAIL FROM, is the bounce address whose domain SPF checks. They can differ, which is why DMARC alignment is needed.
What is alignment in DMARC?
Alignment is the requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header. Relaxed alignment allows the organizational domains to match, while strict alignment requires an exact domain match. Alignment is what makes DMARC resistant to spoofing.
What is ARC and why does it matter?
ARC, Authenticated Received Chain, records authentication results as a message passes through intermediaries such as mailing lists and forwarders. Because forwarding often breaks SPF and DKIM, ARC lets a final receiver see that the message passed authentication earlier, helping legitimate forwarded mail survive DMARC.
Is MTA-STS part of DMARC?
No. MTA-STS is a separate standard that enforces encrypted TLS connections between mail servers, and TLS-RPT (RFC 8460) reports on TLS failures. They complement DMARC by securing mail in transit, but they authenticate the connection, not the sender identity that DMARC covers.
- ADKIM
- DMARC tag setting DKIM alignment: r (relaxed, default) allows subdomains, s (strict) requires an exact domain match.
- Alignment
- The DMARC requirement that the domain authenticated by SPF or DKIM matches the visible From domain.
- ARC
- Authenticated Received Chain: lets forwarders and mailing lists preserve original authentication results.
- ASPF
- DMARC tag setting SPF alignment: r (relaxed) or s (strict).
- BEC
- Business Email Compromise: fraud where attackers impersonate executives or suppliers by email.
- BIMI
- Brand Indicators for Message Identification: shows your logo in inboxes for mail that passes DMARC.
- CMC
- Common Mark Certificate: a BIMI certificate that does not require a registered trademark.
- DANE
- DNS-based Authentication of Named Entities: pins TLS certificates in DNSSEC-signed TLSA records.
- DKIM
- DomainKeys Identified Mail: a cryptographic signature proving a message came from a domain and was not altered (RFC 6376).
- DKIM selector
- The s= label telling receivers which DKIM public key to fetch, at selector._domainkey.domain.
- DMARC
- Domain-based Message Authentication, Reporting and Conformance: policy and reporting built on SPF and DKIM (RFC 7489).
- DMARC record
- A TXT record at _dmarc.domain that publishes the DMARC policy and report addresses.
- DNSSEC
- DNS Security Extensions: cryptographically signs DNS answers to prevent tampering.
- DNS lookup limit
- SPF may trigger at most 10 DNS-querying mechanisms; more causes PermError.
- Envelope sender
- The Return-Path or MAIL FROM address used in SMTP, checked by SPF.
- Forensic report
- See RUF: a per-message failure report.
- Header From
- The From address shown to recipients, the domain DMARC protects.
- Homoglyph
- A character that looks like another, such as Cyrillic a for Latin a, used in lookalike domains.
- Include
- SPF mechanism that authorizes another domain's SPF record, such as include:_spf.google.com.
- Lookalike domain
- A domain resembling yours, registered to impersonate your brand.
- MTA
- Mail Transfer Agent: a server that sends or relays email.
- MTA-STS
- Mail Transfer Agent Strict Transport Security: requires encrypted, validated TLS for inbound mail (RFC 8461).
- MX record
- DNS record naming the servers that receive email for a domain.
- Neutral (?all)
- SPF qualifier stating no assertion about unlisted senders.
- One-click unsubscribe
- List-Unsubscribe-Post header (RFC 8058) required by Gmail and Yahoo for bulk mail.
- p=none
- DMARC monitoring policy: reports are sent but no mail is blocked.
- p=quarantine
- DMARC policy asking receivers to treat failing mail as suspicious, usually the spam folder.
- p=reject
- DMARC policy asking receivers to block failing mail: full protection.
- pct
- DMARC tag applying the policy to a percentage of failing messages.
- PermError
- Permanent SPF error, for example too many lookups or two SPF records; SPF then fails.
- Phishing
- Deceptive messages that trick recipients into revealing credentials, paying money or installing malware.
- PTR record
- Reverse DNS record mapping an IP to a hostname; mail providers require it on sending IPs.
- Return-Path
- Header recording the envelope sender, where bounces go.
- RUA
- DMARC tag for aggregate report addresses; reports are daily XML summaries.
- RUF
- DMARC tag for forensic (failure) report addresses; reports describe individual failing messages.
- Softfail (~all)
- SPF qualifier marking unlisted senders as suspicious but not outright failed.
- SP
- DMARC tag setting the policy for subdomains.
- SPF
- Sender Policy Framework: a TXT record listing servers authorized to send for a domain (RFC 7208).
- SPF flattening
- Replacing SPF includes with IP ranges to stay within the 10-lookup limit.
- Spoofing
- Forging the sender address so mail appears to come from a trusted domain.
- STARTTLS
- SMTP command that upgrades a connection to TLS encryption; without MTA-STS it can be stripped.
- SVG Tiny PS
- The restricted SVG profile required for BIMI logos.
- TLS-RPT
- SMTP TLS Reporting: daily reports of TLS delivery failures to your domain (RFC 8460).
- TXT record
- A DNS record holding text; used for SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT.
- VMC
- Verified Mark Certificate: a trademark-backed certificate that lets Gmail and Apple display your BIMI logo.
[ DMARC guide ]
[ Get a free DMARC assessment ]
Free DMARC assessment
We check your domain and send a short report with the steps to full enforcement.