Glossary

The vocabulary of email security

One term, one page, one definition that stands up on its own. Every entry points at the standard that defines it and the guides that put it to work.

Authentication

DMARC: DMARC is a DNS record published at _dmarc.your-domain.com that tells receiving mail servers what to do with messages claiming to come from your domain that pass neither SPF nor DKIM, and that has those servers send you a daily report of what they received in your name.
SPF: SPF is a DNS TXT record listing the servers permitted to send email for a domain name, which the receiving server compares against the IP address the connection is arriving from.
DKIM: DKIM is a cryptographic signature added to the headers of every outgoing message, which the receiving server verifies using a public key published in the signing domain's DNS under a name called a selector.

DMARC policy: The DMARC policy is the p= tag of a DMARC record; it takes three values. none observes without acting, quarantine files the message as junk, reject has it refused during the SMTP conversation. Only reject actually stops a spoofed message from arriving.
DMARC aggregate report: A DMARC aggregate report is a compressed XML file that a mailbox provider sends once a day to the address given in the rua tag, summarising how many messages it received in your domain's name, from which IP addresses, and which of them passed SPF and DKIM.

SPF ten-lookup limit: The SPF ten-lookup limit is the RFC 7208 rule forbidding the evaluation of an SPF record from triggering more than ten DNS queries; beyond that, evaluation stops with a permerror and the record stops protecting the domain.

DMARC alignment: DMARC alignment is the rule requiring that the domain which passed SPF or DKIM be the same domain your recipient is shown in the From field; without it, a fraudster would pass both checks on their own domain while displaying yours.
Envelope-From: The Envelope-From is the address announced by the SMTP MAIL FROM command at the start of the conversation between servers; it is where bounces are routed, it is what SPF checks, and the recipient never sees it in their mail client.
Header-From: The Header-From is the From field of the message header, meaning the only sender your recipient actually sees displayed in their mail client, and it is the identity DMARC protects.

Business email compromise: Business email compromise is the fraud of getting a company to transfer money to an account the fraudster controls, by impersonating over email a director, a supplier or a customer whose bank details have supposedly changed.
Cousin domain: A cousin domain is a domain name registered by a fraudster because it resembles a real company's, one letter changed, a hyphen added, a different extension, and from which they send perfectly authenticated messages.
Homoglyph: A homoglyph is a character from another alphabet drawn identically to a Latin letter, used to register a domain name visually indistinguishable from a real company's.