DMARC Dictionary and Glossary

[ Quick answer ]

Email authentication rests on three DNS records: SPF lists who may send for a domain, DKIM signs each message, and DMARC checks that one of them passed for the visible From domain and tells receivers to deliver, quarantine or reject mail that fails.

Key facts

›DMARC needs SPF or DKIM to pass with alignment to the From domain.
›p=reject is full protection; p=none only monitors.
›SPF allows at most 10 DNS lookups.
›BIMI shows your logo only once DMARC is enforced.

Reviewed by the EmailAuth research team

This glossary defines the core terms of email authentication, from the standards that DMARC builds on to the reporting and related protocols that surround it. Use it as a quick reference while reading DMARC records or aggregate reports.

125 terms

A record: DNS record pointing a hostname to an IPv4 address (AAAA for IPv6).; MX record A record lookup
Account takeover: An attacker gains control of a real mailbox, so its mail passes SPF, DKIM and DMARC.; BEC
ADKIM: DMARC tag setting DKIM alignment: r (relaxed, default) allows subdomains, s (strict) requires an exact domain match.; adkim=s; Alignment ASPF
Alignment: The DMARC requirement that the domain authenticated by SPF or DKIM matches the visible From domain.; Passing SPF or DKIM is not enough for DMARC. The domain that passed must also be the same as, or (in relaxed mode) share an organisational domain with, the From address the reader sees.; ADKIM ASPF Header From Organizational domain What is DMARC? Email header analyzer
ARC: Authenticated Received Chain: lets forwarders and mailing lists preserve original authentication results.; Each intermediary adds a signed record of what authentication looked like when it received the message, so the final receiver can trust results that forwarding broke.; ARC seal Forwarding
ARC seal: The ARC-Seal header each intermediary adds to sign the chain of ARC results.; ARC
ASPF: DMARC tag setting SPF alignment: r (relaxed) or s (strict).; aspf=r; Alignment ADKIM
Authentication-Results: Header a receiver adds recording SPF, DKIM and DMARC outcomes for a message.; SPF DKIM DMARC Email header analyzer

Backscatter: Bounce messages sent to you for spam you never sent, because your address was forged.; Spoofing
BEC: Business Email Compromise: fraud where attackers impersonate executives or suppliers by email.; Typical BEC asks finance to change bank details or pay an urgent invoice. Losses run into billions each year; DMARC removes the easiest route, exact-domain spoofing.; Whaling Vendor email compromise Spoofing
BIMI: Brand Indicators for Message Identification: shows your logo in inboxes for mail that passes DMARC.; BIMI needs DMARC at quarantine or reject, a logo in SVG Tiny PS format and, for Gmail and Apple, a VMC or CMC certificate.; default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"; VMC CMC SVG Tiny PS What is BIMI? BIMI checker
BIMI record: A TXT record at default._bimi.yourdomain pointing to your logo (l=) and certificate (a=).; BIMI VMC Create a BIMI record
Blocklist: A public list of IPs or domains seen sending spam; receivers use them to reject mail.; Sender reputation Blacklist & DNSSEC checker
Blue checkmark: Gmail's verified-sender tick shown for brands with BIMI and a VMC.; VMC
BOD 18-01: US federal directive requiring agencies to run DMARC at p=reject.; p=reject
Body hash: The bh= value in a DKIM signature: a hash of the message body that must match on arrival.; DKIM signature
Bulk sender: Gmail and Yahoo's term for a domain sending about 5,000 or more messages a day to their users.; Google and Yahoo sender requirements

CAA record: DNS record listing which certificate authorities may issue certificates for a domain.; CAA checker
Canonicalization: How a message is normalised before DKIM signing: simple or relaxed for headers and body.; DKIM signature
CIDR: Classless notation for an IP range, such as 203.0.113.0/24 for 256 addresses.; ip4 and ip6 SPF CIDR calculator
CMC: Common Mark Certificate: a BIMI certificate that does not require a registered trademark.; VMC BIMI
CNAME record: DNS alias pointing one hostname to another, often used to delegate DKIM keys to a provider.; DKIM selector CNAME lookup

d= tag: The signing domain in a DKIM signature; it must align with the From domain for DMARC.; Alignment DKIM signature
DANE: DNS-based Authentication of Named Entities: pins TLS certificates in DNSSEC-signed TLSA records.; TLSA record DNSSEC DANE/TLSA checker
Dangling DNS: A record pointing at a deleted cloud resource that someone else can claim.; Subdomain takeover
Data residency: Keeping data stored and processed in a chosen country or region.; Security & Trust
Deliverability: How reliably your mail reaches the inbox rather than spam or rejection.; Sender reputation
Display-name spoofing: Faking only the sender name, such as "CEO Name" <random@gmail.com>; DMARC cannot stop it.; Spoofing BEC
DKIM: DomainKeys Identified Mail: a cryptographic signature proving a message came from a domain and was not altered (RFC 6376).; The sending server signs headers and body with a private key; receivers fetch the public key from DNS and verify it. Unlike SPF, DKIM usually survives forwarding.; DKIM selector DKIM signature Alignment What is DKIM? DKIM lookup
DKIM key length: Size of the RSA key; 2048-bit is the current recommendation, 1024-bit is considered weak.; DKIM key rotation Ed25519
DKIM key rotation: Regularly replacing DKIM keys by publishing a new selector and retiring the old one.; DKIM selector DKIM key length DKIM setup guide DKIM generator
DKIM selector: The s= label telling receivers which DKIM public key to fetch, at selector._domainkey.domain.; s1._domainkey.example.com; DKIM DKIM key rotation DKIM lookup
DKIM signature: The DKIM-Signature header carrying the signing domain (d=), selector (s=) and the signature itself.; DKIM-Signature: v=1; a=rsa-sha256; d=example.com; s=s1; ...; DKIM d= tag DKIM signature explained Email header analyzer
DMARC: Domain-based Message Authentication, Reporting and Conformance: policy and reporting built on SPF and DKIM, now defined by RFC 9989 (with RFC 9990 and 9991 for reports), which replaced RFC 7489 in May 2026.; DMARC tells receiving mail servers what to do when a message claiming to be from your domain fails SPF and DKIM alignment: deliver it, send it to spam, or reject it. It also asks them to send you reports, so you can see every service sending as your domain.; v=DMARC1; p=reject; rua=mailto:dmarc@example.com; DMARC record Alignment p=reject DMARCbis What is DMARC? DMARC checker
DMARC enforcement: Running DMARC at p=quarantine or p=reject so failing mail is actually stopped.; p=reject p=quarantine DMARC setup guides
DMARC record: A TXT record at _dmarc.yourdomain that publishes the DMARC policy and report addresses.; The record is a list of tag=value pairs. Only v and p are required; the rest control subdomains, reporting and alignment.; _dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:reports@example.com"; DMARC TXT record RUA What is a DMARC record? DMARC generator
DMARCbis: The former working name of RFC 9989, the current DMARC standard (May 2026) that replaced RFC 7489. It adds the np and t tags and a DNS tree walk instead of the public suffix list.; DMARCbis tidies up the original specification: pct is removed, t= replaces partial rollouts, np= covers non-existent subdomains, and the organisational domain is found by walking up the DNS tree. Published in May 2026 as RFC 9989, 9990 and 9991, it is now simply DMARC. Records that are valid today keep working.; DMARC RFC 9989 np t tag psd DNS tree walk What is DMARC?
DNS lookup limit: SPF may trigger at most 10 DNS-querying mechanisms; more causes PermError.; include, a, mx, ptr, exists and redirect each count towards the limit, including nested lookups inside other providers' records. Adding a few SaaS tools is enough to break it.; PermError SPF flattening The SPF lookup problem SPF checker
DNS propagation: The delay before a DNS change is seen everywhere, as cached answers expire.; TTL DNS propagation
DNS tree walk: DMARCbis method of finding the organizational domain by querying up the DNS hierarchy.; DMARCbis Public Suffix List
DNSSEC: DNS Security Extensions: cryptographically signs DNS answers to prevent tampering.; DANE Blacklist & DNSSEC checker
Domain age: How long a domain has been registered; very new domains are treated with suspicion.; Domain age checker
DORA: EU Digital Operational Resilience Act for financial firms, covering ICT risk including email.; NIS2
Downgrade attack: An attacker removes STARTTLS so mail is sent unencrypted; MTA-STS and DANE prevent it.; STARTTLS MTA-STS

Ed25519: A modern, short-key signing algorithm for DKIM (RFC 8463), usually published alongside RSA.; DKIM key length
Email header: The routing and authentication lines at the top of a message, readable via "show original".; Email header analyzer
Envelope sender: The Return-Path or MAIL FROM address used in SMTP, checked by SPF.; Return-Path Header From
ESP: Email Service Provider: a platform that sends mail for you, such as a marketing or transactional service.; Include DKIM selector
External destination verification: A DNS record that lets one domain agree to receive DMARC reports for another.; example.com._report._dmarc.reports.vendor.com TXT "v=DMARC1"; RUA

FCrDNS: Forward-confirmed reverse DNS: the PTR hostname resolves back to the same IP.; PTR record Reverse DNS checker
Feedback loop: A service where a mailbox provider tells you when recipients report your mail as spam.; Spam complaint rate
fo: DMARC tag choosing when failure (forensic) reports are generated, such as fo=1 for any failure.; fo=1; RUF
Forwarding: Re-sending a message to a new address; it usually breaks SPF and sometimes DKIM.; ARC SRS

Google and Yahoo sender requirements: Since 2024, bulk senders to Gmail and Yahoo need SPF, DKIM, DMARC, alignment, one-click unsubscribe and low spam rates.; Bulk sender One-click unsubscribe Spam complaint rate Google & Yahoo sender rules Google & Yahoo sender check
Google Postmaster Tools: Google's free dashboard showing your domain's spam rate, reputation and authentication at Gmail.; Spam complaint rate

Hard bounce: A permanent delivery failure, such as an address that does not exist.; Soft bounce
Hardfail (-all): SPF qualifier stating that any sender not listed is not allowed.; Softfail (~all)Neutral (?all)
Header From: The From address shown to recipients, the domain DMARC protects.; Alignment Envelope sender
HELO identity: The hostname a server announces when it connects; SPF can also check it.; SPF
Homoglyph: A character that looks like another, such as Cyrillic a for Latin a, used in lookalike domains.; Lookalike domain

Include: SPF mechanism that authorizes another domain's SPF record, such as include:_spf.google.com.; SPF record DNS lookup limit
IP warm-up: Gradually increasing volume from a new sending IP so providers build trust.; Sender reputation
ip4 and ip6: SPF mechanisms that authorize an IP address or CIDR range directly without a DNS lookup.; ip4:203.0.113.0/24 ip6:2001:db8::/32; CIDR SPF flattening
ISO 27001: International standard for an information security management system.; Security & Trust

l= tag: Optional DKIM body-length limit; risky because attackers can append content after the signed part.; DKIM signature
Lookalike domain: A domain resembling yours, registered to impersonate your brand.; Homoglyph Lookalike domain finder

MTA: Mail Transfer Agent: a server that sends or relays email.; SMTP
MTA-STS: Mail Transfer Agent Strict Transport Security: requires encrypted, validated TLS for inbound mail (RFC 8461).; You publish a policy file over HTTPS and a TXT record. Sending servers then refuse to deliver to you over an unencrypted or spoofed connection.; _mta-sts.example.com TXT "v=STSv1; id=20260101"; TLS-RPT STARTTLS DANE MTA-STS checker
MX record: DNS record naming the servers that receive email for a domain.; MTA MX lookup

Neutral (?all): SPF qualifier stating no assertion about unlisted senders.; Softfail (~all)
NIS2: EU cybersecurity directive requiring essential and important entities to manage risks, including email threats.; DORA
np: DMARCbis tag setting the policy for subdomains that do not exist in DNS.; Attackers like to send from made-up subdomains such as billing.example.com. np=reject blocks them even while the rest of your policy is still being rolled out.; np=reject; DMARCbis SP
NS record: DNS record naming the authoritative nameservers for a domain.; Nameserver checker

One-click unsubscribe: List-Unsubscribe-Post header (RFC 8058) required by Gmail and Yahoo for bulk mail.; Google and Yahoo sender requirements
Organizational domain: The registered domain a subdomain belongs to, such as example.com for mail.example.com.; Alignment DNS tree walk Public Suffix List

p=none: DMARC monitoring policy: reports are sent but no mail is blocked.; Start here. You collect reports, find every legitimate sender and fix their authentication before moving to quarantine and reject. Staying at p=none forever gives no protection.; p=quarantine p=reject RUA DMARC setup guides
p=quarantine: DMARC policy asking receivers to treat failing mail as suspicious, usually the spam folder.; p=none p=reject
p=reject: DMARC policy asking receivers to block failing mail: full protection.; At p=reject, messages that fail DMARC are refused before they reach the inbox, so attackers cannot send as your exact domain. It is the goal of every DMARC project.; p=none p=quarantine DMARC What is DMARC? DMARC checker
Parked domain: A domain you own but do not send mail from; it still needs SPF -all and DMARC p=reject.; p=reject np
PCI DSS 4.0: Payment card security standard whose version 4.0 expects anti-phishing controls such as DMARC.; DMARC
pct: DMARC tag applying the policy to a percentage of failing messages (removed in DMARCbis).; pct=25; t tag DMARCbis
PermError: Permanent SPF error, for example too many lookups or two SPF records; SPF then fails.; DNS lookup limit TempError SPF checker
Phishing: Deceptive messages that trick recipients into revealing credentials, paying money or installing malware.; Spear phishing Spoofing
psd: DMARCbis tag marking a domain as a public suffix operator, such as a government or registry domain.; psd=y; DMARCbis Organizational domain
PTR record: Reverse DNS record mapping an IP to a hostname; mail providers require it on sending IPs.; FCrDNS Reverse DNS checker
Public Suffix List: A list of domain endings like .co.uk under which people register names; original DMARC used it to find the organizational domain.; Organizational domain DNS tree walk

Redirect modifier: SPF redirect= replaces the whole record with another domain's, often used to share one policy across domains.; v=spf1 redirect=_spf.example.com; Include
Return-Path: Header recording the envelope sender, where bounces go.; Envelope sender Email header analyzer
RFC 7489: The original 2015 DMARC specification, now retired: obsoleted by RFC 9989 in May 2026.; RFC 7489 was an Informational document, never an IETF standard. Guidance written against it still mostly applies, but its pct, rf and ri tags no longer exist under RFC 9989.; RFC 9989 DMARCbis
RFC 9989: The current DMARC standard, published by the IETF in May 2026 on the Standards Track; it obsoletes RFC 7489 and RFC 9091.; RFC 9989 defines DMARC policy, alignment and policy discovery. In its own words: "This document obsoletes RFCs 7489 and 9091." Reporting moved to RFC 9990 (aggregate) and RFC 9991 (failure). v=DMARC1 is unchanged, so existing records keep working; pct, rf and ri are removed and np, psd and t are added.; DMARC DMARCbis RFC 9990 RFC 9991 RFC 7489 What is DMARC?
RFC 9990: The current DMARC aggregate reporting standard (May 2026), defining the XML rua reports.; RFC 9990 split aggregate reporting out of the old RFC 7489 into its own Standards Track document.; RFC 9989 RUA
RFC 9991: The current DMARC failure reporting standard (May 2026), defining ruf reports.; RFC 9991 covers per-message failure (forensic) reports, previously part of RFC 7489.; RFC 9989 RUF
ri: DMARC tag requesting the aggregate report interval in seconds; most receivers send daily regardless.; ri=86400; RUA
RUA: DMARC tag for aggregate report addresses; reports are daily XML summaries.; Aggregate reports list every IP that sent mail as your domain, how many messages and whether they passed SPF, DKIM and DMARC. They contain no message content.; RUF DMARC record Reading aggregate reports DMARC report analyzer
RUF: DMARC tag for forensic (failure) report addresses; reports describe individual failing messages.; Forensic reports can include headers and sometimes content of failing messages. Many large providers do not send them for privacy reasons.; RUA fo Forensic reports explained

Sender reputation: The trust score mailbox providers give your domain and IPs, based on authentication, complaints and engagement.; Spam complaint rate Blocklist
Shadow IT sender: A service sending as your domain that IT does not know about; DMARC reports reveal them.; RUA
SMTP: Simple Mail Transfer Protocol: the protocol servers use to send and relay email.; MTA
SOA record: Start of Authority: DNS record holding a zone's primary server, serial and refresh timers.; SOA checker
SOC 2: An audit report on a service provider's security, availability and confidentiality controls.; Security & Trust
Soft bounce: A temporary delivery failure, such as a full mailbox or greylisting.; Hard bounce
Softfail (~all): SPF qualifier marking unlisted senders as suspicious but not outright failed.; With DMARC in place, ~all is usually enough: DMARC makes the final decision, and softfail avoids some forwarding problems.; Hardfail (-all)Neutral (?all)
SP: DMARC tag setting the policy for subdomains.; sp=reject; np DMARC record
Spam complaint rate: Share of recipients marking mail as spam; Gmail wants it under 0.1% and never above 0.3%.; Google and Yahoo sender requirements Feedback loop
Spear phishing: Phishing aimed at a specific person using researched, personal details.; Phishing Whaling
SPF: Sender Policy Framework: a TXT record listing servers authorized to send for a domain (RFC 7208).; SPF lets a receiver check whether the server handing over a message is allowed to send for the envelope sender domain. It checks the Return-Path, not the visible From address, so DMARC alignment is needed too.; v=spf1 include:_spf.google.com -all; SPF record Envelope sender DNS lookup limit What is SPF? SPF checker
SPF flattening: Replacing SPF includes with IP ranges to stay within the 10-lookup limit.; Flattening fixes the lookup limit but goes stale when providers change their IPs. Managed or dynamic flattening refreshes the ranges automatically.; DNS lookup limit ip4 and ip6 The SPF lookup problem SPF flattener
SPF macros: Placeholders like %{i} that expand per message, used for advanced or per-sender SPF policies.; SPF record
SPF record: The TXT record starting v=spf1 that lists your allowed senders and ends with an all qualifier.; SPF Include Hardfail (-all)SPF record explained SPF generator
Spoofing: Forging the sender address so mail appears to come from a trusted domain.; Exact-domain spoofing is what DMARC at p=reject stops. Lookalike domains and display-name tricks need other controls.; Display-name spoofing Lookalike domain p=reject
SRS: Sender Rewriting Scheme: forwarders rewrite the envelope sender so SPF still passes.; Forwarding Envelope sender
STARTTLS: SMTP command that upgrades a connection to TLS encryption; without MTA-STS it can be stripped.; MTA-STS Downgrade attack
Subdomain takeover: An attacker claims a resource a dangling record points to and serves content or mail from your subdomain.; Dangling DNS
SVG Tiny PS: The restricted SVG profile required for BIMI logos.; BIMI Create a BIMI SVG logo BIMI SVG converter

t tag: DMARCbis testing flag: t=y asks receivers to apply one level less strict policy while you test.; p=reject; t=y; DMARCbis pct
TempError: Temporary SPF or DKIM error, usually a DNS timeout; receivers may retry or treat it as a failure.; PermError
TLS-RPT: SMTP TLS Reporting: daily reports of TLS delivery failures to your domain (RFC 8460).; _smtp._tls.example.com TXT "v=TLSRPTv1; rua=mailto:tls@example.com"; MTA-STS MTA-STS checker
TLSA record: DNS record publishing a TLS certificate fingerprint for DANE.; DANE DANE/TLSA checker
Transactional email: Automated one-to-one messages like receipts and password resets.; Bulk sender
TTL: Time to live: how long resolvers cache a DNS answer before asking again.; DNS propagation
TXT record: A DNS record holding text; used for SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT.; DMARC record SPF record

Vendor email compromise: BEC carried out from a supplier's real, hijacked mailbox.; BEC
VMC: Verified Mark Certificate: a trademark-backed certificate that lets Gmail and Apple display your BIMI logo.; CMC BIMI
Void lookup: An SPF DNS query that returns no records; more than two void lookups cause PermError.; DNS lookup limit PermError

Whaling: Spear phishing aimed at senior executives.; Spear phishing BEC

Frequently asked questions

What is the difference between the From header and the Return-Path?

The From header is the visible sender address recipients see, and DMARC aligns against it. The Return-Path, also called the envelope sender or MAIL FROM, is the bounce address whose domain SPF checks. They can differ, which is why DMARC alignment is needed.

What is alignment in DMARC?

Alignment is the requirement that the domain authenticated by SPF or DKIM matches the domain in the visible From header. Relaxed alignment allows the organizational domains to match, while strict alignment requires an exact domain match. Alignment is what makes DMARC resistant to spoofing.

What is ARC and why does it matter?

ARC, Authenticated Received Chain, records authentication results as a message passes through intermediaries such as mailing lists and forwarders. Because forwarding often breaks SPF and DKIM, ARC lets a final receiver see that the message passed authentication earlier, helping legitimate forwarded mail survive DMARC.

Is MTA-STS part of DMARC?

No. MTA-STS is a separate standard that enforces encrypted TLS connections between mail servers, and TLS-RPT (RFC 8460) reports on TLS failures. They complement DMARC by securing mail in transit, but they authenticate the connection, not the sender identity that DMARC covers.

What is the difference between SPF, DKIM and DMARC?

SPF authorizes sending servers, DKIM proves a message was signed by a domain and not altered, and DMARC ties both to the visible From address and sets the policy for failures.

What does DMARCbis change?

DMARCbis, published in May 2026 as RFC 9989, 9990 and 9991, replaces the retired RFC 7489. It removes pct, adds the t testing flag and the np policy for non-existent subdomains, and finds the organizational domain by walking the DNS tree. Existing valid records keep working.

[ DMARC guide ]

What Is DMARC? How It Works & the 3 Policies What is a DMARC record?DMARC Benefits RUA and DMARC Aggregate Reports RUF and DMARC Forensic Reports DMARC Setup Guides DMARC CheckerFree tool DMARC GeneratorFree tool DMARC Report AnalyzerFree tool

Part of the Knowledge BaseDiagnostics and working resources · 27 guides

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

DMARC dictionary