Reference
Key Terms
Plain-English definitions for the terms you'll see in your results.
- SPF (Sender Policy Framework)
- a DNS record listing which mail servers are allowed to send email for your domain. Receiving servers check this list before trusting a message.
- DKIM (DomainKeys Identified Mail)
- a digital signature attached to outgoing email, proving the message wasn't altered after it was sent and genuinely came from your servers.
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- a policy record that tells receiving servers what to do when SPF or DKIM checks fail, and where to send reports about it.
- TXT record
- a type of DNS record that holds plain text. SPF and DMARC are both published as TXT records. DKIM is published as a TXT record at a special address tied to a selector (see below).
- Selector
- a name that points to where a domain's DKIM key is published in DNS (for example, google._domainkey.yourdomain.com). There's no way to look up a domain's selector directly, it has to be known or guessed, which is why DKIM detection is never 100% certain.
- Permerror ('permanent error')
- what happens when SPF is misconfigured in a way that can't be resolved, like having more than one SPF record, or a record requiring too many DNS lookups. When this happens, SPF fails entirely for that domain, even if the individual records look correct on their own.
- DNS lookup limit
- SPF allows a maximum of 10 DNS lookups when a record and everything it includes are added up. Go over that limit, and SPF returns a permerror, silently breaking authentication.
- Policy (p=)
-
the DMARC setting that tells receiving servers how to handle mail that fails authentication.
- p=none: take no action, just send reports (monitoring only).
- p=quarantine: send failing mail to spam.
- p=reject: block failing mail outright.
- rua
- the email address in a DMARC record that receives aggregate reports, a regular summary of who's sending mail as your domain and whether it's passing or failing checks.
- ruf
- similar to rua, but for forensic reports, more detailed reports about individual failing messages. Less commonly used than rua.