Email and domain security rests on a short list of terms: SPF, DKIM and DMARC for mail authentication, a handful of DNS records, and a few registration controls. This glossary defines each in a sentence or two and links to a fuller guide, so engineers and managers use the same words.
Mail authentication
| Term | Meaning |
|---|---|
| SPF | A DNS record listing which servers may send mail for a domain. Defined in RFC 7208, which limits evaluation to 10 lookup causing terms |
| DKIM | A cryptographic signature added to a message. The receiver checks it against a public key published in DNS under a selector. Defined in RFC 6376 |
| DMARC | A policy record that tells receivers what to do when mail fails SPF and DKIM alignment, and asks for reports. Now specified in RFC 9989 |
| Alignment | The match between the visible From domain and the domain that passed SPF or DKIM |
| Selector | A label that picks which DKIM key a signature uses, allowing several keys and rotation |
| Aggregate report | A summary, sent to the address in your DMARC record, of mail seen using your domain |
| Policy values | none asks receivers to take no action, quarantine to treat failures as suspicious and reject to refuse them |
| Null MX | An MX record that says a domain accepts no mail, defined in RFC 7505 |
Guides: what each of SPF, DKIM and DMARC proves, alignment, selectors and rotation, rollout plan.
DNS and certificates
| Term | Meaning |
|---|---|
| CNAME | A record making one name an alias for another |
| Dangling DNS | A record that points at a resource that no longer exists or belongs to you. A takeover risk |
| Subdomain takeover | Someone else gaining control of a subdomain through a dangling record. See MDN's description |
| Wildcard record | A record with an asterisk label that answers for names that do not exist in the zone, per RFC 4592 |
| Zone transfer (AXFR) | A full copy of a zone sent between servers, defined in RFC 5936 |
| TTL | How long resolvers may cache an answer |
| CAA | A record naming which certificate authorities may issue for a domain |
| Certificate Transparency | Public logs of issued certificates, described in RFC 9162 |
| MTA-STS and TLS-RPT | Mechanisms to ask senders to use encrypted delivery to your mail servers, and to report failures. MTA-STS is defined in RFC 8461 |
Guides: dangling DNS, audit steps, CAA, MTA-STS and TLS-RPT, wildcards.
Registration and ownership
| Term | Meaning |
|---|---|
| Registrar | The company you register a domain through |
| Registry | The organisation that runs a top level domain |
| Registrar lock | Status codes such as clientTransferProhibited that your registrar sets to block transfers, deletion or updates |
| Registry lock | The equivalent server side statuses, offered by some registries on request, slower to remove |
| Auth code | The authorization information that approves a transfer, see RFC 9154 for secure handling |
| Redemption period | A 30 day stage after deletion in which a domain can still be restored, according to ICANN |
| RDAP | The successor protocol to WHOIS for looking up registration data, described in RFC 7480 |
Guides: registry locks, auth codes, expiry, registrar checklist.
How the terms fit together
Think in layers. The registration layer decides who owns the name. The DNS layer decides where it points. The mail layer decides who may speak for it. A weakness in a lower layer undermines the ones above: an attacker with the registrar account can rewrite DNS, and with DNS can pass mail checks.
A sensible reading order for a new team: registrar checklist, then DNS hygiene, then SPF, DKIM and DMARC, then monitoring.
Safeguard covers the software layer: SBOM and dependency scanning, reachability analysis, policies and gates, and asset discovery. Try the free scan at gold.safeguard.sh/scan.
Quick check
What is the difference between SPF and DKIM?
SPF checks the sending server against a list in DNS. DKIM checks a signature on the message itself. DMARC needs at least one of them to pass and align.
What is the difference between a registrar and a registry?
You deal with the registrar. The registry runs the whole top level domain database behind it.
Sources
- RFC 7208, SPF
- RFC 6376, DKIM
- RFC 9989, DMARC
- RFC 7505, Null MX
- RFC 4592, Wildcards in the DNS
- RFC 5936, AXFR
- RFC 9162, Certificate Transparency
- RFC 8461, MTA-STS
- RFC 9154, Secure authorization information for EPP
- RFC 7480, RDAP over HTTP
- ICANN, EPP status codes
- MDN, Subdomain takeover
Last reviewed: 19 October 2026.
