Glossary of DNS and email terms

A record

Maps a host name to an IPv4 address. Its IPv6 counterpart is the AAAA record. See MX records for why mail hosts need them.

AAAA record

Maps a host name to an IPv6 address. A server that has IPv6 connectivity and sends mail needs a matching PTR for its IPv6 address too; see reverse DNS.

Abuse contact

The email address a network operator registers for reports of spam, attacks or other abuse coming from its addresses. Find it with IP Whois; see reporting abuse.

Alignment

DMARC's requirement that the domain that passed SPF or DKIM matches the domain in the visible From: header. Relaxed alignment accepts the same organisational domain; strict requires an exact match. See DMARC alignment.

ARC (Authenticated Received Chain)

Headers added by forwarders and mailing lists that record the authentication results they saw, so later receivers can trust mail whose SPF or DKIM broke in transit. Defined in RFC 8617.

ASN (Autonomous System Number)

The number identifying a network that announces IP routes on the internet. Two addresses with the same ASN are run by the same operator.

BIMI

Brand Indicators for Message Identification: a TXT record pointing to a logo that some inboxes display beside DMARC-authenticated mail. It requires DMARC enforcement, and for Gmail a VMC or CMC certificate. See BIMI setup.

Blocklist (DNSBL)

A list of IP addresses or domains associated with spam or abuse, published through DNS so mail servers can query it in real time. See getting off a blocklist.

CIDR

Notation for an IP range: an address plus a prefix length, e.g. 198.51.100.0/24 (256 addresses). The SPF validator can test a whole CIDR range.

CMC (Common Mark Certificate)

A certificate for BIMI logos that requires 12 months of prior public use of the logo instead of a registered trademark. Gmail displays CMC-backed logos, without the verified checkmark.

CNAME record

Makes one name an alias of another. A name with a CNAME can't hold any other records, which is why a CNAME can't sit at a zone apex. See CNAME rules.

DKIM

DomainKeys Identified Mail: the sending server signs each message with a private key, and receivers verify it with a public key published in DNS. See DKIM selectors.

DKIM selector

The label in a DKIM signature (s=) that tells receivers which key to fetch, at <selector>._domainkey.<domain>. Selectors can't be listed from DNS.

DMARC

A policy record at _dmarc.<domain> telling receivers what to do with mail that fails aligned SPF and DKIM: none, quarantine or reject. It also requests reports. Defined in RFC 9989. See the DMARC rollout.

DNSSEC

Cryptographic signatures on DNS records that let resolvers detect forged answers. It must be handled carefully when changing DNS providers; see changing nameservers.

DS record

A record in the parent zone that links it to a child zone's DNSSEC key. Removing or replacing it is the first step in moving a signed zone.

Envelope sender (Return-Path)

The address given in the SMTP MAIL FROM command, where bounces are sent. SPF checks this domain, not the visible From: address.

FCrDNS (forward-confirmed reverse DNS)

A sending IP's PTR hostname resolves back to the same IP. Gmail and many other receivers require it. See reverse DNS.

ICMP

The Internet Control Message Protocol, which carries ping (echo request and reply) and error messages that the network depends on, such as "packet too big". See the ping guide.

Include (SPF)

An SPF mechanism that evaluates another domain's SPF record and matches if it returns pass. Each include counts towards the 10-lookup limit, as does everything inside it.

MX record

Names a host that accepts mail for a domain, with a preference number; lower numbers are tried first. See MX records.

Nameserver (authoritative)

A DNS server that holds a zone's records and answers for them directly, as opposed to a resolver that caches answers. Find a domain's nameservers with the Nameserver Lookup.

Negative caching

Resolvers also cache "this name doesn't exist" answers, for a time set by the zone's SOA record. This is why a newly created record can stay invisible for a while. See DNS propagation.

Null MX

A single MX record of 0 . declaring that a domain accepts no mail (RFC 7505). Senders bounce immediately instead of retrying.

Organisational domain

The registrable part of a domain name (example.co.uk for mail.example.co.uk), used by DMARC for relaxed alignment and policy inheritance.

PBL (Policy Block List)

Spamhaus's list of address ranges, usually residential and mobile, that shouldn't send mail directly. A listing isn't an accusation of spam. See Spamhaus PBL.

PermError

A permanent SPF evaluation error caused by a broken record: a syntax error, two SPF records, or too many DNS lookups. DMARC then treats SPF as failed. See too many lookups.

Propagation

The informal name for the time it takes resolvers' cached copies of old DNS answers to expire after a change. Nothing actually spreads; caches expire.

PTR record

A reverse DNS record mapping an IP address to a host name, set by whoever controls the IP block. See reverse DNS.

RDAP

The Registration Data Access Protocol: the structured, JSON-over-HTTPS successor to WHOIS, used by IP registries and domain registries. See reading IP Whois.

Resolver (recursive)

The DNS server your device asks, which looks answers up on your behalf and caches them, e.g. your ISP's resolver or 1.1.1.1.

RIR (Regional Internet Registry)

One of five organisations that allocate IP addresses by region: ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC.

SOA record

The start-of-authority record at a zone's apex, holding its primary nameserver, contact, serial number and timers, including the negative-caching TTL.

Softfail

The SPF result from ~all: the sender is probably not authorised. Under DMARC enforcement, unaligned softfail mail fails DMARC unless DKIM passes in alignment.

SPF

Sender Policy Framework: a TXT record listing the servers allowed to send using a domain in the envelope sender. See SPF explained.

TTL (time to live)

How long, in seconds, a resolver may cache a DNS answer. It sets the worst-case delay for a change to be seen. See DNS propagation.

TXT record

A DNS record holding free text, used for SPF, DMARC, DKIM keys, BIMI and domain-ownership verification. Long values are split into 255-character strings within one record.

VMC (Verified Mark Certificate)

A certificate proving a BIMI logo is a registered trademark of the domain owner. It's required for Gmail's verified checkmark and for Apple Mail. See BIMI setup.

Void lookup

An SPF DNS query that returns no records or NXDOMAIN. More than two in one evaluation cause a PermError.

Zone apex

The top of a DNS zone, e.g. example.com itself rather than www.example.com. It always carries SOA and NS records, so it can't be a CNAME.