Email authentication, in plain language.
Short, precise definitions of the terms you meet while setting up and monitoring DMARC.
How these fit together
SPF and DKIM
each authenticate a message on their own terms — one checks the
sending server, the other checks a cryptographic signature.
DMARC sits above both: it requires one
of them to pass and align with the visible
From: address, tells receivers what to do otherwise via
the policy, and reports back on
every source claiming your domain through
aggregate reports.
BIMI and
MTA-STS build on that foundation
rather than replacing any part of it.
ARC (Authenticated Received Chain)
ARC lets a forwarder or mailing list record the authentication result it saw, so a later receiver can choose to honour a pass its own checks would fail.
BIMI
BIMI (Brand Indicators for Message Identification) displays your brand logo beside authenticated email — but only once your domain is at DMARC enforcement.
DKIM
DKIM signs outgoing mail so a receiver can verify which domain took responsibility for the message, and that the signed parts were not altered.
DKIM selector
A DKIM selector is the label that points to a specific DKIM public key in DNS, letting a domain publish and rotate multiple signing keys at once.
DMARC
DMARC tells receiving mail servers what to do with mail that fails authentication or alignment, and reports back on who is sending as your domain.
DMARC aggregate report
An aggregate (RUA) report is a daily XML summary from a mailbox provider showing every source that sent mail as your domain and how it authenticated.
DMARC alignment
Alignment requires the domain that passed SPF or DKIM to match the domain in the visible From address — the check that makes DMARC hard to spoof.
DMARC policy
The DMARC policy (p=) tells receivers whether to monitor, quarantine, or reject mail that fails authentication — the dial you turn toward enforcement.
DMARC quarantine vs reject
DMARC quarantine sends failing mail to spam; reject blocks it outright. Here's the difference, when to use each, and how to move between them safely.
MTA-STS
MTA-STS forces mail sent to your domain to use encrypted TLS, closing a downgrade-attack gap that SPF, DKIM, and DMARC don't address.
SPF
SPF is a DNS record listing which servers are allowed to send mail for your domain, so receivers can reject forgeries from everywhere else.
TLS-RPT
TLS-RPT asks sending servers to report when encrypted delivery to your domain fails. It is the reporting half of MTA-STS, published at _smtp._tls.