Email authentication, in plain language.

How these fit together

SPF and DKIM each authenticate a message on their own terms — one checks the sending server, the other checks a cryptographic signature. DMARC sits above both: it requires one of them to pass and align with the visible From: address, tells receivers what to do otherwise via the policy, and reports back on every source claiming your domain through aggregate reports. BIMI and MTA-STS build on that foundation rather than replacing any part of it.

Two of the terms here sit slightly apart from the rest. MTA-STS and TLS-RPT are about transport rather than identity: they govern whether the connection carrying a message was encrypted and verified, not who was allowed to send it. ARC covers what happens when a message is forwarded, which is the most common reason a perfectly legitimate email fails a check it should have passed.

The definitions are deliberately short. Each says what the term means, where it appears in a record or a header, and — usually the part worth reading — what it does not cover. That last part is where most of the confusion starts, because these standards overlap enough to look interchangeable and differ enough that treating one as a substitute for another quietly breaks something months later. Where a term needs a procedure rather than a definition, the entry links out to the guide that has it.