Aggregate report (rua)
The daily XML report a mailbox provider sends to the rua= address in your DMARC record: every server that sent mail as your domain, how much, and whether it passed. Read one with the XML-to-human Converter.
Alignment
The match DMARC needs between the domain in the From address and the domain SPF or DKIM passed for. Relaxed alignment, the default, accepts a subdomain of the same organisation. Why SPF and DKIM can pass while DMARC fails.
BIMI
Brand Indicators for Message Identification: your logo next to your mail in inboxes that support it, for a domain whose DMARC policy is quarantine or reject. What is BIMI?.
DKIM
DomainKeys Identified Mail: a signature on each message, checked with a public key you publish in DNS. What is DKIM?.
DKIM selector
The name of one DKIM key, in the s= tag of a signature. Its public key is published at <selector>._domainkey.<domain>. DKIM Inspector.
DMARC
The record at _dmarc.<domain> that tells receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports. What is DMARC?.
DMARCbis
The current DMARC specification, RFC 9989, which replaced RFC 7489. It removed pct, ri and rf, and added np, psd and t. What DMARCbis changed.
DNS tree walk
How DMARCbis finds a domain's organisational domain: by looking up DMARC records up the DNS tree, instead of the Public Suffix List.
Envelope sender (Return-Path)
The bounce address given in the SMTP conversation, which SPF checks. It is often the sending service's domain, not the one in the From address.
Failure report (ruf)
A report about a single message that failed DMARC, sent to the ruf= address. Few providers send them. Failure reports in DMARCLoop.
MTA-STS
A policy telling sending servers to deliver mail to your domain only over TLS with a valid certificate. What MTA-STS is.
np
A DMARCbis tag: the policy for subdomains that don't exist, so mail from made-up subdomains can be refused.
Null MX
An MX record of "." (RFC 7505), which says a domain accepts no mail.
Permerror
A permanent error in an SPF check, such as more than 10 DNS lookups or two SPF records. DMARC treats it as SPF failing. SPF Check.
Policy (p=)
What receivers should do with mail that fails DMARC: none (deliver and report), quarantine (junk folder) or reject (refuse). The path from p=none to p=reject.
psd
A DMARCbis tag that marks a domain as a public suffix (psd=y), or as an organisational domain (psd=n), for the DNS tree walk.
SPF
Sender Policy Framework: the record listing the servers allowed to send mail for a domain's envelope sender. What is SPF?.
Subdomain policy (sp=)
The policy for existing subdomains when it should differ from p=. Without it, subdomains follow p=.
Testing flag (t=y)
A DMARCbis tag: while set, receivers apply one step less than the published policy. It replaced pct for testing a stricter policy.
TLS-RPT
SMTP TLS Reporting: a record at _smtp._tls.<domain> asking senders to report failed TLS connections to your mail servers.
Void lookup
An SPF mechanism that points at a name with no DNS answer. More than two in one check is a permanent error.