Glossary of terms

Email security comes with a lot of jargon. This glossary explains the terms you will see across DMARCER in plain language, grouped so you can find the one you need. Feel free to keep it open in a second tab while you work through a domain.

Core authentication standards

• SPF (Sender Policy Framework): a DNS record that lists which servers are allowed to send email for your domain. A receiving server checks the sending address against this list.
• DKIM (DomainKeys Identified Mail): a digital signature added to each message. It proves the message really came from your domain and was not changed along the way. The matching public key lives in your DNS.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): ties SPF and DKIM together, tells receivers what to do with mail that fails, and asks them to send you reports.
• Alignment: the check DMARC uses to make sure a passing SPF or DKIM result genuinely belongs to the domain shown in the visible From address. Mail can pass SPF or DKIM and still fail DMARC if it is not aligned.

DMARC policy and the enforcement journey

DMARCER moves a domain through stages rather than jumping straight to full blocking. These are the terms you will see on the Enforcement page.

• p=none: monitor only. Nothing is blocked; you simply collect reports to see who is sending mail as you. This is where every domain starts.
• p=quarantine: mail that fails DMARC is treated as suspicious and usually sent to the spam or junk folder.
• p=reject: mail that fails DMARC is turned away and never reaches the inbox. This is the goal for a fully protected domain.
• pct (percentage): the share of failing mail the policy applies to, for example quarantine at 10%, 25%, 50% or 100%. DMARCER raises this gradually so that a mistake in your set-up cannot suddenly stop all your mail from being delivered.
• Enforcement journey (the stages or ladder): the step-by-step path from p=none, through partial quarantine and reject, up to full reject. DMARCER moves a domain along these stages and shows you a forecast of how much mail would be quarantined or rejected at the next stage before you commit.
• Subdomain policy (sp): a separate DMARC instruction just for subdomains, so a strict policy on the main domain does not unexpectedly catch a subdomain.

Reporting terms

• RUA (aggregate reports): daily summary reports from receivers showing how much of your mail passed or failed, and where it came from. These power the charts and source lists in DMARCER.
• RUF (forensic or failure reports): reports about individual failed messages. They are far less common, because most providers do not send them for privacy reasons.
• TLS-RPT (SMTP TLS Reporting): reports from receivers about any problems they hit when trying to deliver email to you over an encrypted connection. It works alongside MTA-STS.
• Deliverability: the share of your legitimate mail that authenticates and reaches inboxes, measured over a rolling 90-day window from your report data. It feeds into your Domain Security Score.

Transport, DNS and brand standards

• MTA-STS (Mail Transfer Agent Strict Transport Security): tells other mail servers that they must use a secure, verified connection to deliver email to you, which helps block interception and tampering.
• DNSSEC (Domain Name System Security Extensions): signs your DNS records so that an attacker cannot forge or tamper with the answers people receive for your domain.
• MX (Mail Exchanger) records: DNS records that name the servers responsible for receiving email for your domain.
• BIMI (Brand Indicators for Message Identification): lets your verified logo appear next to authenticated messages in mailboxes that support it. It requires DMARC at enforcement first, and often a VMC (Verified Mark Certificate).

DMARCER-specific terms

• Domain Security Score: a 0 to 100 score for each enrolled domain, refreshed regularly, with letter grades from A (strong) down to F. The why this score? breakdown shows how much each part (SPF, DKIM, DMARC, MTA-STS, DNSSEC, reporting and deliverability) contributed.
• Parked domain: a domain that is not used to send mail. DMARCER recognises a correctly held domain (no mail, strict SPF, DMARC at reject, DNSSEC and reporting switched on) and scores it highly, rather than marking it down for lacking DKIM, MTA-STS or BIMI that it does not need.
• Compliance findings: specific set-up issues DMARCER spots against the relevant standards (for example a duplicate MTA-STS policy line or a weak DNSSEC algorithm). Open findings can lower a domain's score until they are resolved.
• Benchmark: a public, lighter scan and score used to compare a domain against others. It is separate from the fuller Domain Security Score used for enrolled domains.
• Tenant or company: a client you manage within your account. If you look after several clients, each one is a separate tenant with its own domains, policies and reports.
• PSA integration: the link between DMARCER and your professional services automation tool (such as HALO, SuperOps, Autotask or ConnectWise), used to sync assets and raise tickets.

[Screenshot: a domain's Domain Security Score with the why this score? breakdown panel open]

A few common pitfalls worth remembering:

• Passing SPF or DKIM is not the same as passing DMARC: the result also has to be aligned with your From domain.
• p=none does not protect anything on its own; it is only a monitoring stage. Mail is not blocked until you reach quarantine or reject.
• Do not expect many RUF reports; the aggregate RUA data is where the real picture lives.
• A low score on a parked domain usually means it is not yet fully locked down (strict SPF, DMARC reject, DNSSEC), not that it needs more sending features.