DMARC glossary.

Every acronym in one place. New to all this? Start with DMARC, SPF & DKIM in plain English for the story behind the terms.

Aggregate report (RUA): A daily summary a mailbox provider sends about all mail it saw claiming to be from your domain: source IPs, counts, and SPF/DKIM/DMARC results. The backbone of monitoring; the rua= tag says where to send them.
Alignment: The requirement that the domain which passed SPF or DKIM matches the domain in the visible From address. Without it, authentication proves nothing about who the reader thinks sent the mail.
adkim=: The optional DMARC tag controlling DKIM alignment.
adkim=r allows relaxed alignment;
adkim=s requires an exact domain match.
ARC: Authenticated Received Chain. A protocol that records authentication results as mail passes through forwarders or mailing lists, so a receiver can see earlier SPF, DKIM, and DMARC results even if forwarding later breaks them.
ASN: Autonomous System Number, an identifier for the network a sending IP belongs to. Helps tell a real email provider apart from a random hosting network.
aspf=: The DMARC tag controlling SPF alignment.
aspf=r allows relaxed alignment;

aspf=s requires an exact domain match.
BIMI: Brand Indicators for Message Identification. A DNS standard that lets supporting inboxes show your verified logo next to authenticated mail, usually requiring strong DMARC enforcement.
CMC: Common Mark Certificate, a BIMI certificate option for some logos that may not meet the full trademark requirements of a VMC.
DANE: DNS-Based Authentication of Named Entities. For mail, DANE uses DNSSEC and TLSA records to let sending servers verify secure delivery to the right mail server.
DKIM: DomainKeys Identified Mail. A cryptographic signature added to a message and verified against a public key in your DNS. Proves the message wasn't altered and came from a holder of your key; survives forwarding.
DMARC: Domain-based Message Authentication, Reporting & Conformance. The policy layer on top of SPF and DKIM. It requires authentication to pass and align, tells receivers what to do on failure, and asks them to send reports.
DNSSEC: DNS Security Extensions. Adds cryptographic validation to DNS, so DNS answers can be checked for tampering. Required for DANE.
Disposition: What a receiver actually did with a message (delivered, quarantined, or rejected) based on your DMARC policy.
Envelope from: The hidden "MAIL FROM" address used during delivery and checked by SPF. Often differs from the From address the reader sees.
ESP: Email Service Provider, a service that sends mail on your behalf, such as Mailchimp, SendGrid, Microsoft 365, or Google.
Failure report (RUF): A real-time sample of a single message that failed DMARC, sent by receivers that choose to (many don't, for privacy). The ruf= tag controls where they go.
fo= (failure options): The DMARC tag controlling when failure reports may be generated. Useful in theory, but many providers do not send failure reports for privacy reasons.
Header from: The From address your recipient actually sees. DMARC alignment is measured against this.
MTA-STS: Mail Transfer Agent - Strict Transport Security. A policy telling sending mail servers to use trusted TLS when delivering mail to your domain's listed MX hosts.
MX: Mail Exchange. The DNS record that tells other mail servers where to deliver email for your domain.
np=: Non-existent Policy. The DMARC policy for non-existent subdomains. np=reject tells receivers to reject mail from made-up subdomains that do not exist in DNS.
np= (non-existent subdomain policy): A DMARCbis (RFC 9989) tag setting the policy for subdomains that don't exist in DNS. np=reject shuts the door on made-up subdomains spoofers invent.
p= (policy): The DMARC tag that tells receivers what to do with failing mail:
none (monitor only)
quarantine (send to spam)
reject (block)
pct=: Percentage. A legacy DMARC tag that used to apply policy to only a percentage (ex. pct=25)of failing mail. It appears in older records, but is no longer part of the current DMARC standard.
psd=: Public Suffix Domains. A DMARC tag, mostly relevant to registry-level operators and advanced domain boundary cases, not normal company domains.
Reporter: The mailbox provider that sent you a report: Google, Microsoft/Outlook, Yahoo, and others.
Reverse DNS: The hostname an IP address resolves back to, a clue to who owns a sending server.
rf= Legacy DMARC: A legacy DMARC tag that described the format for failure reports. Older records may contain it, but it is no longer part of the current DMARC standard.
ri= Legacy DMARC: A legacy DMARC tag that requested how often aggregate reports should be sent. Older records may contain it, but it is no longer part of the current DMARC standard.
rua=: The DMARC tag listing where aggregate reports should be sent. These reports are the main source of DMARC monitoring data. You can have multiple mails receiving the reports: rua=mailto:mail1@company.com,mailto:mail2@company.com;
ruf=: The DMARC tag listing where failure reports should be sent. Many receivers do not send them, so they are less common than aggregate reports.
SPF: Sender Policy Framework, a DNS list of servers allowed to send for your domain. Checked against the envelope sender; breaks on forwarding.
sp=: Subdomain Policy. A separate DMARC policy governing your existing subdomains. Lock it down too, or subdomains become a spoofer's open door.
STARTTLS: The SMTP command that upgrades a plain mail connection to encrypted TLS. MTA-STS, DANE, and TLS-RPT help make that upgrade safer and more visible.
t=: Testing Mode. A DMARC tag indicating
TLSA: Transport Layer Security Authentication.The DNS record used by DANE. It publishes certificate or public-key information for a service, such as SMTP, and relies on DNSSEC validation.
TLS-RPT: Transport Layer Security Reporting. Reports delivery problems related to encrypted mail transport, especially MTA-STS and DANE failures.
VMC: Verified Mark Certificate. A certificate used with BIMI to prove that a displayed logo is verified and trademarked.