Domain security glossary

IPv6 address

An AAAA record tells the world the IPv6 address of your website or server, the newer and longer form of internet address. It sits beside the older A record, which holds the IPv4 address. Without one, visitors on IPv6-only networks have to be translated to reach you.

Census: 21.8% of the 316,600,902 graded domains publish an AAAA record, as of September 5, 2026.

Read more: How to fix IPv6 support · The IPv6 support check: pass and fail rules · What percent of domains support IPv6?

Automatic Certificate Management Environment

ACME is the protocol that lets a web server request and renew its security certificate automatically. Let’s Encrypt and most hosting control panels use it, which is why many certificates now renew themselves every few weeks with nobody touching them.

Read more: How to fix TLS certificate health · TLS and certificates: every browser warning and what causes it

Authenticated Encryption with Associated Data

AEAD describes the modern kind of encryption cipher that scrambles data and proves it was not altered, in one step. TLS 1.3 allows only AEAD ciphers such as AES-GCM and ChaCha20-Poly1305, which is one reason it is safer than older versions.

Read more: The Cipher strength check: pass and fail rules · TLS and certificates: every browser warning and what causes it

Authenticated Received Chain

ARC lets a mailing list or forwarding service record that a message passed its authentication checks before the service changed it. A receiving mail provider that trusts the forwarder can then accept the message even though SPF or DKIM now fails.

Read more: Mail forwarding breaks SPF, and what survives it · DKIM "body hash did not verify"

Business Email Compromise

Business email compromise is fraud in which a criminal sends email that appears to come from you, your boss or a supplier, usually to redirect a payment. A domain with no enforcing DMARC policy makes the forged sender address easy to fake.

Read more: Can someone send email as your domain right now? · DMARC: what your record instructs a receiver to do · Someone is sending emails from my domain, what to do

Brand Indicators for Message Identification

BIMI is a DNS record that lets supporting inboxes show your logo beside mail from your domain. It only works once your domain has an enforcing DMARC policy, and most inboxes also want a certificate proving the logo is yours: Gmail accepts a VMC or a CMC, and Apple Mail needs a VMC.

Read more: How to fix BIMI · BIMI needs more than a logo: the DMARC gate in front of it

Certificate Authority

A certificate authority is an organisation browsers trust to issue the security certificates that make HTTPS work, such as Let’s Encrypt or DigiCert. Before issuing, it checks that whoever asks really controls the domain.

Read more: TLS and certificates: every browser warning and what causes it · How to fix CAA records · Who issues the most TLS certificates?

Certification Authority Authorization

A CAA record lists the certificate authorities allowed to issue certificates for your domain. Authorities are required to check it first, so a CAA record stops a certificate being issued by a company you never use.

Census: 1.4% of the 313,913,664 domains where the CAA lookup returned a determinate answer publish a CAA record, as of September 5, 2026.

Read more: How to fix CAA records · CAA setup walkthroughs by provider · The CAA records check: pass and fail rules · What percent of domains have CAA records?

Content Delivery Network

A content delivery network is a group of servers around the world that keeps copies of your website close to visitors so pages load faster. Cloudflare, Akamai and Fastly are common examples, and many also filter attacks before they reach your own server.

Read more: How to fix CDN / WAF & hosting · HTTP security headers: what each one does and what the web actually sets

Common Mark Certificate

A common mark certificate proves you have used a logo for at least a year, so it can be shown in inboxes through BIMI without a registered trademark. Gmail accepts a CMC; Apple Mail needs a VMC instead.

Read more: How to fix BIMI · BIMI needs more than a logo: the DMARC gate in front of it

Canonical Name

A CNAME record points one name at another name, for example www.yourdomain.com at your hosting provider’s address. Email services often ask you to add CNAME records so they can manage your DKIM keys for you.

Read more: DNS and DNSSEC: what signing changes and what it breaks · DKIM setup walkthroughs by provider

Cross-Origin Embedder Policy

COEP is a web security header that stops a page loading files from other sites unless those sites agree to it. Together with COOP it isolates a page from other sites, which a few advanced browser features require.

Read more: How to fix Cross-origin isolation headers · HTTP security headers: what each one does and what the web actually sets

Cross-Origin Opener Policy

COOP is a web security header that keeps your page in its own browser window group, so a site that opened it, or that it opens, cannot reach into it. It helps block some cross-site data leaks.

Read more: How to fix Cross-origin isolation headers · HTTP security headers: what each one does and what the web actually sets

Cross-Origin Resource Policy

CORP is a web security header you put on your own files, such as images and scripts, to say which other sites may load them. It stops other sites embedding them when you have not allowed it.

Read more: How to fix Cross-origin isolation headers · HTTP security headers: what each one does and what the web actually sets

Content Security Policy

A content security policy is a web security header that lists where your pages may load scripts, styles and images from. If an attacker manages to inject code into a page, the browser refuses to run it when the policy does not allow it.

Census: 2.5% of the 214,006,060 domains that sent a Server, Content-Security-Policy or X-Powered-By header carry a Content-Security-Policy that constrains script, as of September 5, 2026.

Read more: HTTP security headers: what each one does and what the web actually sets · How to fix Content-Security-Policy · The Content-Security-Policy check: pass and fail rules · Most Content-Security-Policy headers are not content security policies · What percent of websites have a Content-Security-Policy?

DNS-Based Authentication of Named Entities

DANE publishes a fingerprint of your mail server’s certificate in DNS, protected by DNSSEC. Sending servers that support it will then only deliver to you over an encrypted connection using that exact certificate.

Read more: How to fix DANE · Bounce codes: reading the rejection your receiver actually sent

DomainKeys Identified Mail

DKIM adds a digital signature to every email you send, and publishes the key to check it in your DNS. A receiving mail provider can then confirm the message really came from your domain and was not changed on the way.

Census: 50.1% of the 75,823,110 domains where a DKIM selector could be determined have a discoverable DKIM selector, as of September 5, 2026.

Read more: DKIM: signing, selectors, and the failures you will actually see · How to fix DKIM · DKIM setup walkthroughs by provider · The DKIM check: pass and fail rules · How to find the DKIM selector your provider uses

Domain-based Message Authentication, Reporting and Conformance

DMARC is a DNS record that tells mail providers what to do with email that claims to be from your domain but fails SPF and DKIM: deliver it, send it to spam, or reject it. It also sends you reports on who is sending mail in your name. It is the main defence against criminals impersonating your business by email.

Census: 24.8% of the 316,600,902 graded domains publish a DMARC record, as of September 5, 2026.

Read more: DMARC: what your record instructs a receiver to do · How to fix DMARC · DMARC setup walkthroughs by provider · The DMARC policy check: pass and fail rules · What percent of domains have DMARC?

Domain Name System

DNS is the internet’s address book. It turns your domain name into the addresses of your website and mail servers, and it holds the text records that prove who may send email as you. Most of what this site checks lives in DNS.

Read more: DNS and DNSSEC: what signing changes and what it breaks · DNS & infrastructure: the census section · How to fix Nameserver setup

DNS Public Key

A DNSKEY record holds the public key that DNSSEC signatures in your domain are checked against. Your DNS provider normally creates and rotates it for you once DNSSEC is switched on.

Read more: How to fix DNSSEC · DNSSEC setup walkthroughs by provider · DNS and DNSSEC: what signing changes and what it breaks

Domain Name System Security Extensions

DNSSEC signs your DNS records so a resolver can prove the answers came from you and were not forged on the way. It needs a matching DS record at your registrar, and a mismatch there makes your whole domain fail to resolve for validating resolvers.

Census: 6.9% of the 316,600,902 graded domains have a valid, fully validating DNSSEC chain, as of September 5, 2026.

Read more: How to fix DNSSEC · DNSSEC setup walkthroughs by provider · The DNSSEC check: pass and fail rules · What percent of domains use DNSSEC? · SERVFAIL after turning on DNSSEC: signed, broken, or off

Delegation Signer

A DS record sits at your registrar, in the zone above yours, and vouches for your domain’s DNSSEC key. It links your signed records into the chain of trust. If you change DNS provider, the old DS record has to be replaced or removed.

Read more: How to fix DNSSEC · DNSSEC setup walkthroughs by provider · SERVFAIL after turning on DNSSEC: signed, broken, or off

Elliptic Curve Digital Signature Algorithm

ECDSA is a signature method used for certificate keys and DNSSEC. A 256-bit ECDSA key is about as strong as a 3072-bit RSA key while being far smaller and faster.

Read more: How to fix TLS certificate health · The Key strength check: pass and fail rules

Email Service Provider

An email service provider is a company that sends newsletters or bulk mail on your behalf, such as Mailchimp or Brevo. It has to be authorised in your SPF record or sign with DKIM for your domain, or its mail will fail DMARC.

Read more: Newsletter emails failing DMARC? Authenticate your domain · DMARC: what your record instructs a receiver to do

HTTP Strict Transport Security

HSTS is a web security header that tells browsers to use only the encrypted HTTPS version of your site, for a period you choose. After the first visit, the browser refuses to load the unencrypted version, which blocks a class of interception attacks.

Census: 21.1% of the 212,154,494 HTTPS-serving domains send an HSTS header, as of September 5, 2026.

Read more: HSTS: the header most HTTPS sites still skip · How to fix HSTS · The HSTS check: pass and fail rules · What percent of websites use HSTS?

Hypertext Transfer Protocol

HTTP is the protocol browsers use to fetch web pages. On its own it is unencrypted, so anyone on the network path can read or change what is sent. Web security headers travel in HTTP responses.

Read more: HTTP security headers: what each one does and what the web actually sets · The HTTP→HTTPS redirect check: pass and fail rules · How to fix HTTPS & forced-secure redirect

Hypertext Transfer Protocol Secure

HTTPS is HTTP sent over an encrypted TLS connection, shown by the padlock in the browser. It keeps what visitors type and read private, and proves they reached your real site.

Census: 67.0% of the 316,600,902 graded domains serve over HTTPS, as of September 5, 2026.

Read more: How to fix HTTPS & forced-secure redirect · The HTTPS available check: pass and fail rules · TLS and certificates: every browser warning and what causes it

Internet Assigned Numbers Authority

IANA is the body that coordinates the internet’s shared registries, including the list of top-level domains and the root of DNS. The census uses IANA’s delegation type to class each top-level domain as a country code or a generic one.

Read more: The September 2026 edition: how 347,691,016 domains were counted · How many TLDs does the census cover?

Internationalized Domain Name

An internationalized domain name uses characters outside plain English letters, such as accented or non-Latin scripts. Behind the scenes DNS stores it in an encoded form that starts with xn--.

Read more: The September 2026 edition: how 347,691,016 domains were counted · DNS and DNSSEC: what signing changes and what it breaks

Internet Protocol

The Internet Protocol is the basic system that moves data between computers. An IP address is the number that identifies a server or device on the internet, in either the older IPv4 or the newer IPv6 form.

Read more: How to fix IPv6 support · How to fix Reverse DNS · DNS and DNSSEC: what signing changes and what it breaks

Internet Service Provider

An internet service provider is the company that connects a home or office to the internet. Many also run large mailbox services and apply their own spam filtering to mail from your domain.

Read more: Bounce codes: reading the rejection your receiver actually sent · How to fix Reverse DNS

Microsoft, Apple, Google and Yahoo

MAGY is deliverability shorthand for Microsoft, Apple, Google and Yahoo, the four big consumer mailbox providers. Google, Yahoo and Microsoft publish and enforce sender requirements: authenticate with SPF and DKIM, publish DMARC, align the visible From: domain, support one-click unsubscribe and keep spam complaints low.

Census: 19.4% of the 316,600,902 graded domains publish both an SPF record and a DMARC record, the part of the baseline visible in public DNS, as of September 5, 2026.

Read more: MAGY readiness: the mailbox-provider baseline · DMARC: what your record instructs a receiver to do · SPF: what your record says, how it fails, and how to fix it

Multipurpose Internet Mail Extensions

MIME types label what kind of file something is, such as text/html or image/png, in both email and the web. The X-Content-Type-Options header stops browsers guessing a different type than the one your server declared.

Read more: How to fix MIME-sniffing protection · The MIME-sniffing protection check: pass and fail rules

Mail Transfer Agent

A mail transfer agent is the server software that passes email from one mail system to the next. When you send a message, your provider’s MTA hands it to the recipient’s MTA over SMTP.

Read more: Bounce codes: reading the rejection your receiver actually sent

SMTP MTA Strict Transport Security

MTA-STS is a policy you publish that tells other mail servers to deliver to your domain only over an encrypted, certificate-checked connection. It closes the gap where an attacker could force mail to travel unencrypted.

Read more: Bounce codes: reading the rejection your receiver actually sent

Mail Exchange

An MX record tells other mail servers where to deliver email for your domain, for example to Google Workspace or Microsoft 365. A domain with no MX record cannot receive mail at its own addresses.

Census: 54.7% of the 316,600,902 graded domains publish at least one MX record, as of September 5, 2026.

Read more: Bounce codes: reading the rejection your receiver actually sent · How to fix MX records · The MX records check: pass and fail rules · What percent of domains publish MX records?

Non-Delivery Report

A non-delivery report is the bounce message you get back when an email could not be delivered. Its error code, such as 550 5.7.26, usually names the exact authentication check that failed.

Read more: Outlook rejecting your email, 550 5.7.515 and 5.7.509 · Gmail 550-5.7.1 message blocked, and how to fix it · 550-5.7.26 This email has been blocked because the sender is unauthenticated

Name Server

NS records list the name servers that answer DNS questions for your domain, usually run by your registrar or DNS host. A domain should list at least two, on separate networks, so one outage does not take everything offline.

Read more: How to fix Nameserver setup · The Nameserver diversity check: pass and fail rules · DNS and DNSSEC: what signing changes and what it breaks

Non-Existent Domain

NXDOMAIN is the DNS answer that means the name you asked for does not exist. A typo in a record name, or a lapsed domain, produces it.

Read more: DNS and DNSSEC: what signing changes and what it breaks · 15.9 million domains the census could not pin down

Online Certificate Status Protocol

OCSP lets a browser ask a certificate authority whether a certificate has been revoked before it expires. OCSP stapling lets your server attach that answer itself, which is faster and more private for visitors.

Read more: How to fix TLS certificate health · TLS and certificates: every browser warning and what causes it

Pointer

A PTR record does reverse DNS: it turns an IP address back into a host name. Mail providers check that a sending server has one, and that it matches, before they trust its mail.

Census: 77.8% of the 173,216,907 domains with a mail-relevant address have a PTR (reverse DNS) record, as of September 5, 2026.

Read more: How to fix Reverse DNS · The Reverse DNS (PTR) check: pass and fail rules · Bounce codes: reading the rejection your receiver actually sent

Request for Comments

An RFC is a numbered document published by the Internet Engineering Task Force that defines how an internet standard works. SPF is RFC 7208, DKIM is RFC 6376 and DMARC is RFC 7489, and the checks on this site follow them.

Read more: How the grade is calculated: all 33 checks · How the grade is built: 33 checks, 100 points, and the 40 that email carries

Resource Record Signature

An RRSIG record is the DNSSEC signature over a set of DNS records. Each one has an expiry date, so a signer that stops re-signing leaves the domain failing to resolve for validating resolvers.

Read more: How to fix DNSSEC · SERVFAIL after turning on DNSSEC: signed, broken, or off

Rivest-Shamir-Adleman

RSA is the long-established public key method used for certificate keys, DKIM keys and DNSSEC. Keys of 2048 bits or longer are considered safe today.

Read more: How to fix TLS certificate health · The Key strength check: pass and fail rules · DKIM: signing, selectors, and the failures you will actually see

Server Failure

SERVFAIL is the DNS answer that means the server could not give a valid reply. A broken DNSSEC chain is a common cause, and to visitors it looks as if the domain has vanished.

Read more: SERVFAIL after turning on DNSSEC: signed, broken, or off · How to fix DNSSEC

Simple Mail Transfer Protocol

SMTP is the protocol mail servers use to hand email to each other. SPF, DKIM and DMARC were all added on top of it because SMTP itself never checks who the sender really is.

Read more: Bounce codes: reading the rejection your receiver actually sent · 550-5.7.26 This email has been blocked because the sender is unauthenticated

Start of Authority

The SOA record is the header of your DNS zone. It names the primary name server and a contact address, and sets the timers other servers use to refresh and cache your records.

Read more: What is an SOA record · The SOA configuration check: pass and fail rules · DNS and DNSSEC: what signing changes and what it breaks

Sender Policy Framework

SPF is a DNS record that lists the servers allowed to send email for your domain. Receiving mail providers compare the sending server against it, and mail from a server not on the list can be marked as suspicious.

Census: 47.4% of the 316,600,902 graded domains publish an SPF record, as of September 5, 2026.

Read more: SPF: what your record says, how it fails, and how to fix it · How to fix SPF · SPF setup walkthroughs by provider · The SPF record check: pass and fail rules · What percent of domains have an SPF record?

Sender Rewriting Scheme

SRS lets a forwarding service rewrite the hidden sender address of a message it passes on, so SPF checks the forwarder instead of failing. It does not change the From: address people see, so it does not help DMARC alignment.

Read more: Mail forwarding breaks SPF, and what survives it

Secure Sockets Layer

SSL is the older name for the encryption behind HTTPS. Every version of SSL is retired as insecure and TLS replaced it, but people still say SSL certificate for what is really a TLS certificate.

Read more: TLS and certificates: every browser warning and what causes it · How to fix TLS certificate health · How to fix Modern encryption

Transmission Control Protocol

TCP is the internet protocol that delivers data reliably and in order between two computers. Web traffic and email run over it, and DNS switches to it for answers too large for a single packet.

Read more: DNS and DNSSEC: what signing changes and what it breaks

Top-Level Domain

The top-level domain is the last part of a domain name, such as .com, .org or a country code such as .de. Each one is run by a registry with its own rules, and the census reports results for each.

Census: 1,433 top-level domains parsed by the census, as of September 5, 2026.

Read more: TLDs compared: the census section · Place your score inside your TLD · Is .com safer than .net or .org? The measured answer with the denominator stated · How many TLDs does the census cover?

Transport Layer Security

TLS is the encryption that protects a connection between two computers, used by HTTPS websites and by mail servers. Versions 1.2 and 1.3 are current; anything older should be switched off.

Census: 100.0% of the 212,154,494 HTTPS-serving domains negotiate TLS 1.2 or 1.3, as of September 5, 2026.

Read more: TLS and certificates: every browser warning and what causes it · How to fix Modern encryption · TLS certificate setup walkthroughs by provider · The TLS version check: pass and fail rules · What percent of websites use TLS 1.3?

SMTP TLS Reporting

TLS-RPT is a DNS record that asks other mail servers to send you daily reports when they could not make an encrypted connection to your mail server. It is usually set up alongside MTA-STS.

Read more: Bounce codes: reading the rejection your receiver actually sent

Time to Live

The TTL on a DNS record is how many seconds other servers may keep a copy before asking again. A long TTL means a change can take hours to be seen everywhere; lowering it before a planned change speeds that up.

Read more: DNS and DNSSEC: what signing changes and what it breaks

Text

A TXT record holds free text in your DNS. SPF, DMARC and DKIM keys are all published as TXT records, as are the verification codes services such as Google and Microsoft ask you to add.

Read more: DNS and DNSSEC: what signing changes and what it breaks · Identify a TXT record · How many TXT verification records does one domain carry?

Verified Mark Certificate

A verified mark certificate proves you own the trademarked logo you publish through BIMI. Apple Mail needs one before it shows the logo, and Gmail accepts either a VMC or a CMC.

Read more: How to fix BIMI · BIMI needs more than a logo: the DMARC gate in front of it

Web Application Firewall

A web application firewall sits in front of a website and blocks requests that look like attacks, such as attempts to inject code. It is often part of a CDN service.

Read more: How to fix CDN / WAF & hosting · HTTP security headers: what each one does and what the web actually sets