DNS & Domain Security Terms

A DNS record that maps a hostname to an IPv4 address. The most fundamental DNS record type.

IPv6 address record. Same purpose as an A record but for IPv6. Read aloud as 'quad-A record'.

Authenticated Received Chain — a series of DKIM-like signatures that preserve email authentication across mailing-list forwarders that would otherwise break DMARC.

The 2015 winner of the Password Hashing Competition. Modern password KDF with tunable memory + parallelism + time cost. Recommended for new applications.

An ASCII-safe encoding representing binary data as 64 printable characters. Widely used in JWTs, email attachments, data URLs, and TLS certs. Not encryption.

A password hashing function designed for slow key derivation. Adaptive work factor. Industry-standard for storing user passwords since 1999.

Brand Indicators for Message Identification — a DNS TXT record letting DMARC-authenticated senders show their logo next to messages in Gmail, Yahoo, and Apple Mail.

A database of IP addresses or domain names known to send spam, host malware, or engage in phishing. Mail servers and browsers query blacklists to block or flag suspicious traffic.

Certification Authority Authorization — a DNS record listing which certificate authorities are allowed to issue TLS certs for a domain. Blocks rogue or mistaken issuance.

Country-Code Top-Level Domain — a TLD assigned to a country or territory using ISO 3166-1 alpha-2 codes (.uk, .de, .in, .cn).

Canonical Name record — maps a hostname to another hostname rather than an IP address. Used for aliases and pointing subdomains at external services.

A cookie attribute controlling whether the browser sends a cookie on cross-site requests. Modern CSRF defence — Lax by default.

Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy — HTTP headers that isolate a page from cross-origin windows and require CORP-marked embeds. Prerequisite for SharedArrayBuffer.

Cross-Origin Resource Sharing — an HTTP header protocol that lets servers explicitly permit cross-origin fetch requests from browsers, overriding the same-origin policy.

Content Security Policy — an HTTP response header that whitelists trusted sources of scripts, styles, images, and connections. The single biggest anti-XSS defence.

A CNAME record whose target no longer resolves or points to a resource you don't own. The technical name for the setup that enables subdomain takeover.

DomainKeys Identified Mail — an email authentication standard that uses public-key cryptography to sign outgoing messages, allowing receivers to verify the email came from the claimed domain and wasn't altered in transit.

A short string in a DKIM record's DNS name identifying which key pair to use. Enables key rotation and multi-provider deployments.

Domain-based Message Authentication, Reporting & Conformance — the policy layer of email authentication that ties SPF and DKIM to the From: header and specifies what to do when messages fail.

Domain Name System — the internet's distributed database that translates human-readable domain names (example.com) into IP addresses and other machine-readable data.

A portion of the DNS namespace administered by a single authority. Delimited by NS records and controlled by a single SOA record.

DNS Security Extensions — a suite of records (DNSKEY, RRSIG, DS, NSEC/NSEC3) that cryptographically signs DNS answers, preventing forgery.

Registering a domain name at the exact moment it becomes available after prior owner drops it. Automated, high-volume, adversarial.

Delegation Signer — a DNS record in the parent zone that fingerprints the child zone's DNSSEC key. The link that connects a domain into the DNSSEC chain of trust.

The address named in the SMTP MAIL FROM command. Distinct from the visible From: header. What SPF actually authenticates.

Extensible Provisioning Protocol — the XML-over-TCP protocol registrars use to talk to registries. Every domain registration, transfer, and lock change goes through EPP.

An A or AAAA record in the parent zone giving the IP of an in-bailiwick nameserver. Solves the DNS chicken-and-egg where a nameserver is inside the zone it serves.

Generic Top-Level Domain — a TLD not tied to a specific country. Includes .com, .org, .net, plus the ~1,200 newTLDs from ICANN's 2013 expansion.

A character that looks identical or nearly identical to another, from a different script (e.g., Cyrillic а vs Latin a). Used in phishing to build lookalike domains.

HTTP Strict Transport Security — an HTTP response header telling browsers to only connect over HTTPS for a specified time. Blocks downgrade attacks.

Hypertext Transfer Protocol Secure — HTTP with TLS encryption. HTTPS encrypts data between browser and server and authenticates the server's identity via an SSL/TLS certificate.

Internationalized Domain Name — a domain containing non-ASCII characters (Cyrillic, Chinese, emoji, etc.), transmitted as Punycode over DNS.

JSON Web Key — RFC 7517 spec for representing a public or private cryptographic key as a JSON object. Enables key discovery for JWT verification.

JSON Web Signature — the RFC 7515 specification defining how JWT claims are signed. Underlying signature layer under most JWTs.

JSON Web Token — a compact base64-encoded token containing signed claims. The dominant format for API auth, session tokens, and OAuth access tokens.

Media Access Control address — a 48-bit hardware identifier assigned to network interfaces. Used at Ethernet / Wi-Fi layer, not for internet routing.

The SMTP command declaring the envelope sender for a message. Distinct from the From: header. The address SPF actually checks.

Message Digest 5 — a 128-bit cryptographic hash function, broken since 2004. Still used for file integrity where security is not required.

Mail Transfer Agent Strict Transport Security — forces inbound SMTP over TLS with certificate validation, published via HTTPS.

Mail Exchange record — a DNS record that specifies the mail servers responsible for receiving email for a domain, with priority values to control which server is tried first.

A server that stores DNS records for a domain and answers DNS queries. Your domain's nameservers are the authoritative source for all DNS data about your domain.

Naming Authority Pointer — used with SRV for complex service discovery, especially SIP and ENUM.

Nameserver record — delegates a zone (or subzone) to a specific set of authoritative nameservers. Present at every zone boundary.

Organizationally Unique Identifier — the first 24 bits of a MAC address identifying the device manufacturer. Assigned by IEEE.

An HTTP response header controlling which browser features (camera, microphone, geolocation, payment, etc.) a page and its iframes may use. Replaces Feature-Policy.

A cyberattack that uses deceptive emails, websites, or messages to trick victims into revealing credentials, financial data, or installing malware. Most attacks impersonate trusted brands via spoofed domains or emails.

TCP port 25 — the original SMTP port, used for server-to-server mail relay. Blocked outbound by most residential ISPs to prevent spam.

TCP port 465 — SMTP over implicit TLS. Deprecated for years, then revived by RFC 8314 as an equal alternative to port 587 for mail submission.

TCP port 587 — SMTP mail submission with STARTTLS. Current standard for authenticated client-to-server mail sending.

Reverse DNS record. Maps an IP address back to a hostname. Critical for email deliverability — receivers reject mail from IPs with no PTR.

An ASCII-only encoding for internationalized (Unicode) domain names. Encoded labels start with 'xn--' and can look nothing like the human-readable form.

Registration Data Access Protocol — the modern JSON-over-HTTPS replacement for WHOIS. Structured, authenticated, internationalized.

An email header inserted by receiving mail servers recording the SPF check verdict. First stop when debugging SPF failures.

The 30-day grace window after a domain expires but before it drops. During this window only the original registrant can restore it, usually for a fee.

An HTTP response header controlling how much URL information is sent in the Referer header when navigating away. Privacy + prevents URL-token leakage.

The email header inserted by the receiving mail server containing the envelope sender address. Where bounces are directed.

Reporting URI for Aggregate — the DMARC field naming the mailbox that receives daily aggregate authentication reports as gzipped XML.

Reporting URI for Forensic — the DMARC field naming the mailbox that receives per-message forensic failure reports. Rarely used due to privacy concerns.

Secure Hash Algorithm 256-bit — the industry-standard cryptographic hash function. Used in TLS certs, Bitcoin, Git, and every modern integrity check.

Secure Hash Algorithm 512-bit — a larger SHA-2 family member with a 512-bit digest. Used where extra output width is preferred over compactness.

Start of Authority — the first record in every DNS zone. Names the primary nameserver, the admin email, and controls zone refresh timers and negative-cache TTL.

Sender Policy Framework — a DNS TXT record that lists which mail servers are authorized to send email for a domain. Receiving servers check the sender's IP against this list.

Subresource Integrity — an HTML attribute containing a cryptographic hash that browsers verify before executing a fetched script or stylesheet. Blocks CDN tampering.

Service location record — advertises the hostname and port for a specific service on a domain. Used by SIP, XMPP, LDAP, Matrix, and Minecraft.

Secure Sockets Layer / Transport Layer Security — cryptographic protocols that encrypt data in transit between a client (browser) and server. TLS is the modern version; SSL is deprecated but the name persists.

A vulnerability where a DNS record (usually CNAME) points to a third-party service that has since been decommissioned — allowing an attacker to re-claim the resource and serve content from your subdomain.

Top-Level Domain — the last label of a domain name. Categorized as gTLD (.com, .org), ccTLD (.uk, .de, .in), sTLD (.gov, .edu), or newTLD (.xyz, .app).

SMTP TLS Reporting — a DNS TXT record telling senders where to send daily reports of TLS failures on inbound SMTP. Companion to MTA-STS.

TLSA — a DANE record that publishes a hash of the expected TLS certificate directly in DNS, letting clients verify certs without depending only on public CAs.

A registrar setting that prevents a domain from being transferred to another registrar without the owner's explicit action. On by default at reputable registrars.

Time to Live — a value in DNS records (in seconds) that controls how long resolvers and browsers cache the record before fetching a fresh copy from the authoritative nameserver.

A DNS record type that stores arbitrary text strings. Originally for human-readable notes, now primarily used to publish SPF, DKIM, DMARC, and domain verification data.

Universally Unique Identifier — a 128-bit value used as an ID with negligible collision probability. Multiple versions with different generation strategies.

The legacy plain-text protocol for querying domain registration data — registrant, registrar, dates, nameservers. Being superseded by RDAP.

An HTTP response header with a single value 'nosniff' that stops browsers from MIME-sniffing responses. Blocks the class of attacks that turn an image into an executable script.

An HTTP response header that controls whether a page can be embedded in an <iframe>. Primary defence against clickjacking. Superseded by CSP frame-ancestors.