What do all these email deliverability terms mean?
Scott Anderson · Last reviewed
Short answer
Email deliverability has three core records — SPF (who may send as you), DKIM (a signature proving the message is unaltered) and DMARC (what to do when those fail, plus reporting) — surrounded by supporting vocabulary: alignment, selectors, aggregate reports, MTA-STS, BIMI and ARC. Every term below is defined in one or two sentences.
Key facts
SPF, DKIM and DMARC are open standards published as RFCs 7208, 6376 and 7489 — not products anyone sells. RFC 7489 (DMARC) ↗
ARC (RFC 8617) exists to preserve authentication results across intermediaries like mailing lists. RFC 8617 (ARC) ↗
The three records
- SPF (Sender Policy Framework)
- A DNS record listing the servers and services permitted to send email using your domain. Breaks when mail is forwarded, and is limited to ten DNS lookups.
- DKIM (DomainKeys Identified Mail)
- A cryptographic signature added to each outgoing message, verified against a public key in your DNS. Survives forwarding, unlike SPF.
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
- Ties SPF and DKIM to the visible From: domain, tells receivers what to do when both fail, and requests reports on mail sent in your name.
How they're evaluated
- Alignment
- The requirement that the domain SPF or DKIM authenticated matches the domain in the From: address your recipient sees. Without it, a spammer could pass SPF for their own domain while displaying yours.
- Selector
- The label identifying which DKIM key signed a message, published at selector._domainkey.yourdomain. Selectors can't be enumerated from outside — you can only guess common names.
- Soft fail (~all)
- The SPF instruction to treat unlisted senders as suspicious but still accept them. The usual starting position.
- Hard fail (-all)
- The SPF instruction to reject unlisted senders. Correct once you're certain every legitimate sender is listed.
- Neutral (?all)
- No opinion at all about unlisted senders. Equivalent to publishing nothing, and rarely what anyone intends.
- permerror
- A permanent SPF error — two records, a syntax problem, or more than ten lookups. Receivers discard the whole record.
- Policy (p=)
- The DMARC instruction: none (monitor only), quarantine (send to junk) or reject (refuse outright).
- pct=
- The percentage of failing mail your DMARC policy is applied to. A value below 100 usually means a rollout that was never finished.
Reporting
- rua=
- The address receiving daily aggregate DMARC reports. Without it, a DMARC record tells you nothing.
- ruf=
- The address for forensic reports on individual failed messages. Many providers don't send these, for privacy reasons.
- Aggregate report
- A daily XML summary from a receiving provider listing every source that sent mail claiming to be your domain, and whether it authenticated.
- Postmaster Tools
- Google's free dashboard showing your spam complaint rate, authentication results and domain reputation for mail sent to Gmail.
The supporting cast
- MX record
- Where your incoming mail is delivered. Stale MX records left over from a migration are a common and under-rated security problem.
- PTR / reverse DNS
- A record mapping a sending IP address back to a hostname. Required by Gmail, and handled for you by any reputable sending platform.
- MTA-STS
- A policy declaring that mail to your domain must be delivered over TLS, closing off downgrade attacks. Optional, and a mark of a well-run domain.
- TLS-RPT
- Reporting on failed TLS connections to your domain. Pairs with MTA-STS.
- BIMI
- Displays your logo beside authenticated messages in supporting clients. Requires DMARC at quarantine or reject first, so it's a reward for finishing the work, not a shortcut.
- ARC
- Authenticated Received Chain: preserves authentication results across intermediaries such as mailing lists, which otherwise break DKIM by modifying messages.
- Return-Path / envelope sender
- The hidden address SPF actually checks, distinct from the visible From:. The gap between the two is why alignment exists.
- Bulk sender
- Under Gmail's and Microsoft's rules, a domain sending more than 5,000 messages a day to their users. Counted daily, so a single campaign can qualify you.
- Spam complaint rate
- The proportion of recipients marking your mail as spam. Gmail requires this to stay below 0.3%.
- Transactional email
- Mail a recipient is expecting: receipts, resets, confirmations. Worth keeping separate from marketing so one can't damage the other.
- Warm-up
- Gradually increasing volume from a new domain or IP so receivers build a reputation for it rather than treating a sudden surge as suspicious.
Frequently asked
Which of these actually matter for a small business?
SPF, DKIM, DMARC and MX — the four this site's checker reads. MTA-STS, TLS-RPT and BIMI are worthwhile refinements once the core four are right, and meaningless before that.
What's the difference between deliverability and delivery?
Delivery is whether the receiving server accepted the message. Deliverability is whether it reached the inbox rather than junk. A message can be delivered perfectly and read by nobody.
Is a blocklist the same as failing authentication?
No. Blocklists track sending IP addresses and domains with a history of abuse; authentication is about proving identity. You can fail authentication with a spotless reputation, or pass it while sitting on a blocklist.
Find out where your domain actually stands.
The checker reads your real records in a few seconds. The review works out whether they cover everything you send.