Glossary
Glossary
The terms behind DomainWarn findings, explained in plain language: how each one works, what can go wrong, how to prevent it and how DomainWarn checks it.
42 terms
A
B
- BIMIBrand Indicators for Message IdentificationBIMI is a DNS record that lets mail clients show your brand logo next to authenticated messages, provided DMARC is enforced.
- BlocklistDNSBL / RBLA blocklist is a DNS-queryable list of IP addresses or domains that have been caught sending spam, hosting malware or otherwise abusing mail.
C
- CAA recordCertification Authority AuthorizationA CAA record is a DNS entry that names the certificate authorities allowed to issue TLS certificates for your domain; all others must refuse.
- Cache poisoningDNS cache poisoningCache poisoning tricks a DNS resolver into caching a forged answer, which it then serves to every user who asks for that name.
- Certificate chainchain of trustThe certificate chain links a server certificate through one or more intermediates to a root certificate that browsers and mail servers trust.
- Certificate TransparencyCT logsCertificate Transparency is a set of public, append-only logs in which certificate authorities record every publicly trusted certificate.
- Content Security PolicyCSPContent Security Policy is an HTTP header that defines which sources a browser may load scripts, styles, images and frames from on a page.
- Cookie consentconsent before trackingCookie consent means a website asks visitors for permission before it sets non-essential cookies or loads any tracking and marketing services.
- Core Web VitalsLCP, INP and CLSCore Web Vitals are three Google metrics for how fast a page loads (LCP), how quickly it responds (INP) and how visually stable it stays (CLS).
D
- DANEDNS-based Authentication of Named EntitiesDANE uses a TLSA record in DNSSEC-signed DNS to pin the certificate your mail server must present before senders will deliver over TLS.
- DKIMDomainKeys Identified MailDKIM adds a cryptographic signature to outgoing mail so receivers can use a public key in DNS to verify it is genuine and unaltered.
- DMARCDomain-based Message Authentication, Reporting and ConformanceDMARC is a DNS record telling receivers what to do with mail whose visible sender is not confirmed by SPF or DKIM, and where to send reports.
- DNS spoofingDNS spoofing means feeding forged DNS answers to a client or resolver so that visitors or mail servers end up at an IP address the attacker controls.
- DNSSECDomain Name System Security ExtensionsDNSSEC cryptographically signs the records in a DNS zone so that validating resolvers can detect and discard forged or tampered answers.
- Domain expiryexpiration of the domain registrationDomain expiry is the end of the paid registration term, after which website and email stop working and the name may eventually be released.
E
G
H
- Heartbeatmonitoring for cron jobs and backupsA heartbeat is a regular check-in that a cron job, backup or import sends to a monitor after every run, so that a missing run gets noticed.
- HSTSHTTP Strict Transport SecurityHSTS is an HTTP response header that tells browsers to load a website exclusively over HTTPS for a defined period of time.
- HTTP/3HTTP over QUICHTTP/3 is the third major version of HTTP, running over QUIC on UDP instead of TCP to set up connections faster and cope better with packet loss.
I
L
M
- Mixed contentinsecure resources on HTTPS pagesMixed content means a page served over HTTPS pulls in scripts, stylesheets, images or other resources unencrypted over plain http:// instead.
- MTA-STSSMTP MTA Strict Transport SecurityMTA-STS is a standard (RFC 8461) that lets your domain require sending mail servers to deliver only over TLS with a valid certificate.
- MX recordMail ExchangerAn MX record tells the world which mail servers accept email for a domain and in which order sending servers should try them.
N
O
- OCSPOnline Certificate Status ProtocolOCSP is a protocol clients use to ask the certificate authority whether a certificate has been revoked before its expiry date.
- Open portsservices reachable from the internetOpen ports are network services on a server that accept connections from anywhere on the internet, such as a database, remote desktop access or FTP.
- Open relayAn open relay is a mail server that accepts mail from any sender without authentication and forwards it to any outside recipient.
P
R
- Redirect chainmultiple redirects in a rowA redirect chain is when a URL reaches its final destination not directly but through several HTTP redirects in a row, each adding another round trip.
- Registrar locktransfer lockA registrar lock is a domain status that blocks transfers to another registrar until the owner deliberately removes the lock again.
- Reverse DNSPTR recordReverse DNS maps an IP address back to a hostname through a PTR record, and mail servers use it to judge whether a sending server is properly named.
S
- security.txtsecurity contact file per RFC 9116security.txt is a plain-text file defined in RFC 9116 that tells security researchers how to report a vulnerability they found on a domain.
- SMTP TLSTransport encryption between mail serversSMTP TLS is the transport encryption between mail servers, and how well it protects depends on the receiving server's certificate and TLS version.
- SPFSender Policy FrameworkSPF is a DNS TXT record that lists which servers may send mail using your domain in the return path, as defined in RFC 7208.
- SSL/TLS certificateX.509 server certificateAn SSL/TLS certificate proves that a server is entitled to a hostname and makes encrypted connections over HTTPS or STARTTLS possible.
- STARTTLSSTARTTLS is an SMTP command (RFC 3207) that upgrades a mail connection which starts in plain text to TLS on the same port.
- Subdomain takeovertakeover via dangling DNS recordsA subdomain takeover happens when an outsider claims a subdomain whose DNS record still points to a deleted service or a released address.