# What do all these email deliverability terms mean? _Not the Junk Folder — Scott Anderson. Last reviewed 4 August 2026._ ## Short answer Email deliverability has three core records — SPF (who may send as you), DKIM (a signature proving the message is unaltered) and DMARC (what to do when those fail, plus reporting) — surrounded by supporting vocabulary: alignment, selectors, aggregate reports, MTA-STS, BIMI and ARC. Every term below is defined in one or two sentences. ## Key facts - SPF, DKIM and DMARC are open standards published as RFCs 7208, 6376 and 7489 — not products anyone sells. [RFC 7489 (DMARC)](https://www.rfc-editor.org/rfc/rfc7489) - ARC (RFC 8617) exists to preserve authentication results across intermediaries like mailing lists. [RFC 8617 (ARC)](https://www.rfc-editor.org/rfc/rfc8617) ## The three records - **SPF (Sender Policy Framework)** — A DNS record listing the servers and services permitted to send email using your domain. Breaks when mail is forwarded, and is limited to ten DNS lookups. - **DKIM (DomainKeys Identified Mail)** — A cryptographic signature added to each outgoing message, verified against a public key in your DNS. Survives forwarding, unlike SPF. - **DMARC (Domain-based Message Authentication, Reporting and Conformance)** — Ties SPF and DKIM to the visible From: domain, tells receivers what to do when both fail, and requests reports on mail sent in your name. ## How they're evaluated - **Alignment** — The requirement that the domain SPF or DKIM authenticated matches the domain in the From: address your recipient sees. Without it, a spammer could pass SPF for their own domain while displaying yours. - **Selector** — The label identifying which DKIM key signed a message, published at selector._domainkey.yourdomain. Selectors can't be enumerated from outside — you can only guess common names. - **Soft fail (~all)** — The SPF instruction to treat unlisted senders as suspicious but still accept them. The usual starting position. - **Hard fail (-all)** — The SPF instruction to reject unlisted senders. Correct once you're certain every legitimate sender is listed. - **Neutral (?all)** — No opinion at all about unlisted senders. Equivalent to publishing nothing, and rarely what anyone intends. - **permerror** — A permanent SPF error — two records, a syntax problem, or more than ten lookups. Receivers discard the whole record. - **Policy (p=)** — The DMARC instruction: none (monitor only), quarantine (send to junk) or reject (refuse outright). - **pct=** — The percentage of failing mail your DMARC policy is applied to. A value below 100 usually means a rollout that was never finished. ## Reporting - **rua=** — The address receiving daily aggregate DMARC reports. Without it, a DMARC record tells you nothing. - **ruf=** — The address for forensic reports on individual failed messages. Many providers don't send these, for privacy reasons. - **Aggregate report** — A daily XML summary from a receiving provider listing every source that sent mail claiming to be your domain, and whether it authenticated. - **Postmaster Tools** — Google's free dashboard showing your spam complaint rate, authentication results and domain reputation for mail sent to Gmail. ## The supporting cast - **MX record** — Where your incoming mail is delivered. Stale MX records left over from a migration are a common and under-rated security problem. - **PTR / reverse DNS** — A record mapping a sending IP address back to a hostname. Required by Gmail, and handled for you by any reputable sending platform. - **MTA-STS** — A policy declaring that mail to your domain must be delivered over TLS, closing off downgrade attacks. Optional, and a mark of a well-run domain. - **TLS-RPT** — Reporting on failed TLS connections to your domain. Pairs with MTA-STS. - **BIMI** — Displays your logo beside authenticated messages in supporting clients. Requires DMARC at quarantine or reject first, so it's a reward for finishing the work, not a shortcut. - **ARC** — Authenticated Received Chain: preserves authentication results across intermediaries such as mailing lists, which otherwise break DKIM by modifying messages. - **Return-Path / envelope sender** — The hidden address SPF actually checks, distinct from the visible From:. The gap between the two is why alignment exists. - **Bulk sender** — Under Gmail's and Microsoft's rules, a domain sending more than 5,000 messages a day to their users. Counted daily, so a single campaign can qualify you. - **Spam complaint rate** — The proportion of recipients marking your mail as spam. Gmail requires this to stay below 0.3%. - **Transactional email** — Mail a recipient is expecting: receipts, resets, confirmations. Worth keeping separate from marketing so one can't damage the other. - **Warm-up** — Gradually increasing volume from a new domain or IP so receivers build a reputation for it rather than treating a sudden surge as suspicious. ## Frequently asked ### Which of these actually matter for a small business? SPF, DKIM, DMARC and MX — the four this site's checker reads. MTA-STS, TLS-RPT and BIMI are worthwhile refinements once the core four are right, and meaningless before that. ### What's the difference between deliverability and delivery? Delivery is whether the receiving server accepted the message. Deliverability is whether it reached the inbox rather than junk. A message can be delivered perfectly and read by nobody. ### Is a blocklist the same as failing authentication? No. Blocklists track sending IP addresses and domains with a history of abuse; authentication is about proving identity. You can fail authentication with a spotless reputation, or pass it while sitting on a blocklist. ## Related - https://notthejunkfolder.com/guides/spf-dkim-dmarc-explained - https://notthejunkfolder.com/guides/dmarc-p-none - https://notthejunkfolder.com/guides/why-emails-go-to-spam --- Not the Junk Folder reviews small business email configuration — SPF, DKIM, DMARC and MX — and fixes what's broken. Free domain checker at https://notthejunkfolder.com/#check. Contact: hello@notthejunkfolder.com.