CC-CEM key terms

A DNS record that tells sending servers which host receives mail for a domain, ordered by preference value so traffic can fail over to a backup gateway.

A routing design where some recipients' mail is delivered to an on-premises server while other mail goes straight to a cloud mailbox, based on address or policy rules.

A migration technique where each incoming message is delivered to both the legacy and the cloud mailbox simultaneously, letting users be cut over gradually without losing mail.

A state in which two mail systems operate at once and share a single namespace, requiring synchronized directories, shared routing, and consistent address policies.

Continuous replication of user, group, and contact objects from an on-premises identity source into the cloud tenant so both systems resolve the same recipients.

A server or service that accepts messages from senders and forwards them to the next hop, commonly used for device alerts and applications that cannot authenticate directly.

A configured rule set that controls mail flow between two systems, defining which hosts or domains it applies to and how TLS and authentication are handled.

A policy evaluated on messages in transit that can add disclaimers, redirect, block, or modify mail based on sender, recipient, subject, attachment, or classification conditions.

A mailbox or address that receives copies of all or selected messages for archival and legal purposes, independent of what the user does with the original.

A DNS TXT record listing the hosts authorized to send mail for a domain, plus a qualifier that tells receivers whether to soft-fail, hard-fail, or neutralize unauthorized senders.

The ceiling of ten DNS-querying mechanisms and modifiers permitted during one SPF evaluation, beyond which receivers return a permerror and the check effectively fails.

Replacing include and redirect mechanisms in an SPF record with the resolved IP addresses so evaluation needs fewer DNS lookups and stays under the limit.

A signing scheme that adds a cryptographic signature and a selector-based public key in DNS, letting receivers verify that signed headers and body were not altered in transit.

The label in a DKIM signature that tells the verifier which DNS name holds the public key, allowing multiple active keys and painless key rotation.

A digest of the canonicalized message body recorded in the DKIM signature; any mismatch with the received body causes the signature to fail verification.

The normalization rules applied to headers and body before DKIM signing and verification so that harmless transport changes such as whitespace or line-ending edits do not break the signature.

A DNS policy record that ties SPF and DKIM results to the visible From domain and instructs receivers how to handle mail that fails both checks.

The requirement that the domain passing SPF or DKIM match the From header domain, either exactly in strict mode or as an organizational-domain parent in relaxed mode.

The registered parent domain plus its public suffix, used by relaxed alignment so subdomains can inherit the policy and authentication reputation of the main brand domain.

A periodic XML summary sent to the address in a DMARC record that shows per-source message counts, authentication results, and disposition so owners can find unauthorized senders.

A per-message failure report requested in a DMARC record that includes header details or samples of failed mail, though many receivers send few or none for privacy reasons.

A set of seal headers that let intermediaries such as forwarders and mailing lists record authentication results and preserve them across hops that would otherwise break SPF and DKIM.

Authentication failure caused by a legitimate intermediary re-sending a message from a new IP or altering the body, so SPF and DKIM no longer match the original domain.

A registered domain that imitates a brand through character substitution, added words, or a different top-level domain, often used to host phishing sites or send deceptive mail.

A filter that detects display-name spoofing, similar domains, and mailbox-name tricks by comparing sender attributes against protected users, brands, and partner domains.

Business email compromise: a low-volume, text-only attack in which a criminal poses as an executive, vendor, or colleague to trigger a payment or credential disclosure.

A scheme where an attacker convinces finance staff to change bank details or release funds, often by hijacking or mimicking a real supplier conversation thread.

An attack that injects a reply into an existing conversation, using a compromised mailbox or forged headers, so the request appears to continue a trusted discussion.

Opening a suspicious link in an isolated sandbox browser to observe redirects, credential-harvesting pages, and payload downloads before the user can click it.

Re-checking a link at the moment the user clicks it, rather than only at delivery, so pages weaponized after the message arrived are still blocked.

Executing files in an instrumented virtual environment to watch for malicious behavior such as process injection, macro execution, or outbound callbacks before release.

Rules that hold suspicious messages outside the inbox and let administrators or recipients review, release, or delete them, with configurable retention and notification.

A legitimate message or link that a filter classifies as malicious, causing blocked business mail and requiring tuning, allow lists, or admin release.

An administrator-managed list of senders, domains, URLs, or files that overrides automated filtering verdicts, applied before or after the standard evaluation path.

Controls that limit recipients per message and per day, detect compromised accounts sending bulk mail, and route suspicious senders to review or block.

Unauthorized use of valid credentials, often detected through anomalous sign-in location, new inbox rules, or a sudden spike in outbound mail to external recipients.

A rule set that inspects content for sensitive information types and then blocks, encrypts, warns, or audits the message and its attachments.

A pattern definition, often a regular expression plus checksum or keyword context, that identifies data such as card numbers, national IDs, or bank accounts.

A DLP technique that hashes a customer-supplied list of real records, such as employee IDs, so only those exact values trigger a policy and false positives drop.

An inline notice shown to the sender in the mail client explaining that content matched a DLP rule and what action, such as removing recipients, is required.

A capability that wraps a message and its attachments so only the intended recipient can open them, often through an identity provider or a one-time passcode.

Persistent protection that travels with a file or message and enforces who may view, forward, print, or copy it, even after delivery outside the organization.

The requirement that stored and processed mailbox data remain within a specified country or region, shaping tenant creation, migration timing, and feature availability.

A tenant configuration that places selected users' mailbox data in a chosen satellite region while keeping a single directory and administration experience.

The logical perimeter within which customer content and diagnostic data are stored and processed, used to demonstrate compliance with regional commitments.

A privacy request from an individual to access, correct, export, or delete their personal data, which administrators must locate and fulfill within a legal deadline.

A preservation order that keeps mailbox and site content, including deleted and edited items, from being purged while an investigation or litigation is pending.

Rules that define how long content is kept and what happens afterwards, such as delete, retain, or retain-then-delete, applied by location or label.

An authentication model where accounts exist both on-premises and in the cloud, synchronized and validated by a shared sign-in authority such as federation or password hash sync.

Policy that grants or blocks access based on signals such as user, device state, location, and risk, commonly enforcing multifactor authentication for mail protocols.

Older mail protocols that submit only a username and password, cannot perform multifactor authentication, and are therefore a common target for password spray attacks.

A registered client that requests scoped, delegated, or application permissions to read mail or files through an API, subject to admin consent and review.

A searchable record of administrative and user actions, such as mailbox permission changes and message traces, retained for a fixed period for investigations.

A lookup that follows a specific message through the service, showing each hop, filter verdict, and delivery or failure event with timestamps.

Review of mailbox forwarding and deletion rules created by users or attackers, a key signal of compromise because rules hide replies and exfiltrate copies.

A one-step move of all mailboxes to the cloud in a short window, suited to small organizations with a single mail system and simple routing.

A migration that moves batches of mailboxes over time while keeping a routing path between the old and new systems, using synchronized users and shared address space.

Assignment of administrative permissions through predefined or custom roles scoped to objects, so staff get only the rights their job requires.

The practice of granting the minimum permissions and time needed for a task, reducing the blast radius of a mistaken change or stolen admin credential.