Proofpoint Email Security Specialist key terms

A DNS TXT record that lists which IP addresses and hosts are authorized to send email for a domain. Receiving systems compare the connecting IP against this list to detect forgery.

A DMARC check requiring the domain in the visible From header to match the domain that passed SPF. Without alignment, an SPF pass does not satisfy DMARC.

A permanent SPF evaluation failure caused by a malformed record, such as exceeding the ten DNS lookup limit. Receivers treat it as no valid policy, so DMARC may fail.

The SPF specification cap of ten DNS-querying mechanisms and modifiers per evaluation. Exceeding it produces a PermError, so records must be flattened or consolidated.

A cryptographic signature added to outgoing messages by the sending domain. Receivers verify it against a public key published in DNS to confirm the message was authorized and unaltered in transit.

The label that identifies which public key record to query, appearing as s= in the signature and as a DNS name like selector._domainkey.example.com. Rotating selectors limits key compromise exposure.

The practice of periodically replacing DKIM signing keys and publishing new DNS records. Old selectors stay published until in-flight mail is delivered, then are removed.

A DMARC requirement that the d= signing domain correspond to the From header domain, either exactly or at the organizational level. A valid signature from an unrelated domain does not satisfy it.

A digest of the canonicalized message body stored in the DKIM signature (bh= tag). If the body changes after signing, the recomputed hash mismatches and verification fails.

The normalization rules applied to headers and body before DKIM signing and verification, so minor transport changes do not break signatures. Common modes are relaxed and simple.

A policy framework that ties SPF and DKIM results to the visible From domain and tells receivers what to do with unauthenticated mail: none, quarantine, or reject. It also defines aggregate and forensic reporting.

The p= tag in a DMARC record that instructs receivers how to handle failing messages. Values are none for monitoring only, quarantine for spam folder, and reject for outright refusal.

The sp= tag that sets a separate handling policy for subdomains of the record's domain. When absent, subdomains inherit the main p= value.

A DMARC record setting expressing the percentage of failing messages to which the policy applies. Lower values let administrators phase in enforcement gradually while watching reports.

A periodic XML summary sent by receivers to addresses in the rua= tag. It shows per-source message counts and SPF/DKIM pass or fail results for a reporting domain.

A near-real-time failure notice sent to ruf= addresses, typically including header excerpts and the failing source. Privacy concerns mean many receivers send few or none.

The registrable base domain plus its public suffix, such as example.com rather than mail.example.com. DMARC relaxed alignment compares domains at this level.

An alignment mode in DMARC where the authenticated domain only needs to share the organizational domain with the From domain. Strict alignment instead demands an exact match.

The address given in SMTP MAIL FROM, which receives bounces and is the domain SPF is evaluated against. It may differ from the visible From header.

The address a recipient actually sees in their mail client. DMARC alignment is judged against this domain, making it the key target for brand impersonation.

An attack that uses a trusted name in the friendly-name field while the underlying address belongs to someone else. Recipients see the familiar name and overlook the real domain.

A registered domain that imitates a legitimate brand through typos, character substitution, or added words. It is used to host phishing pages and send convincing mail.

Fraud in which an attacker poses as an executive, vendor, or colleague to trick staff into payments or data disclosure. Messages often carry no malware or links, defeating content-only filters.

Detection logic that compares sender identity attributes against known internal and partner identities to flag messages claiming to be from a trusted person or brand.

A BEC variant where attackers impersonate a supplier, often redirecting payment to a new account. Detection relies on sender identity checks and unusual payment-change language.

Replacing links in a delivered message with a link pointing to a protection service that checks the destination at click time. It allows blocking after delivery if a page turns malicious.

Evaluating a link's destination when the user clicks rather than when the message arrives. This catches weaponized pages that were benign during initial scanning.

Detonating attachments in an isolated environment to observe behavior such as process creation, network callbacks, or file drops. Verdicts feed policy actions like quarantine or strip.

The final action applied to a message, such as deliver, quarantine, discard, or route to an alternate folder. Dispositions are driven by policy matches and threat verdicts.

A search interface that queries retained message metadata and content using structured filters like sender, recipient, subject, and verdict. It supports investigation without full mailbox access.

A record of the delivery path and processing events for a message, showing each hop, filter decision, and final disposition. It is the primary tool for proving what happened to a specific email.

A holding area for messages judged suspicious or policy-violating, preventing delivery until released or expired. End users or administrators may review and release items depending on configuration.

A legitimate message incorrectly classified as malicious or blocked by policy. Reducing these requires tuning rules and reviewing quarantine releases for patterns.

A configured set of senders, domains, or IPs whose mail bypasses certain filtering or blocking rules. Overuse weakens protection, so entries should be narrowly scoped and reviewed.

A configured set of senders, domains, IPs, or URLs whose mail is denied or quarantined regardless of other scoring. It is used to enforce known-bad indicators.

A technique that strips active content from attachments and rebuilds a safe version before delivery. It neutralizes exploits while preserving the document's usable appearance.

Transport Layer Security encrypts SMTP sessions between mail servers. Policy can require TLS for specific domains or routes and flag messages that arrive unencrypted.

Assigning administrative permissions by job function rather than individual accounts. It limits who can change policies, release quarantined mail, or view sensitive reports.

A chronological record of administrative and user actions such as policy edits, logins, and quarantine releases. It supports compliance review and investigation of insider misuse.