Glossary

49 terms you meet on result pages, each in one or two sentences with the tool that shows it and the guide that explains it.

A record: The DNS record that maps a name to an IPv4 address. A name can have several, and resolvers pick among them.; Check it → Read more →
AAAA record: The IPv6 equivalent of an A record. A site with only A records is unreachable over IPv6-only networks.; Check it → Read more →
AS number (ASN): The number identifying an autonomous system, a network under one administration that announces IP prefixes to the internet. Knowing the ASN tells you who really operates an address.; Check it → Read more →
Authoritative nameserver: A server that holds the zone for a domain and answers with the AA flag. Recursive resolvers ask these; you configure them at the registrar.; Check it → Read more →
AXFR (zone transfer): The DNS operation a secondary server uses to copy a whole zone from the primary. Left open to anyone, it hands an attacker every name in your zone.; Check it → Read more →
BIMI: Brand Indicators for Message Identification: a DNS record pointing at your logo, shown by some mailbox providers next to mail that passes DMARC at enforcement.; Check it → Read more →
Blocklist (DNSBL): A DNS-published list of addresses or domains associated with spam or abuse. Receivers query it during delivery; a listing causes rejections or spam-foldering.; Check it → Read more →
CAA record: Certification Authority Authorization: names the certificate authorities allowed to issue certificates for the domain. Others must refuse.; Check it → Read more →
CIDR prefix: Classless Inter-Domain Routing notation such as 203.0.113.0/24: an address plus the number of leading bits that identify the network.; Check it →
CNAME record: An alias from one name to another. A name with a CNAME may hold no other records, which is why it cannot sit at the zone apex.; Check it → Read more →
DKIM: DomainKeys Identified Mail: a cryptographic signature added by the sending server, verified against a public key in DNS. It survives forwarding, unlike SPF.; Check it → Read more →
DKIM selector: The label that picks which DKIM key to use, appearing in DNS as selector._domainkey.example.co.uk and in the message as s=.; Check it → Read more →
DMARC: A policy record telling receivers what to do when mail using your domain in From: fails both SPF and DKIM alignment, and where to send reports.; Check it → Read more →
DMARC alignment: The requirement that the domain that passed SPF or DKIM matches the From: domain (relaxed: same organisational domain; strict: identical).; Check it → Read more →
DNS propagation: The period after a change during which resolvers still serve the old answer from cache. It lasts up to the old record's TTL, not a fixed 24 to 48 hours.; Check it → Read more →
DNS zone: The set of records for a domain and its undelegated subdomains, held on its authoritative nameservers.; Check it → Read more →
DNSSEC: Signatures on DNS records, validated from the root down, so a resolver can tell a forged answer from a real one. Needs a DS record in the parent zone.; Check it → Read more →
DS record: Delegation Signer: a hash of the child zone's key, published in the parent, that links the DNSSEC chain of trust across a delegation.; Check it → Read more →
EPP status codes: Registry flags such as clientTransferProhibited that describe what may currently happen to a domain: transfers, updates, deletion.; Check it → Read more →
Expiry date: The end of the current registration period. Most registries allow a grace period for renewal, after which the domain is suspended and later deleted.; Check it → Read more →
Forward-confirmed reverse DNS: A PTR record whose name resolves back to the same address. Mail receivers treat anything less as no reverse DNS at all.; Check it → Read more →
Glue record: The address of a nameserver, stored in the parent zone, needed when the nameserver's name lies inside the zone it serves.; Check it → Read more →
HSTS: HTTP Strict Transport Security: a response header telling browsers to use HTTPS only for the site for a stated time.; Check it → Read more →
IANA registrar ID: The number ICANN assigns to each accredited registrar of generic top-level domains; shown on RDAP and WHOIS records.; Check it → Read more →
IPS tag: Nominet's identifier for a .uk registrar. Moving a .uk domain is done by changing the tag, not by using an authorisation code.; Check it → Read more →
Lame delegation: A nameserver listed for a zone that does not actually answer authoritatively for it. Resolvers time out or get errors.; Check it → Read more →
MTA-STS: A policy that tells sending servers to require TLS with a valid certificate when delivering to your MX hosts, closing the STARTTLS downgrade gap.; Check it → Read more →
MX record: Names the servers that accept mail for a domain, each with a preference number; lower is tried first.; Check it → Read more →
NS record: Names the authoritative nameservers for a zone. The set at the registrar and the set inside the zone should match.; Check it → Read more →
NXDOMAIN: The DNS answer meaning the name does not exist. For a domain apex it usually means unregistered, undelegated or a removed zone.; Check it → Read more →
Open relay: A mail server that accepts mail from anyone to anyone. Spammers find them within hours and blocklists follow.; Check it → Read more →
PTR record: The reverse-DNS record mapping an address back to a name, held by whoever controls the address block.; Check it → Read more →
RDAP: Registration Data Access Protocol: the structured JSON successor to WHOIS, with consistent fields and explicit redaction notices.; Check it → Read more →
Recursive resolver: The DNS server your device asks, which walks the hierarchy on your behalf and caches answers. Public examples are 1.1.1.1 and 8.8.8.8.; Check it → Read more →
Registrant: The person or organisation that holds a domain registration. Under UK and EU privacy rules the registry usually withholds their contact details.; Check it → Read more →
Registrar: The company you register a domain through. It holds your account and talks to the registry on your behalf.; Check it → Read more →
Registry: The organisation that operates a top-level domain and its database: Nominet for .uk, Verisign for .com.; Check it → Read more →
Security headers: HTTP response headers such as HSTS, Content-Security-Policy and X-Frame-Options that instruct the browser to refuse classes of attack.; Check it → Read more →
SOA record: Start of Authority: the zone's primary server, contact, serial number and timers. The serial should be identical on every nameserver.; Check it → Read more →
SPF: Sender Policy Framework: a TXT record listing the servers allowed to send mail using your domain in the envelope sender.; Check it → Read more →
SPF ten-lookup limit: Receivers stop evaluating SPF after ten DNS-querying mechanisms and return permerror, which most treat as a failure.; Check it → Read more →
STARTTLS: The SMTP command that upgrades a plain connection to TLS. Opportunistic by default, which is why MTA-STS exists.; Check it → Read more →
Subdomain: Any name beneath a domain, such as shop.example.co.uk. It may be records in the parent zone or a separately delegated zone.; Check it → Read more →
TLS certificate: The document a server presents to prove its identity, issued by a certificate authority and valid for a limited time and a set of names.; Check it → Read more →
TLS-RPT: A DNS record asking senders to report failed TLS connections to your mail servers, usually paired with MTA-STS.; Check it → Read more →
TTL: Time to live: how many seconds a resolver may cache a DNS answer. Lower it before a planned change, raise it afterwards.; Check it → Read more →
TXT record: A free-text DNS record used for SPF, DKIM, DMARC, domain verification and more.; Check it → Read more →
Typosquatting: Registering misspellings or lookalikes of a brand's domain to catch mistyped traffic or to send convincing phishing.; Check it →
WHOIS: The original text protocol for registration data, port 43. Being replaced by RDAP; Nominet retires its WHOIS in February 2027.; Check it → Read more →