Authentication

• ARC (Authenticated Received Chain)

  RFC 8617 reference — the three ARC header fields, instance and chain-validation tags, sealing and validation rules, and how receivers use an intact chain to override DMARC failures caused by forwarding.

• BIMI (Brand Indicators for Message Identification)

  Implementing BIMI — DMARC enforcement prerequisites, the BIMI DNS record, SVG Tiny PS logo requirements, VMC/CMC certificates, and mailbox-provider support.

• DKIM (DomainKeys Identified Mail)

  RFC 6376 reference plus RFC 8301 (rsa-sha256 required, 1024–4096-bit keys) and RFC 8463 (ed25519-sha256) — signature and key record syntax, tag meanings, canonicalization, signing scope, and risks.

• DKIM Key Rotation

  M3AAWG DKIM Key Rotation BCP (rev. March 2019) — semiannual rotation cadence, selector naming schemes, the two-live-keys workflow, p= retirement, CNAME/subdomain delegation for third parties, and rotation auditing.

• DKIM Replay Attacks

  The DKIM replay problem (draft-ietf-dkim-replay-problem) — how one legitimately signed message gets resent to millions, why l=/x= don't fix it, current mitigations and their tradeoffs, and what it means for ESP infrastructure.

• DKIM2 (in-progress IETF work)

  The IETF DKIM WG redesign of DKIM — per-hop chained signatures bound to the SMTP envelope, documented modifications ("recipes"), authenticated bounces, replay resistance — with WG status as of July 2026. NOT a published standard.

• DMARC (Domain-based Message Authentication, Reporting, and Conformance)

  What DMARC does and doesn't do, how it builds on SPF and DKIM, domain alignment, the DNS record, and choosing a handling policy.

• DMARC Aggregate Reports (RFC 9990)

  The XML aggregate feedback format — report structure, transport, filename and subject conventions, external-destination verification, and policy-override reasons.

• DMARC Deployment in Depth

  Operational DMARC deployment — full tag reference, subdomain policy, pct sampling, alignment strictness, report processing, forwarding/mailing-list failure modes, and the none→quarantine→reject rollout.

• DMARC Failure Reports (RFC 9991)

  Per-message DMARC failure ("forensic") reports — ARF format, required fields, the ruf/fo tags, privacy constraints, and why few providers send them.

• DMARC Standard Reference (RFC 9989 / DMARCbis)

  The standards-track DMARC spec that obsoletes RFC 7489 — full record tag registry, the DNS Tree Walk replacing the Public Suffix List, alignment rules, policy discovery, and what changed.

• SPF (Sender Policy Framework)

  RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls.

• The Authentication-Results Header

  RFC 8601 reference — syntax of the header receivers use to record SPF/DKIM/DMARC/iprev results, ptypes and properties, method result codes, and how to read one.