# Email security terms explained

SPF, DKIM and DMARC are DNS records that help receiving servers check that mail claiming to be from your domain really is. S/MIME and PGP encrypt and sign individual mails. Two-step login adds a code after your password, and an app password is a separate password for one mail app.

## Terms

### SPF (Sender Policy Framework)
A DNS record on your domain that lists the servers allowed to send mail for it. A receiving server checks the list and can treat mail from any other server as suspicious. Your administrator or email provider publishes it.

### DKIM (DomainKeys Identified Mail)
A digital signature that the sending server adds to every outgoing mail. The receiving server checks it against a public key published in your domain's DNS. If the signature matches, the mail came from your domain and was not altered on the way.

### DMARC (Domain-based Message Authentication, Reporting and Conformance)
A DNS record that tells receiving servers what to do with mail that fails SPF and DKIM checks: deliver it, send it to spam, or reject it. It can also ask them to send reports back to your domain. Together, SPF, DKIM and DMARC make it much harder for anyone to send fake mail in your organisation's name.

### S/MIME
A standard for signing and encrypting individual mails with a certificate. A signature proves who sent the mail and that nobody changed it. Encryption means only the intended recipients can read it. In XgenPlus your organisation can issue S/MIME certificates to every mailbox, and Outlook, Apple Mail and Thunderbird understand them too.

### PGP (Pretty Good Privacy)
Another way to sign and encrypt mail, using a key pair that you create and manage yourself: a public key you share and a private key protected by a passphrase. XgenPlus can create, store and use PGP keys for you in webmail.

### Two-step login
Also called two-factor authentication or 2FA. After your password, you enter a one-time code that only you can get, such as a code sent to your alternate email. A stolen password alone is then not enough to open your mailbox.

### App password
A separate password that you create for one mail app, such as Outlook on your laptop or the mail app on your phone. The app never learns your main password, and you can revoke one app password without changing anything else.

## Good to know

- SPF, DKIM and DMARC are set up once per domain by your administrator or email provider. Users have nothing to do.
- S/MIME and PGP protect a mail's content. SPF, DKIM and DMARC protect your domain's name.

Source: https://docs.xgenplus.com/security/email-security-glossary/