Glossary

Email privacy terms defined in plain language: encryption, sender authentication, DNS records, aliases, and the header fields every message carries.

A

Authentication-Results Header headers #

The header a receiving server adds to record the outcome of its SPF, DKIM and DMARC checks, for example spf=pass, dkim=pass and dmarc=pass. It is the first place to look when a message might be spoofed: when all three pass and align with the From domain, the message very likely came from who it claims.

C

Catch-All aliases #

A setting that delivers mail sent to any address at a domain or subdomain, including addresses you never created. It is what lets you invent an alias at a signup form and have it work on the first message, as addy.io standard aliases and custom domains at alias services and paid encrypted providers do. The side effect is that addresses guessed by spammers arrive too, until you switch those aliases off.

D

DKIM (DomainKeys Identified Mail) authentication #

A signature the sending provider adds to outgoing mail, checked against a public key published in the sender's DNS. A valid signature shows the message came from that domain and was not altered in transit. On a custom domain at Proton Mail, DKIM takes three CNAME records, and all three have to be added.

DMARC authentication #

Domain-based Message Authentication, Reporting and Conformance: a TXT record at the _dmarc host that ties SPF and DKIM to the domain in the visible From line and tells receivers what to do with mail that fails. p=none only monitors, p=quarantine sends failures to spam, and p=reject refuses them. A dmarc=pass result is the strongest single header signal that a message is genuine.

E

Email Alias aliases #

A forwarding address that delivers to your real inbox without revealing it. Senders only see the alias, and you can switch off a single alias when it starts attracting spam or turns up in a breach. Aliases are pseudonymous, not anonymous: the alias service keeps the record of which account owns each alias and can be compelled to hand it over.

See also: Reverse Alias, Catch-All, Metadata

Encryption at Rest encryption #

Encryption of mail while it is stored on the provider's disks. It defeats someone who walks off with the storage media, but when the provider holds the keys, as Google does for Gmail, the provider can still decrypt the mailbox and can be compelled to. Always ask who holds the key.

End-to-End Encryption (E2EE) encryption #

Encryption applied on the sender's device and removed only on the recipient's, so no server in between, including the mail provider, can read the body. Mail between two Proton users or two Tuta users is end-to-end encrypted by default; mail to an ordinary provider needs PGP or a password-protected message. It protects the body and attachments, not the envelope.

M

Message-ID headers #

A unique identifier the sending system stamps on every message. Replies point back to it through the In-Reply-To and References headers, which is how mail clients build threads, and it can be used to correlate one message across several mailboxes.

O

OpenPGP encryption #

The open standard behind PGP email encryption. Each user has a key pair: the public key encrypts mail to you and verifies your signatures, and the private key decrypts and signs. GnuPG is the common free implementation. Proton Mail is built on OpenPGP, which is why Proton users can exchange encrypted mail with any PGP user; Tuta uses its own scheme instead.

R

Received Header headers #

A line each mail server adds as it handles a message, recording where the message came from, where it went and when. Read them bottom to top: the lowest Received header is the origin and usually carries the sending server's IP address, which is how you trace a message's real path.

Reverse Alias aliases #

The routing address an alias service uses so you can reply through an alias. When you reply to a forwarded message, the reply goes back through the service, which rewrites the sender so the other party sees your alias instead of your real address. SimpleLogin includes replies on its free plan; addy.io reserves them for paid plans.

S

S/MIME encryption #

Secure/Multipurpose Internet Mail Extensions: a certificate-based standard for encrypting and signing email, common in corporate mail, where both sides need certificates. In Gmail it is a Google Workspace feature, and in its hosted form the private key is uploaded to Google, so it protects mail from outsiders and the recipient's provider but not from Google.

SPF (Sender Policy Framework) authentication #

A TXT record listing the servers allowed to send mail for a domain. Receivers check it and record spf=pass, fail or softfail in the Authentication-Results header. A domain may have only one SPF record, so adding a new provider means merging its include: into the existing record rather than publishing a second one.

T

TLS and STARTTLS encryption #

Transport Layer Security encrypts the connection between two mail servers, or between your app and your provider. Between servers it is negotiated with the STARTTLS command and is opportunistic: when the other server does not support it, mail silently falls back to plaintext. TLS protects the pipe, not the message, which is decrypted at the servers on each end.

W

Web Key Directory (WKD) encryption #

A standard that lets a domain publish its users' OpenPGP public keys at a well-known HTTPS path, so mail clients can find them automatically with no keyserver or manual import. Proton publishes a key for every account through WKD and checks WKD when you address an outside recipient.

Z

Zero-Access Encryption encryption #

Storage encryption where the provider keeps your mail in a form it cannot later decrypt. Proton applies it to stored message bodies and attachments, including mail that arrived unencrypted from outside. It is not end-to-end encryption: an incoming external message can be processed before it is encrypted for storage, and fields such as the subject stay readable to the provider.