MailMum Glossary

Abuse

Abuse in email systems is the use of email, or of the infrastructure that carries it, for malicious or unlawful purposes: spam, phishing, malware, forged senders, and attacks against the mail servers themselves. It is the umbrella term for everything an abuse desk has to deal with.

One thing matters more than the definition: abuse is judged by the receiving side. It does not help that you consider your own bulk mail legitimate. If enough recipients complain, receiving systems treat the traffic as abuse and your IP address becomes subject to IP blacklisting.

Abuse Desk

An abuse desk is the team, or in smaller organisations the single person, that handles reports about abuse originating from an organisation’s own network, IP ranges or customer accounts. Every ISP, ESP and hosting provider is expected to run one and to publish a way of reaching it.

The abuse desk is the counterpart to the mailbox you write to when a server under someone else’s control sends you spam or phishing. It is not a customer support channel — it exists so that outsiders can report a provider’s own customers to that provider.

Abuse Reporting Format (ARF)

The Abuse Reporting Format (ARF) is a standardised, machine-readable format for reporting email abuse between providers. It is defined in RFC 5965 and is the format in which almost every feedback loop delivers its complaints.

An ARF report is itself an email message. What makes it machine-readable is a MIME part of type message/feedback-report that carries the facts of the incident — source IP, envelope sender, arrival time, type of complaint — as structured fields instead of prose.

Acceptable Use Policy (AUP)

An acceptable use policy (AUP) is the document that defines what a provider’s customers, or an organisation’s users, are and are not allowed to do with a system, network or email service. For anyone operating mail infrastructure it is the rule set that gives an abuse desk the authority to act on a complaint.

Without one, every abuse case turns into a negotiation. With one, suspending a compromised account or terminating a customer who sends spam is simply the enforcement of a term they already agreed to.

Access Control List (ACL)

An access control list (ACL) is an ordered list of rules that decides who may do what with a resource. Each rule matches on something — an IP address, an authenticated user, a sender domain — and produces a verdict: allow, deny, or continue to the next rule.

In email systems the term appears in three different places that are easy to confuse: the SMTP-level rules that decide whether a connection or a message is accepted, the mailbox-level permissions that decide who may read a shared folder, and the packet filter on the host itself.

Access Management in E-Mail Systems

Access management in email systems is the practice of controlling who may connect to a mail server, who may send through it, and who may read which mailbox. It covers three separate questions that are often treated as one:

Who may deliver mail to us? Inbound access, controlled at the SMTP connection by ACLs and blocklists.
Who may send mail through us? Outbound access, controlled by SMTP authentication on the submission service.
Who may read this mailbox? Mailbox access, controlled by IMAP/POP authentication and per-folder permissions.

Getting the second one wrong is what turns a mail server into a source of abuse. Getting the third one wrong exposes mail; getting the first wrong mostly means more spam in the inbox.

Anycast Routing

Anycast routing is a technique in which the same IP address is announced from several locations at once, and the routing system delivers each packet to whichever of those locations is nearest in network terms. The sender addresses one IP; which machine actually answers depends on where the sender is.

“Nearest” here means nearest according to BGP, not geographically. A user in Vienna may well be served by a node in Frankfurt rather than one in Bratislava, because the path through Frankfurt is shorter in AS hops.

Application Programming Interface (API)

An API (Application Programming Interface) is a defined contract that lets one piece of software use the functionality of another. It specifies which operations exist, what they expect, and what they return — without the caller needing to know how the other side is implemented.

In email systems the term almost always means an HTTP API: a REST or JSON interface used to submit messages, query delivery status, manage suppression lists, or look up reputation data.

Artificial Intelligence (AI)

Artificial intelligence (AI) describes systems that perform tasks normally requiring human judgement — classifying, predicting, generating — by learning patterns from data rather than by following rules a person wrote out in advance.

Email was one of the first mass applications of machine learning, and it remains one of the clearest: spam filtering has used statistical classification since the early 2000s, long before the term AI came back into fashion.

Attack Vector

An attack vector is the route an attacker takes into a system: the specific combination of exposure and technique that turns a weakness into access. It is distinct from the vulnerability itself — the vulnerability is the flaw, the vector is how it gets reached.

Email is the most heavily used attack vector against organisations, for a structural reason: it is the one service that accepts unsolicited input from strangers by design, and it delivers that input to a human being.

Autonomous System Number (ASN)

An autonomous system number (ASN) identifies a network that is operated under a single, consistent routing policy. It is the unit that the Border Gateway Protocol (BGP) uses to route traffic between networks: every route on the internet carries the list of ASNs it passed through.

For email, the relevant point is that the ASN is the largest unit at which a sender can be identified. An IP address can be swapped in minutes and a domain registered in seconds, but an ASN belongs to an organisation with a contract at a Regional Internet Registry — which makes it the level at which reputation is hardest to escape.

Backscatter

Backscatter is the flood of automated replies — bounce messages, out-of-office notices, virus warnings — that arrives at an address which was forged as the sender of mail it never sent.

The victim is not the recipient of the spam. The victim is whoever’s address the spammer put in the envelope sender, because every bounce generated along the way is delivered there.

How does backscatter happen?

The mechanism is a mail server that accepts a message first and only afterwards discovers it cannot deliver it:

Bounce Message or Report

A bounce report, also known as a bounce message or a non-delivery report (NDR), is an automated email message generated by an email server to inform the sender that their email was not delivered to the recipient’s inbox.

Why an email can’t be delivered?

When an email is sent, it is routed through various servers before reaching the intended recipient’s mailbox. If there is a problem with the delivery of the email at any point in this process, such as an incorrect email address, a full mailbox, a blacklisted server, or a blocked email domain, the email may “bounce” back to the sender.

Email Service Provider (ESP)

An Email Service Provider (ESP) is a third-party company that offers email hosting and management services, allowing users to send, receive, and manage emails. ESPs typically provide services by managing email servers and other related systems.

The term is used loosely, and its meaning depends on who you ask — see ESP, mailbox provider or MTA? below, because the distinction matters as soon as you start diagnosing a delivery problem.

Who can be an email service provider?

An Email Service Provider (ESP) can be any person, company or organization that provides email hosting and management services. This can include:

Geofeed

A geofeed is a collection of IP networks accompanied by geolocation information, published as a CSV file over an https link. It lets a network operator state authoritatively where their own address space is actually used, instead of leaving geolocation databases to guess.

The format is standardised in RFC 8805 (the file format itself) and RFC 9092, which defines how to advertise a geofeed through a geofeed: attribute in RIR whois data so that consumers can discover it automatically rather than having the URL passed around informally.

Hostname

A hostname is the human-readable label assigned to a device or server on a network, such as mail.example.com. Hostnames are resolved to IP addresses through the Domain Name System (DNS), and back again through reverse DNS (rDNS) and PTR records.

For a mail server the hostname is not cosmetic. It is the identity the server presents to every other server it talks to, and it is checked.

What makes a hostname fully qualified?

A fully qualified domain name (FQDN) is a hostname that includes every label up to the top-level domain, so it is unambiguous no matter where it is resolved from:

Internet Service Provider (ISP)

An Internet Service Provider (ISP) is a company that provides internet access to customers. It does this by providing a connection to the internet via a network of servers, which allows users to access the web, send emails, and use other internet services. ISPs can be large, national companies or smaller, local providers.

Do ISPs provide email services?

Some Internet Service Providers (ISPs) do offer email services to their customers as part of their internet package. This means that when you sign up for internet service with a particular ISP, you may also be given a unique email address that you can use to send and receive emails. However, not all ISPs offer email services, and you may need to use a separate email provider, to create and manage your email accounts.

IP Block Listing or Blacklisting

IP blacklisting is a technique used by Internet Service Providers (ISPs) and email providers to block or filter incoming messages from IP addresses that have been identified as sources of spam or other malicious activity. By blocking or filtering messages from these IP addresses, ISPs and email providers can help protect their users from spam and other unwanted email.

IP Blacklisting on local systems

IP blacklisting can be applied using configuration files in several different ways, depending on the specific needs of the organization and the type of system that is being used. Here are a few examples of how this might be done:

Mail Transfer Agent (MTA)

A Mail Transfer Agent (MTA) is a software application responsible for the transfer of email messages between computer systems, using SMTP. The MTA is a critical component in the email delivery process, ensuring that messages are routed correctly from the sender to the recipient.

What is the role of an MTA?

The primary role of an MTA is to accept incoming email messages from a client application or another MTA and deliver them to the appropriate recipient. This process involves routing the message through the internet or a local network, resolving any addressing issues, and ensuring that the message is delivered successfully.

Pointer Record (PTR)

A PTR record (Pointer record) is a type of DNS record used to map an IP address to a domain name (e.g. 127.0.0.1 -> localhost). It is the record type that makes reverse DNS (rDNS) lookups possible.

This page covers the record itself — where it lives, how it is constructed, and who controls it. For why a mail server needs one and what happens when it is missing, see reverse DNS (rDNS).

Reverse DNS (rDNS)

Reverse DNS (rDNS) is a technique used to map an IP address to a domain name using a Pointer (PTR) record. It involves querying the DNS system in reverse, starting with the IP address, to retrieve the associated domain name (e.g. 127.0.0.1 -> localhost). Reverse DNS is commonly used for verifying server identities, preventing email spam, and troubleshooting network issues.

For mail servers it is not optional in practice. A missing or mismatched reverse DNS entry is one of the most common reasons an otherwise correctly configured server cannot deliver mail.

Top Level Domain (TLD)

A Top Level Domain (TLD) is the last segment of a domain name, representing the highest level in the domain name system. It typically consists of two or more letters and indicates the purpose or geographical location of a website or entity. Examples include .com, .org, and .net. TLDs help categorize and organize websites on the internet, facilitating easy navigation and identification.

What types of TLD are there?

TLDs fall into two groups that are worth keeping apart, because they are run by different kinds of organisation under different rules: