MailMum Glossary

Abuse

Abuse in email systems is the use of email, or of the infrastructure that carries it, for malicious or unlawful purposes: spam, phishing, malware, forged senders, and attacks against the mail servers themselves. It is the umbrella term for everything an abuse desk has to deal with.

One thing matters more than the definition: abuse is judged by the receiving side. It does not help that you consider your own bulk mail legitimate. If enough recipients complain, receiving systems treat the traffic as abuse and your IP address becomes subject to IP blacklisting.

Abuse Desk

An abuse desk is the team, or in smaller organisations the single person, that handles reports about abuse originating from an organisation’s own network, IP ranges or customer accounts. Every ISP, ESP and hosting provider is expected to run one and to publish a way of reaching it.

The abuse desk is the counterpart to the mailbox you write to when a server under someone else’s control sends you spam or phishing. It is not a customer support channel — it exists so that outsiders can report a provider’s own customers to that provider.

Abuse Reporting Format (ARF)

The Abuse Reporting Format (ARF) is a standardised, machine-readable format for reporting email abuse between providers. It is defined in RFC 5965 and is the format in which almost every feedback loop delivers its complaints.

An ARF report is itself an email message. What makes it machine-readable is a MIME part of type message/feedback-report that carries the facts of the incident — source IP, envelope sender, arrival time, type of complaint — as structured fields instead of prose.

Acceptable Use Policy (AUP)

An acceptable use policy (AUP) is the document that defines what a provider’s customers, or an organisation’s users, are and are not allowed to do with a system, network or email service. For anyone operating mail infrastructure it is the rule set that gives an abuse desk the authority to act on a complaint.

Without one, every abuse case turns into a negotiation. With one, suspending a compromised account or terminating a customer who sends spam is simply the enforcement of a term they already agreed to.

Access Control List (ACL)

An access control list (ACL) is an ordered list of rules that decides who may do what with a resource. Each rule matches on something — an IP address, an authenticated user, a sender domain — and produces a verdict: allow, deny, or continue to the next rule.

In email systems the term appears in three different places that are easy to confuse: the SMTP-level rules that decide whether a connection or a message is accepted, the mailbox-level permissions that decide who may read a shared folder, and the packet filter on the host itself.

Access Management in E-Mail Systems

Access management in email systems is the practice of controlling who may connect to a mail server, who may send through it, and who may read which mailbox. It covers three separate questions that are often treated as one:

Who may deliver mail to us? Inbound access, controlled at the SMTP connection by ACLs and blocklists.
Who may send mail through us? Outbound access, controlled by SMTP authentication on the submission service.
Who may read this mailbox? Mailbox access, controlled by IMAP/POP authentication and per-folder permissions.

Getting the second one wrong is what turns a mail server into a source of abuse. Getting the third one wrong exposes mail; getting the first wrong mostly means more spam in the inbox.

Anycast Routing

Anycast routing is a technique in which the same IP address is announced from several locations at once, and the routing system delivers each packet to whichever of those locations is nearest in network terms. The sender addresses one IP; which machine actually answers depends on where the sender is.

“Nearest” here means nearest according to BGP, not geographically. A user in Vienna may well be served by a node in Frankfurt rather than one in Bratislava, because the path through Frankfurt is shorter in AS hops.

Application Programming Interface (API)

An API (Application Programming Interface) is a defined contract that lets one piece of software use the functionality of another. It specifies which operations exist, what they expect, and what they return — without the caller needing to know how the other side is implemented.

In email systems the term almost always means an HTTP API: a REST or JSON interface used to submit messages, query delivery status, manage suppression lists, or look up reputation data.

Artificial Intelligence (AI)

Artificial intelligence (AI) describes systems that perform tasks normally requiring human judgement — classifying, predicting, generating — by learning patterns from data rather than by following rules a person wrote out in advance.

Email was one of the first mass applications of machine learning, and it remains one of the clearest: spam filtering has used statistical classification since the early 2000s, long before the term AI came back into fashion.

Attack Vector

An attack vector is the route an attacker takes into a system: the specific combination of exposure and technique that turns a weakness into access. It is distinct from the vulnerability itself — the vulnerability is the flaw, the vector is how it gets reached.

Email is the most heavily used attack vector against organisations, for a structural reason: it is the one service that accepts unsolicited input from strangers by design, and it delivers that input to a human being.

Autonomous System Number (ASN)

An autonomous system number (ASN) identifies a network that is operated under a single, consistent routing policy. It is the unit that the Border Gateway Protocol (BGP) uses to route traffic between networks: every route on the internet carries the list of ASNs it passed through.

For email, the relevant point is that the ASN is the largest unit at which a sender can be identified. An IP address can be swapped in minutes and a domain registered in seconds, but an ASN belongs to an organisation with a contract at a Regional Internet Registry — which makes it the level at which reputation is hardest to escape.

Backscatter

Backscatter is the flood of automated replies — bounce messages, out-of-office notices, virus warnings — that arrives at an address which was forged as the sender of mail it never sent.

The victim is not the recipient of the spam. The victim is whoever’s address the spammer put in the envelope sender, because every bounce generated along the way is delivered there.

How does backscatter happen?

The mechanism is a mail server that accepts a message first and only afterwards discovers it cannot deliver it:

Bounce Message or Report

A bounce report, also known as a bounce message or a non-delivery report (NDR), is an automated email message generated by an email server to inform the sender that their email was not delivered to the recipient’s inbox.

Why an email can’t be delivered?

When an email is sent, it is routed through various servers before reaching the intended recipient’s mailbox. If there is a problem with the delivery of the email at any point in this process, such as an incorrect email address, a full mailbox, a blacklisted server, or a blocked email domain, the email may “bounce” back to the sender.

DNS Blocklist (DNSBL / RBL)

A DNS blocklist (DNSBL), historically called a realtime blackhole list (RBL), distributes a list of IP addresses or domains over the DNS protocol. A mail server queries the list during the SMTP connection and decides whether to accept the message before the body has even been transferred.

Using DNS as the transport is what makes this practical: the answer is cached, the query costs a few milliseconds, and no list has to be downloaded or kept in sync. It is the mechanism behind almost all IP blacklisting in production mail systems.

Domain-based Message Authentication, Reporting and Conformance (DMARC)

DMARC ties SPF and DKIM to the From: header the recipient actually sees, tells receiving servers what to do when neither authenticates, and sends the domain owner reports about who is sending mail as their domain.

It is defined in RFC 7489. Without it, SPF and DKIM authenticate identifiers a recipient never looks at, and a message can pass both while displaying any sender address at all.

What does a DMARC record look like?

A TXT record at the _dmarc subdomain:

DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to an outgoing message. The signing domain publishes the matching public key in DNS, so any receiving server can verify that the message really was sent by that domain and that the signed parts have not been altered in transit.

DKIM is defined in RFC 6376. Unlike SPF, it says nothing about which IP address a message came from — which is precisely why it survives forwarding.

Email Queue

An email queue holds messages a mail server has accepted responsibility for but has not yet delivered. Because SMTP delivery is asynchronous — the destination may be unreachable, slow, or temporarily refusing — every MTA needs somewhere to keep a message between acceptance and delivery.

Once a server has answered 250 at the end of DATA, it has promised to deliver the message or to tell the sender why it could not. The queue is where that promise lives.

Email Service Provider (ESP)

An Email Service Provider (ESP) is a third-party company that offers email hosting and management services, allowing users to send, receive, and manage emails. ESPs typically provide services by managing email servers and other related systems.

The term is used loosely, and its meaning depends on who you ask — see ESP, mailbox provider or MTA? below, because the distinction matters as soon as you start diagnosing a delivery problem.

Who can be an email service provider?

An Email Service Provider (ESP) can be any person, company or organization that provides email hosting and management services. This can include:

Geofeed

A geofeed is a collection of IP networks accompanied by geolocation information, published as a CSV file over an https link. It lets a network operator state authoritatively where their own address space is actually used, instead of leaving geolocation databases to guess.

The format is standardised in RFC 8805 (the file format itself) and RFC 9092, which defines how to advertise a geofeed through a geofeed: attribute in RIR whois data so that consumers can discover it automatically rather than having the URL passed around informally.

Hostname

A hostname is the human-readable label assigned to a device or server on a network, such as mail.example.com. Hostnames are resolved to IP addresses through the Domain Name System (DNS), and back again through reverse DNS (rDNS) and PTR records.

For a mail server the hostname is not cosmetic. It is the identity the server presents to every other server it talks to, and it is checked.

What makes a hostname fully qualified?

A fully qualified domain name (FQDN) is a hostname that includes every label up to the top-level domain, so it is unambiguous no matter where it is resolved from:

Internet Service Provider (ISP)

An Internet Service Provider (ISP) is a company that provides internet access to customers. It does this by providing a connection to the internet via a network of servers, which allows users to access the web, send emails, and use other internet services. ISPs can be large, national companies or smaller, local providers.

Do ISPs provide email services?

Some Internet Service Providers (ISPs) do offer email services to their customers as part of their internet package. This means that when you sign up for internet service with a particular ISP, you may also be given a unique email address that you can use to send and receive emails. However, not all ISPs offer email services, and you may need to use a separate email provider, to create and manage your email accounts.

IP Block Listing or Blacklisting

IP blacklisting is a technique used by Internet Service Providers (ISPs) and email providers to block or filter incoming messages from IP addresses that have been identified as sources of spam or other malicious activity. By blocking or filtering messages from these IP addresses, ISPs and email providers can help protect their users from spam and other unwanted email.

IP Blacklisting on local systems

IP blacklisting can be applied using configuration files in several different ways, depending on the specific needs of the organization and the type of system that is being used. Here are a few examples of how this might be done:

IP Whitelisting or Allow Listing

IP whitelisting — increasingly called allow listing — is the practice of naming senders that must always be accepted, regardless of what any blocklist says about them. It is the necessary counterpart to IP blacklisting: the mechanism that keeps a false positive on a third-party list from costing you a customer’s order confirmation.

Why is a whitelist needed at all?

Because you do not control the lists you reject on. A DNSBL operator can list a shared outbound relay used by your bank, your payment provider or your own ticketing system, and your server will refuse that mail without ever telling you what you missed.

Mail Transfer Agent (MTA)

A Mail Transfer Agent (MTA) is a software application responsible for the transfer of email messages between computer systems, using SMTP. The MTA is a critical component in the email delivery process, ensuring that messages are routed correctly from the sender to the recipient.

What is the role of an MTA?

The primary role of an MTA is to accept incoming email messages from a client application or another MTA and deliver them to the appropriate recipient. This process involves routing the message through the internet or a local network, resolving any addressing issues, and ensuring that the message is delivered successfully.

MX Record

An MX (Mail Exchanger) record is the DNS record that tells a sending server which hosts accept mail for a domain, and in which order to try them. It is the first lookup in every delivery attempt: before a message can be sent to someone@example.com, the sending server has to ask what handles mail for example.com.

$ dig +short MX example.com
10 mx1.example.net.
20 mx2.example.net.

How is the priority interpreted?

The number is a preference, and lower wins. A sending server tries priority 10 first and falls back to 20 only if the first is unreachable. Equal priorities are used round-robin, which spreads load rather than providing fallback.

Phishing

Phishing is email that impersonates a party the recipient trusts in order to obtain something: login credentials, payment details, or an instruction carried out on the attacker’s behalf. It is the most damaging category of abuse, because it targets the person rather than the software, and no filter is the last line of defence when the last line is a human being under time pressure.

What kinds of phishing exist?

Credential phishing. A link to a convincing copy of a login page. Mail system credentials are the highest-value target, since a working mailbox unlocks password resets everywhere else.
Spear phishing. The same idea, aimed at one named person and written with knowledge of their role, their colleagues and their current projects.
Business email compromise (BEC). A request — apparently from an executive, a supplier or a lawyer — to change bank details or make an urgent transfer. Typically plain text with no link and no attachment, which is exactly why content filters have so little to work with.
Clone phishing. A genuine message the recipient already received, resent with the link or attachment swapped.
Thread hijacking. A reply injected into a real, ongoing conversation from a compromised participant. The context is authentic, so the usual cues are absent.

What does a phishing message look like?

Credential phishing is recognisable in the headers more often than in the text:

Pointer Record (PTR)

A PTR record (Pointer record) is a type of DNS record used to map an IP address to a domain name (e.g. 127.0.0.1 -> localhost). It is the record type that makes reverse DNS (rDNS) lookups possible.

This page covers the record itself — where it lives, how it is constructed, and who controls it. For why a mail server needs one and what happens when it is missing, see reverse DNS (rDNS).

Reverse DNS (rDNS)

Reverse DNS (rDNS) is a technique used to map an IP address to a domain name using a Pointer (PTR) record. It involves querying the DNS system in reverse, starting with the IP address, to retrieve the associated domain name (e.g. 127.0.0.1 -> localhost). Reverse DNS is commonly used for verifying server identities, preventing email spam, and troubleshooting network issues.

For mail servers it is not optional in practice. A missing or mismatched reverse DNS entry is one of the most common reasons an otherwise correctly configured server cannot deliver mail.

Sender Policy Framework (SPF)

The Sender Policy Framework (SPF) is a DNS record in which a domain owner publishes the list of servers permitted to send mail using that domain. A receiving server compares the IP address that is connecting against that list and can reject, or downgrade, mail from anywhere else.

SPF is defined in RFC 7208. It is one of the three sender authentication mechanisms, alongside DKIM and DMARC, and it is the oldest and the most brittle of them.

Simple Mail Transfer Protocol (SMTP)

The Simple Mail Transfer Protocol (SMTP) is the protocol mail servers use to hand messages to one another, and that mail clients use to submit new messages for sending. It is defined in RFC 5321.

SMTP is a line-based conversation in plain text. That is worth knowing not out of nostalgia but because every rejection you will ever debug is a line from this conversation, quoted back at you in a log file.

Spam

Spam is unsolicited bulk email. Both halves of that phrase are load-bearing: unsolicited means the recipient did not ask for it, and bulk means it was sent to many recipients essentially unchanged.

The definition deliberately says nothing about content. A single unwanted message is not spam, and a million messages to people who genuinely subscribed are not spam either. This is why senders and recipients so often disagree — and why the recipient’s view is the one that determines whether your mail gets delivered.

Top Level Domain (TLD)

A Top Level Domain (TLD) is the last segment of a domain name, representing the highest level in the domain name system. It typically consists of two or more letters and indicates the purpose or geographical location of a website or entity. Examples include .com, .org, and .net. TLDs help categorize and organize websites on the internet, facilitating easy navigation and identification.

What types of TLD are there?

TLDs fall into two groups that are worth keeping apart, because they are run by different kinds of organisation under different rules: