Learn

The terms, explained

One page per term, a few paragraphs each, and the tool or product it points at. For step-by-step instructions, see the help centre.

Mail

BIMI (Brand Indicators for Message Identification)A DNS record that lets mailbox providers show your logo next to your mail, once DMARC is enforced and the logo is a verified SVG. DANE and TLSA recordsA way to pin your mail server's certificate in DNS, signed with DNSSEC, so sending servers can verify it without trusting any certificate authority. DKIM (DomainKeys Identified Mail)A digital signature on outgoing mail, verified against a public key in DNS, that proves the message was not altered and really came from the domain that signed it. DMARCA DNS policy that tells receiving servers what to do with mail that fails SPF and DKIM for your domain, and where to send reports about it. IMAP and SMTPThe two protocols a mail program uses: IMAP to read mail on the server, SMTP to send it. MTA-STSA policy, published over DNS and HTTPS, that tells sending servers to deliver to your mail server over TLS only, with a valid certificate, or not at all. MX recordThe DNS record that names the servers which accept mail for a domain, in order of preference. Reverse DNS (PTR record)The DNS record that maps an IP address back to a hostname. Mail servers check it, and many refuse mail from an address without one. SPF (Sender Policy Framework)A DNS TXT record that lists which servers may send mail for a domain, so a receiving server can tell a forged sender from a real one.

DNS and domains

A and AAAA recordsThe DNS records that give a name its IPv4 (A) and IPv6 (AAAA) addresses. Every website and every server starts with these. CAA recordA DNS record that says which certificate authorities may issue certificates for a domain. A CA must check it before issuing. CNAME recordA DNS record that makes one name an alias for another. Used to point www or a subdomain at a hosting provider without copying its addresses. DNS (Domain Name System)The directory that turns names like example.lu into addresses, mail servers and other records, run as a tree of zones from the root down. DNS propagationWhy a changed DNS record shows up at different times in different places: resolvers keep the old answer until its TTL runs out. DNSSECCryptographic signatures on DNS records, with a chain of trust from the root, so a resolver can tell a forged answer from the real one. NameserverA server that answers DNS queries for a zone with authority. A domain needs at least two, and they must all serve the same data. RDAP and whoisThe two ways to ask a registry who holds a domain: whois, the old text protocol on port 43, and RDAP, its JSON successor over HTTPS. Registry, registrar, registrantThe three parties behind every domain: the registry runs the extension, the registrar sells the names, the registrant holds one. SOA record and zone serialThe record at the top of every DNS zone that names the primary nameserver, the contact address and the serial number that shows which version of the zone a server holds. SRV recordA DNS record that names the host and port for a service, so a client can find it without the user typing server settings. TTL (time to live)The number of seconds a DNS record may be cached. It decides how long a change takes to reach everyone.

Networks and addresses

AS number (ASN)The number that identifies a network on the internet for routing. Needed to announce your own IP addresses with BGP. BGP (Border Gateway Protocol)The protocol networks use to tell each other which IP prefixes they can reach. It is how the internet routes between autonomous systems. CGNAT (carrier-grade NAT)When an ISP puts many customers behind one shared public IPv4 address. Outbound works, inbound does not, and port forwarding stops working. IP addressThe number that identifies a device on the internet, in two versions: IPv4 (32-bit, scarce) and IPv6 (128-bit, plentiful). IPv4 vs IPv6Why there are two versions of the internet protocol, what IPv6 changes in practice, and why a server should have both. IPv6 prefix sizes (/64, /48, /32)What the number after the slash means in IPv6, and why /64 is a single network, /48 a site, /32 an ISP. Peering and internet exchangesNetworks connecting to each other directly, often at an internet exchange, to swap traffic without a middleman. PI and PA address spaceProvider-independent space is registered to you and moves with you; provider-aggregatable space belongs to the provider's block and stays behind when you leave. RIR and LIR (RIPE NCC)The registries that hand out IP addresses and AS numbers: five regional ones, and the local registries that are their members. RPKI and ROAsSigned statements of which AS number may announce which IP prefix, so routers can drop hijacked or mistyped BGP announcements. WireGuardA small, fast VPN protocol built on modern cryptography. One key pair per side, one UDP port, and it works behind NAT.

Servers and hosting

KVM (Kernel-based Virtual Machine)The virtualisation built into the Linux kernel. Each VPS is a real virtual machine with its own kernel, not a container sharing the host's. Root accessFull administrative control of a server: install anything, change anything, and be responsible for all of it. Snapshots and backupsA snapshot freezes a server's disk at a point in time for a quick rollback. A backup is a copy somewhere else. You want both, for different reasons. SSH keyA key pair used to log in to a server instead of a password. The private key stays on your machine; the public key goes on the server. Tier IV datacenterThe highest level in the Uptime Institute's classification: fault-tolerant power and cooling, so any single failure or maintenance leaves the servers running. TLS and HTTPS certificatesThe encryption behind https:// and secure mail delivery, and the certificate that proves a server is who it says it is. VPS (virtual private server)A share of a physical server with its own operating system, its own IP address and full root access. Between shared hosting and a dedicated server.

Law and billing

Controller, processor and the DPAUnder the GDPR the customer who decides what to do with personal data is the controller; the host that stores it on their behalf is the processor; the DPA is the contract between them. Data residency and jurisdictionWhere data is physically stored is one question; whose law can reach it is another. The second one depends on the provider, not the rack. Reverse charge VATWhy an EU business with a VAT number is invoiced without VAT by a provider in another member state, and what it has to do instead.