Glossary

Heading levels express the structure of a page. Why skipping a level breaks navigation, and why headings must not be chosen for their size.

An h1 names what a page is about, in the page itself. How it differs from the title tag, and what the standard actually says about having several.

DNS maps names to addresses and to service configuration. The record types that matter for a website, and how propagation and TTL really behave.

DKIM attaches a cryptographic signature to a message and publishes the key in DNS. What a selector is, what the signature covers, and what it cannot do.

Alignment requires the domain SPF or DKIM authenticated to match the visible From address. How relaxed and strict modes differ, and what breaks them.

MTA-STS publishes a policy demanding encrypted, authenticated SMTP connections. How the DNS record and HTTPS policy file work together.

SMTP TLS Reporting collects daily reports about connections that could not be encrypted. What the reports contain and why they precede enforcement.

BIMI lets mailbox providers display a domain's logo next to its messages. What it requires, what a VMC is, and what it does not improve.

Spoofing puts someone else's address in the From header. Why SMTP allows it, what authentication actually prevents, and what it does not cover.

SPF lists which servers may send mail for a domain. The ten-lookup limit, why -all and ~all differ, and why only one record is allowed.

DMARC ties SPF and DKIM to the visible From: domain and tells receivers what to do on failure. What alignment means, and how to move from none to reject safely.

Why every message has two sender addresses, which one SPF authenticates, and why that gap is the reason DMARC alignment exists.

What a selector is, why DNS makes it impossible to list them, how key rotation depends on them, and how to find yours from a real message.

What an include mechanism does, why it costs a DNS lookup, how the ten-lookup limit is reached without changing anything, and how to stay under it.

What an aggregate report contains, why it is the only way to tighten a policy safely, and what it deliberately does not include.

How STARTTLS upgrades an SMTP connection, why opportunistic encryption can be stripped, and what MTA-STS and DANE add on top of it.

A trailing slash changes the URL. Why servers treat the two forms differently, what it costs to serve both, and how to pick one and enforce it.

robots.txt controls crawling, not indexing. How the rules are matched, why a blocked page can still appear in results, and what it cannot hide.

A sitemap lists a site's canonical URLs with optional metadata. What lastmod means, what the size limits are, and what it does not guarantee.

noindex tells search engines not to index a page. Where to put it, why it must be crawlable to work, and how it differs from robots.txt.

The title element names a document. Where it appears, why search engines sometimes rewrite it, and what makes a title work as a result link.

A meta description proposes a snippet for search results. Why it is not a ranking factor, when it is used, and what makes one worth writing.

Open Graph tags tell social platforms and chat apps what to show for a shared link. Which tags matter, image requirements, and caching behaviour.

Structured data states a page's facts in a vocabulary machines understand. What schema.org is, what rich results require, and what mismatches cost.

JSON-LD expresses linked data as JSON. What @context and @id do, how a graph is assembled, and why it is preferred for structured data on the web.

TLS encrypts and authenticates an HTTP connection. What the versions differ on, why TLS 1.0 and 1.1 are deprecated, and what it does not protect.

A certificate binds a public key to a hostname, vouched for by an authority. What the fields mean, what validation levels change, and what expiry does.

A certificate authority issues certificates that browsers trust. How trust stores work, what validation involves, and what happens when an authority fails.

A chain links a site's certificate to a root the client trusts. Why servers must send intermediates, and why an incomplete chain fails intermittently.

The SAN extension lists every name a certificate is valid for. Why the common name no longer counts, and what a missing name actually breaks.

A wildcard covers every subdomain at one level. What it does not cover, why issuance requires DNS validation, and what sharing a key across hosts costs.

A cipher suite names the algorithms used for key exchange, encryption and integrity. How TLS 1.3 simplified them, and what forward secrecy means.

The handshake negotiates a version, a cipher and a key, and validates the certificate. What each round trip costs, and how handshake failures present.

Strict-Transport-Security makes a browser refuse plain HTTP for a domain. What max-age and includeSubDomains do, and why it is hard to undo.

The preload list ships HSTS policies inside browsers, covering the very first request. What inclusion requires, and why removal takes months.

Mixed content is a plain-HTTP subresource inside an HTTPS page. What browsers block, what they upgrade, and why the padlock stops meaning much.

Why a server needs the hostname before it can present a certificate, what SNI solves, and why a wrong certificate on one name is usually an SNI problem.

What forward secrecy guarantees, how ephemeral key exchange provides it, and why it is no longer something most sites have to configure.

What the ACME protocol automates, the two validation methods and how each fails, and why short certificate lifetimes depend on it working.

What a self-signed certificate does and does not provide, why browsers refuse it, and the legitimate places one still belongs.