reference · plain-language definitions

Glossary

This site uses a fair number of abbreviations — some familiar, some specific to email and DNS. This page defines each one in a sentence or two, in plain language, so nothing you read elsewhere on merula.io depends on already knowing the jargon.

For a deeper explanation of how Merula checks each of these — including why a change matters and what to do about it — see the in-app Knowledge Base, or the technical standards & framework mappings.

Email authentication & delivery

DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to outgoing email, so a receiving server can confirm the message wasn't altered in transit and really was authorised by your domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance): Tells receiving mail servers what to do with a message that fails SPF or DKIM, and asks them to send back a report on what they saw — the record that ties SPF and DKIM together into one enforceable policy.
MTA-STS (SMTP MTA Strict Transport Security): A policy a domain publishes to require that incoming mail is delivered only over an encrypted, verified connection, rather than silently falling back to plain text.
SMTP (Simple Mail Transfer Protocol): The protocol mail servers use to relay messages to one another — the transport layer email travels over.
SPF (Sender Policy Framework): A DNS record listing which mail servers are allowed to send email for a domain, so receivers can reject messages that claim to be from you but weren't sent by anything on the list.
STARTTLS: The command that upgrades a plain-text mail connection to an encrypted one, part-way through the conversation between two mail servers.
TLS-RPT (SMTP TLS Reporting): Asks mail senders to report back, daily, on any problems they had delivering encrypted mail to a domain — visibility for failures that would otherwise be silent.

DNS & domain records

A / AAAA record: DNS records that map a domain name to the server address that hosts it — A for a regular (IPv4) address, AAAA for the newer, longer (IPv6) form.
CAA record (Certification Authority Authorization): A DNS record naming which certificate authorities are allowed to issue a TLS certificate for your domain, reducing the risk of an unintended certificate being issued elsewhere.
CNAME record: A DNS record that makes one hostname an alias for another, so a lookup for the alias resolves to whatever the target name resolves to.
DANE / TLSA: DNS-based Authentication of Named Entities: lets a domain publish, in a signed DNS record, exactly which TLS certificate its mail servers should present, so a sender can refuse delivery if the certificate doesn't match.
DNS (Domain Name System): The directory that translates a domain name into the records other systems need — which server hosts the website, where to deliver email, and more.
DNSSEC (DNS Security Extensions): Adds a cryptographic signature to DNS answers, so a resolver can tell a genuine answer from one that's been tampered with in transit.
MX record (Mail Exchange): The DNS record naming which server should receive email for a domain.
NS record (Nameserver): The DNS record naming the servers authoritative for answering queries about a domain.
RDAP (Registration Data Access Protocol): The modern, structured way to look up a domain's public registration details — who it's registered through, and when it expires — replacing the older, line-based WHOIS protocol.
TXT record: A DNS record that holds free-form text, most often used for domain-ownership verification tokens and to publish records like SPF.

Web & network security

API (Application Programming Interface): A structured way for software to talk to other software, rather than a person clicking through a screen.
CORS (Cross-Origin Resource Sharing): The browser rule set that controls which other websites are allowed to read data from a web service — overly permissive CORS can expose data that should stay private.
CSP (Content-Security-Policy): A browser security header that limits where a page's scripts, styles and other resources are allowed to load from, reducing the impact of certain injection attacks.
HSTS (HTTP Strict Transport Security): A header that tells browsers to always use an encrypted connection to a site, rather than trying plain HTTP first.
HTTP / HTTPS: The protocol a browser uses to request a web page. The "S" means the connection is encrypted with TLS — the padlock in the address bar.
RPKI (Resource Public Key Infrastructure): Lets the holder of a block of internet addresses publish a signed statement of which network is allowed to announce it, so other networks can reject an announcement that doesn't match — protection against traffic being redirected by mistake or by design.
TLS (Transport Layer Security): The protocol that encrypts and authenticates a connection between two systems — the layer underneath HTTPS and secure email delivery.

Standards & authorities

BSI: Germany's Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik), which publishes technical guidance such as its email-authentication and secure-transport guidelines.
CERT-EU: The Computer Emergency Response Team for the EU institutions, part of the wider European cybersecurity landscape.
CIS Controls: A prioritised, freely available set of cybersecurity safeguards published by the Center for Internet Security — a pragmatic baseline widely used by smaller organisations.
ENISA: The European Union Agency for Cybersecurity, which publishes EU-wide technical guidance referenced by national authorities and NIS2 implementing legislation.
IETF (Internet Engineering Task Force): The standards body that publishes the RFCs defining most internet protocols, including the ones behind DNS, TLS and email.
ISO/IEC 27001: An international standard for information security management systems, often requested in B2B procurement.
NCSC: A national Cyber Security Centre — the UK's and the Netherlands' are both referenced in Merula's guidance — publishing public cybersecurity advice for organisations.
NIS2: An EU directive requiring certain essential and important entities to apply cybersecurity risk-management measures, including cyber hygiene and secure communications.
NIST CSF: The US National Institute of Standards and Technology's Cybersecurity Framework — a widely referenced structure for organising a security programme, used internationally even outside US federal contexts.
OWASP: The Open Worldwide Application Security Project, a non-profit publishing widely cited application-security guidance, including the OWASP Top 10 and the Secure Headers baseline.
RFC (Request for Comments): A numbered document published by the IETF that defines an internet protocol or convention — the precise rulebook behind terms like SPF, DKIM and DMARC.
SBOM (Software Bill of Materials): A list of the software components that make up a product, used to understand and track its dependencies.

Business & legal

DPA (Data Processing Addendum): The contract that governs how a service processes personal data on a customer's behalf under GDPR.
EEA (European Economic Area): The EU member states plus Iceland, Liechtenstein and Norway.
EU (European Union): The political and economic union of European member states. Merula is built for EU and EEA businesses, and eligibility for paid plans is checked against it.
GDPR (General Data Protection Regulation): The EU's data-protection law governing how personal data is collected, used, retained and deleted.
MFA (Multi-Factor Authentication): Signing in with something you know (a password) and something you hold (a one-time code from an authenticator app), so a leaked or guessed password alone isn't enough to reach an account. Also referred to as 2FA (two-factor authentication).
MSP (Managed Service Provider): A company that runs IT or security services on behalf of other businesses — Merula's agency plan is built for this model.
SMB / SME (Small and Medium-sized Business / Enterprise): Merula's core customer segment.
VAT (Value Added Tax): The EU sales tax applied to paid plans, calculated and validated automatically at checkout.
VIES (VAT Information Exchange System): The EU's official registry for confirming that a business's VAT number is valid.