Technical reference

Domain security and digital exposure glossary

Clear definitions for SSL, DNS, email authentication, attack surface, availability, brand protection, and exposed identities.

SSL

The historical name for protocols that protected encrypted connections. Modern secure connections use TLS, though “SSL certificate” remains common language.

In business use, the term often covers both the certificate and TLS configuration of websites, APIs, and services.

TLS

A cryptographic protocol that authenticates endpoints and protects data confidentiality and integrity in transit.

Review it together with protocol version, ciphers, trust chain, and hostname coverage.

Certificate Authority (CA)

An entity that issues and signs digital certificates after the relevant control or identity validation.

Client trust depends on a chain ending at a recognized CA and correctly served intermediates.

Certificate expiration

The end of the `notAfter` period during which a certificate is considered valid.

Renewal must be issued, deployed, and verified before that date; issuance alone does not prevent an outage.

DNS

A distributed system that resolves domain names and publishes delegation, email, and service information.

DNS changes affect availability, email authentication, and asset control, making history operationally important.

SPF

A DNS policy listing servers allowed to send mail using a domain in the envelope sender.

It has a DNS lookup limit and must be read with DMARC alignment; it does not protect visible From by itself.

DKIM

A cryptographic signature added by a sender and validated with a public key published in DNS under a selector.

To satisfy DMARC, the signing domain needs to align with the visible message domain.

DMARC

An email authentication policy using SPF or DKIM alignment and supporting aggregate reporting.

Policies `none`, `quarantine`, and `reject` should be rolled out with observation and legitimate-sender classification.

DMARC RUA

Aggregate XML reports summarizing volume, sources, disposition, and authentication outcomes observed by receivers.

They contain no message bodies but may include third-party IPs and domains and need minimization and defined retention.

DMARC RUF

An optional forensic or failure-reporting mechanism with limited support and potentially more sensitive content than RUA.

Availability and content vary by receiver; do not treat it as universal or retain it without privacy review.

MX

A DNS record identifying servers responsible for receiving a domain's mail and their relative priority.

An unplanned change may disrupt or redirect mail and should be correlated with domain administration.

CNAME

A DNS record declaring one name as an alias of another canonical name.

Stale references to third-party services may create takeover risk if the target resource becomes claimable.

Nameserver

An authoritative server that answers for a domain's DNS zone.

Changing NS delegation can transfer effective resolution control and should be treated as sensitive.

Typosquatting

Use of domains that imitate likely typing mistakes of a legitimate name.

It may support phishing, fraud, or misdirected mail, but similarity alone does not prove abuse.

Homograph attack

Impersonation using visually similar characters, often across alphabets or different Unicode forms.

IDN and punycode normalization help comparison, but visual similarity still depends on font and context.

Lookalike domain

A domain resembling a brand through characters, added words, TLD, or structure.

Prioritize it with DNS, MX, certificate, and content signals before starting a response.

Attack Surface Management (ASM)

A process for inventorying, contextualizing, and reducing surfaces from which systems could be attacked.

It may include internal and external assets; EASM focuses on the internet-visible perspective.

External Attack Surface Management (EASM)

Continuous discovery, validation, attribution, and monitoring of internet-exposed assets.

It does not replace penetration tests or vulnerability scanners; it helps establish what exists and who should respond.

Shadow IT

Technology used or exposed without sufficient visibility, approval, or governance from the responsible team.

It may arise from experiments, acquisitions, or decentralized purchases and escape patching and decommissioning.

Subdomain discovery

Gathering names beneath a domain through DNS, certificates, authorized sources, and inventory.

Finding a name does not prove that it is active or in scope; validation and attribution are still needed.

Uptime

The proportion of time a service is considered available under a defined success condition.

Interpret it with measurement window, exclusions, cadence, and conditions; a percentage without methodology can mislead.

Endpoint monitoring

Scheduled checks against a URL or service to evaluate response, latency, and minimal conditions.

Safe monitors avoid destructive operations and do not retain full headers, secrets, or responses.

Status page

A public or restricted view communicating availability and incidents for selected services.

It should expose only approved names, states, and messages—not internal hosts, evidence, or operating comments.

Credential leak

Exposure of identifiers, passwords, or other secrets through a breach or external collection.

A match warrants review but does not prove a current credential works and must never be tested against accounts.

Data breach

A security incident compromising the confidentiality, integrity, or availability of personal or business data.

Legal definitions and obligations vary by jurisdiction and context; a source mention does not replace investigation.