Terms are listed alphabetically. Each has a short definition that holds for any email provider, with RFC numbers for the main mail standards. Where Atriomail's own behavior matters, a second line starting "In Atriomail:" says what the product does today.
For a longer read on hosting types, DNS records and white-label concepts, see the companion guide Email hosting terminology explained, and to test a live domain's MX, SPF, DKIM and DMARC records without an account, use the free DNS checker.
A
A record
A DNS record that maps a hostname to an IPv4 address (the AAAA record does the same for IPv6). Mail depends on it indirectly: the hostname an MX record names must have an A or AAAA record so sending servers can connect to it.
Alias
An additional email address with no storage or password of its own: mail sent to it is delivered to an existing mailbox, so addresses such as info@ and sales@ can land in one inbox.
In Atriomail: Aliases are not billed. You can add them to a domain once that same domain has at least one mailbox; a mailbox on a different domain does not count.
App password
A separate, generated password that lets a mail app or migration tool sign in to an account protected by two-step verification without the main password or the second factor. It can be revoked on its own without changing the main password.
In Atriomail: The built-in IMAP migration can copy Gmail and Google Workspace mailboxes with an app password (Google requires 2-Step Verification for app passwords, and a Workspace admin can block them), and Yahoo Mail and iCloud Mail accounts with an app-specific password from that provider.
Autoconfig
A convention started by Mozilla Thunderbird: the mail app requests an XML file listing a domain's incoming and outgoing server names, ports and security settings, typically from autoconfig.example.com. The domain needs a DNS record for that hostname that points at the server hosting the file.
Autodiscover
Microsoft's mechanism for Outlook to find account settings from an email address, typically by requesting an XML file from autodiscover.example.com. The DNS side is usually a CNAME or A record for that hostname.
In Atriomail: On a connected Cloudflare or Namecheap account, Atriomail can write the autodiscover and autoconfig records along with the domain's MX record, which moves its mail, when you add a domain imported from that account and it passes the security check (full steps under DNS zone). The recommended mail app settings to give clients are IMAP with SSL/TLS on port 993 and SMTP with STARTTLS on port 587.
C
Catch-all address
A rule that accepts mail sent to any address at a domain that matches no existing mailbox or alias and delivers it to a chosen mailbox. It stops mistyped addresses from bouncing, but it also collects spam sent to guessed addresses.
In Atriomail: Catch-all addresses are not billed and need at least one mailbox on the same domain.
CNAME record
A DNS record that makes one hostname an alias of another, so lookups continue at the target name. A name with a CNAME cannot hold any other record except DNSSEC records (RFC 1034, RFC 2181), so a CNAME cannot sit at the bare domain (the zone apex), and an MX record must not point at a name that is a CNAME (RFC 2181).
Custom domain email
Email addresses on a domain the business owns, such as name@company.com, instead of on a provider's shared domain. The domain's MX records decide which provider receives the mail, so the addresses can move to another provider by changing DNS, while stored mail has to be migrated separately.
D
DKIM
DomainKeys Identified Mail (RFC 6376): the sending server adds a cryptographic signature to each message, and receivers verify it with a public key published as a TXT record at <selector>._domainkey.<domain>, either directly or through a CNAME record at that name pointing to a key the sending service hosts (Amazon SES's Easy DKIM works this way). A valid signature shows that the signed headers and body were not changed after signing, and ties the message to the domain in the signature's d= tag.
In Atriomail: The panel generates each domain's DKIM record ready to copy, and its DNS Setup dialog also lists the Amazon SES verification records once they are generated; add each record with exactly the type the dialog shows. Outgoing mail is delivered through Amazon SES and is DKIM-signed for the sending domain's own name once that domain's Amazon SES records are in DNS. This is shared infrastructure, not dedicated.
DKIM selector
The label in a DKIM signature's s= tag that tells receivers which public key to fetch: selector s1 on example.com is looked up at s1._domainkey.example.com. Selectors let one domain publish several keys at once, for example one per sending service, and let a key be rotated by publishing a new selector before retiring the old one.
In Atriomail: The free DNS checker reads public DNS only, so it checks DKIM at one selector: dkim, unless you enter another under Advanced options on the checker page that opens when you submit a domain.
DMARC
Domain-based Message Authentication, Reporting and Conformance (RFC 9989, which replaced RFC 7489 in 2026): a TXT record at _dmarc.<domain> that states the domain owner's policy for mail that fails DMARC and where receivers should send reports. A message passes DMARC when SPF or DKIM passes for a domain that aligns with the domain in the visible From header.
In Atriomail: The panel generates a DMARC record for every domain, ready to copy.
DMARC alignment
The DMARC check that the domain authenticated by SPF (the envelope sender) or by DKIM (the d= tag) matches the domain in the From header. Relaxed alignment, the default, accepts the same organizational domain, so mail.example.com aligns with example.com; strict alignment, set with aspf=s or adkim=s, requires an exact match.
DMARC policy
The p= tag of a DMARC record, which RFC 9989 calls the Domain Owner Assessment Policy, states how the domain owner regards mail that fails DMARC: p=none expresses no preference (domains use it while they read reports), p=quarantine says the owner considers failing mail suspicious, and p=reject says the owner considers any failure a clear sign that the use of the domain is not legitimate. Each receiver still decides what to do under its own local policy, often filing mail that fails under p=quarantine as spam and refusing mail that fails under p=reject, and the optional sp= tag sets a separate policy for subdomains.
DNS zone
The set of DNS records for a domain, held by the DNS host the domain is delegated to through its NS records, which can be a different company from the registrar. Mail records such as MX, SPF, DKIM and DMARC take effect only once they are published in that zone.
In Atriomail: Connect a Cloudflare or Namecheap account and let Atriomail import its domain list; when you then add one of those domains and it passes the security check, Atriomail can write the MX, SPF, DMARC, autodiscover and autoconfig records and the DKIM key into that zone. Writing the MX record moves that domain's mail, so add the domain when you are ready to switch. Copy the Amazon SES verification records yourself from the panel's DNS Setup dialog once they are generated. On any other DNS host, check with us before relying on automation, or add the records listed in that dialog. Details: connecting Cloudflare and Namecheap for automatic mail DNS.
E
Email deliverability
The share of sent mail that reaches recipients' inboxes instead of being rejected or filtered as spam. It depends on authentication (SPF, DKIM and DMARC), the reputation of the sending IP addresses and domain, message content and how recipients engage, and no provider can guarantee it.
F
Forwarder
A rule that passes mail arriving for one address on to another address, often at a different provider. After forwarding, SPF no longer passes for the original sender's domain, because the forwarding server is not listed in that domain's SPF record, so forwarded mail usually depends on an intact DKIM signature to pass DMARC at the final destination.
In Atriomail: Forwarders are not billed and can pass mail on to outside addresses such as Gmail, once the domain has at least one mailbox. A forwarded message shows the original sender's name followed by "via" your domain, and replies go back to the original sender. For forwarding next to hosted mailboxes, see Cloudflare Email Routing vs. white-label email hosting.
I
IMAP
Internet Message Access Protocol (RFC 9051, which replaced RFC 3501): the protocol mail apps use to work with mail that stays on the server, so folders and read status stay in step across devices. Apps connect with implicit TLS on port 993; port 143 is the plain port, upgraded with STARTTLS.
In Atriomail: Mailboxes work with standard mail apps such as Outlook, Thunderbird and the iPhone and Android mail apps over IMAP, POP3 and SMTP with encrypted connections. The recommended IMAP setting is SSL/TLS on port 993.
IMAP migration
Copying mail between servers by signing in to both mailboxes over IMAP and transferring messages folder by folder. It moves stored messages only: calendars and contacts use other protocols and are not part of an IMAP copy.
In Atriomail: IMAP migration is built into the panel and has no charge; you pay only for the mailboxes you migrate into. It keeps the folder structure and each message's original date, can be run as a dry run first, and works with any server that allows IMAP sign-in with a password. Microsoft no longer allows password sign-in over IMAP, so moving a Microsoft 365 tenant needs a different route: talk to us before you quote it.
M
Mailbox
An account on a mail server that stores the mail for one address and has its own sign-in, used from mail apps or webmail.
In Atriomail: Each mailbox is $1.39 per month (US dollars) with 15 GB of storage included. A mailbox is billed until it is deleted; deactivating it does not stop its charge.
Mailbox storage (quota)
The maximum amount of mail a mailbox may hold. When a mailbox is full, the server typically refuses new messages for it until space is freed or the quota is raised, so senders may get a bounce.
In Atriomail: The 15 GB is included with each mailbox, not pooled across the account. Extra storage is sold in 5 GB blocks at $0.60 per block per month, up to 100 GB per mailbox in the panel, and is billed on the size you set, not on the mail stored. See pricing.
MX priority
The preference number in an MX record. Senders try the server with the lowest number first and move to higher numbers only if it cannot be reached or temporarily refuses the message, so with 10 mx1.example.net and 20 mx2.example.net, mx1 is the primary; servers with equal numbers share the load.
MX record
The DNS record that names the servers that accept mail for a domain, each with a preference number. Its target must be a hostname with an A or AAAA record, not an IP address and not a CNAME.
P
POP3
Post Office Protocol version 3 (RFC 1939): a simpler protocol that downloads mail to one device and often deletes it from the server, with no server-side folders. Apps connect with implicit TLS on port 995; port 110 is the plain port, upgraded with the STLS command.
Provisioning
Creating and configuring the services a customer has ordered, such as their account, domain, mailboxes and limits, usually triggered by a billing system when an order is placed.
In Atriomail: The WHMCS provisioning module (version 3.1.1, requires WHMCS 9) creates the client's Atriomail account and email domain when a client orders (the WHMCS product must be a Hosting Account or Reseller Account type), and creates the first mailbox if the domain clears the security check during the order. See the WHMCS integration page.
PTR record (reverse DNS)
A DNS record that maps an IP address back to a hostname. It lives in the in-addr.arpa (IPv4) or ip6.arpa (IPv6) zone, which is controlled by whoever holds the IP address rather than by the domain owner. Many receiving servers check that a sending IP has a PTR record whose hostname resolves back to the same IP.
R
Reseller (email)
A business that buys mailboxes from a provider at a wholesale price and sells them to its own clients, often alongside domains, websites or IT support, while handling the client relationship and billing itself.
In Atriomail: You set your own resale price: Atriomail charges the account holder $1.39 per mailbox per month and does not decide what you charge your clients. For the run-it-yourself alternative, see Zimbra for MSPs: host it for clients or resell managed email.
Return-Path (envelope sender)
The sender address given in the SMTP MAIL FROM command, which the final receiving server records in a Return-Path header. Bounces go to this address, and SPF checks its domain, which can differ from the From address the reader sees.
S
Sender reputation
The trust mailbox providers assign to a sending IP address and domain, built from complaint rates, bounce rates, spam-trap hits and authentication results. When many senders share the same infrastructure, one sender's behavior can affect the reputation the others send under.
In Atriomail: Outgoing mail is delivered through Amazon SES. Each Atriomail customer account is its own tenant in Amazon SES, which lets sending be tracked account by account; the sending infrastructure itself is shared. Because all customers share the platform's sending reputation, the Acceptable Use Policy bans unsolicited bulk mail and bought or rented lists.
SMTP
Simple Mail Transfer Protocol (RFC 5321): the protocol mail servers use to relay messages to each other, normally on port 25. Mail apps send through a separate, authenticated service called SMTP submission.
SMTP submission
The authenticated service a mail app uses to hand outgoing mail to its own provider (RFC 6409): port 587 with STARTTLS, or port 465 with implicit TLS (RFC 8314). Port 25 is meant for relay between servers and is often blocked on home and mobile networks.
In Atriomail: The recommended mail app setting for outgoing mail is SMTP with STARTTLS on port 587.
SPF
Sender Policy Framework (RFC 7208): a TXT record beginning v=spf1 that lists the hosts allowed to send mail for a domain, checked against the envelope sender (MAIL FROM) domain and often the HELO name. A domain name may publish only one SPF record: two make the check return a permanent error, so every sending service has to be merged into a single record.
In Atriomail: The panel generates an SPF record for every domain, ready to copy. On a connected Cloudflare or Namecheap account, Atriomail reads the zone first and leaves an existing SPF or DMARC record in place, unchanged, instead of adding a second one, so if the domain already has an SPF record, merge the panel's SPF value into it yourself.
SPF lookup limit
RFC 7208 caps an SPF check at 10 terms that need DNS lookups (include, a, mx, ptr, exists and the redirect modifier), counting those inside included records. Going over returns a permanent error (permerror), which many receivers treat as a failure; ip4, ip6 and all do not count.
STARTTLS
A command that upgrades a plain connection to an encrypted TLS connection on the same port, used by SMTP (RFC 3207, ports 25 and 587) and IMAP (port 143); POP3 uses the equivalent STLS command. If an attacker strips the command and the client does not insist on TLS, the session can continue unencrypted, which is why RFC 8314 recommends implicit TLS for mail apps.
T
TLS
Transport Layer Security (TLS 1.3 is specified in RFC 9846, which replaced RFC 8446): the encryption that protects data in transit on a connection, between a mail app and a server or between two servers. It does not encrypt stored mail, and server-to-server TLS protects each hop separately rather than end to end.
In Atriomail: The recommended mail app settings use encrypted connections, and outgoing mail is handed to Amazon SES over an encrypted connection.
TTL
Time to live: the number of seconds resolvers may cache a DNS record before looking it up again. Lowering a record's TTL at least one old TTL period before a planned change, such as an MX switch, shortens the time some senders keep using the old value.
Two-factor authentication (2FA)
A sign-in that asks for a second proof besides the password, such as a one-time code from an authenticator app or a code sent by email.
In Atriomail: Two-factor authentication is required to sign in to the Atriomail control panel, with a code from an authenticator app or a code sent by email. It applies to the panel only, not to webmail or mail app sign-ins.
TXT record
A DNS record type that holds text strings. SPF, DKIM and DMARC publish their data in TXT records (a DKIM name can instead hold a CNAME that points to a key record the sending service hosts), and many services use TXT records to verify domain ownership. Each string is limited to 255 characters, so long values such as 2048-bit DKIM keys are split into several strings inside one record.
W
Webmail
A mail client that runs in a web browser, so people can read and send mail without installing an app.
In Atriomail: Every mailbox comes with webmail, so clients can read and send mail from a browser.
White-label email
Email hosting that a reseller sells under its own name, with the reseller's brand shown in place of the provider's in some or all of the parts clients use. How much is rebranded differs by provider and by layer (control panel, webmail, sign-in pages, system emails, message headers), so ask exactly which layers change.
In Atriomail: White-label branding is a separate paid add-on on top of the per-mailbox price, with a one-time setup fee and a monthly subscription, both per branded domain; ask sales for the price. Once our team has set up your own hostname (you need to control its DNS), clients sign in to the control panel there and see your product name and favicon. Some layers stay neutral or show the platform, including raw message headers, the webmail interior, payment pages, system emails and some platform legal documents; we tell you exactly which before you launch.
Wholesale price
The price a reseller pays its provider per unit, usually per mailbox per month. The difference between it and the reseller's own price has to cover payment fees, support time and any add-ons before any of it is profit.
In Atriomail: Atriomail's published price, and so your wholesale cost, is $1.39 per mailbox per month with 15 GB of storage included. As arithmetic, before card fees, support time and any white-label fee: a $5.00 resale price leaves $3.61 a month per mailbox above wholesale, about 72 percent. For a comparison with Microsoft's partner program, see Microsoft 365 CSP reseller program vs. white-label email hosting.
Mail ports at a glance
The standard ports the mail protocols define. This is not a list of the ports any one provider offers: Atriomail's recommended mail app settings are IMAP with SSL/TLS on port 993 and SMTP with STARTTLS on port 587. Implicit TLS means the connection is encrypted from the first byte; STARTTLS means it starts plain and is upgraded.
| Service | Port | Encryption |
|---|---|---|
| IMAP | 993 | Implicit TLS |
| IMAP | 143 | Plain, upgraded with STARTTLS |
| POP3 | 995 | Implicit TLS |
| POP3 | 110 | Plain, upgraded with STLS |
| SMTP submission | 587 | STARTTLS |
| SMTP submission | 465 | Implicit TLS |
| SMTP relay between servers | 25 | STARTTLS when both servers support it |
Where mail DNS records live
Illustrative values for a domain called example.com. Your mail provider supplies the real ones.
| Record | DNS type | Published at | Example value |
|---|---|---|---|
| MX | MX | example.com | 10 mail.example.net |
| SPF | TXT | example.com | v=spf1 include:spf.example.net ~all |
| DKIM | TXT, or a CNAME to the sending service's key | <selector>._domainkey. | v=DKIM1; k=rsa; p=<public key> |
| DMARC | TXT | _dmarc.example.com | v=DMARC1; p=<policy>; rua= |
| PTR | PTR | 10.2.0.192.in-addr.arpa (for the IP 192.0.2.10) | mail.example.net |