Page 218 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Authentication-Results assertions are trustworthy only when producer and consumer are connected through the receiving administrative domain’s configured trust boundary.
Read the explainer
One-click unsubscribe requires one List-Unsubscribe header containing an HTTPS URI and one List-Unsubscribe-Post header whose value is List-Unsubscribe=One-Click.
Read the guide
An SMTP mail object has an envelope containing the reverse path, recipient paths, and extension parameters, plus separately transmitted message content.
Read the playbook
Port 587 identifies ESMTP message submission, while port 25 may be used only when a site explicitly distinguishes submission agents from transfer agents. A submission agent requires authentication by default unless the session is already independently authenticated or authorized.
Read the briefing
An IMAP UID remains stable during a session and normally across sessions; UIDVALIDITY tells a client when earlier UIDs can no longer be reused for synchronization.
Read the checklist
Internet Message Format defines message content syntax, not the SMTP envelope, transmission method, storage format, or user interface. A message contains a syntactically structured header section followed by an optional body separated by an empty line.
Read the explainer
A MIME-conformant top-level message declares MIME-Version: 1.0; body parts need their own declaration only when they encapsulate a MIME message. Content-Type identifies the body’s media type, subtype, and type-specific parameters so the receiver can choose an appropriate handler.
Read the guide
A structurally valid ARC chain has exactly one AAR, AMS, and AS in each set, with instance numbers forming an unbroken sequence from 1 through N.
Read the playbook
An RDNSS option’s Lifetime is the maximum time its advertised recursive-server addresses may be used; a zero lifetime removes them immediately. A DNSSL option applies the same lifetime semantics to its advertised DNS search suffixes, including immediate withdrawal at zero.
Read the briefing
A BGP speaker advertises supported capabilities in the Capabilities Optional Parameter of its OPEN message. A capability may be used on a peering only after both peers have advertised support for it.
Read the checklist