Fifteen controls across two tracks, placed on one surface each, with what they assert and to whom. This is the reference the rest of the course assumes.
Identity
| Control | Asserts | To |
|---|---|---|
SPF | These hosts may use this domain as an envelope sender | Receiving mail servers |
DKIM | This domain signed this message | Receiving mail servers |
DMARC | Treat unaligned mail claiming this From domain as follows | Receiving mail servers |
CAA | Only these authorities may issue certificates for this name | Certificate authorities |
Transfer lock | This domain may not be transferred | The registry, via the registrar |
Registry lock | This domain may not be changed without an out-of-band process | The registry |
Integrity
| Control | Asserts | To |
|---|---|---|
DNSSEC | These records are as this zone published them, and these do not exist | Validating resolvers |
DKIM body hash | This message body is unmodified since signing | Receiving mail servers |
TSIG | This zone transfer request is authorised | Your own secondaries |
Certificate Transparency | Every certificate for this name is publicly visible | Anyone watching, including you |
Transport
| Control | Asserts | To |
|---|---|---|
MTA-STS | Require TLS to these hosts, with a valid certificate | Sending mail servers |
DANE | Expect exactly this key at this host | Sending mail servers that validate |
TLS-RPT | Tell me when transport security failed | Sending mail servers |
Perception
| Control | Asserts | To |
|---|---|---|
BIMI | This logo belongs with mail from this domain | Mail clients, and then a human |
Monitoring and takedown | Nothing — it removes the thing being perceived | Nobody. It acts rather than asserts. |
User-facing warnings | This message is from outside the organisation | A human |
Read the “to” column
Almost every control addresses a machine, and a machine either implements it or does not. Only the perception surface addresses a person, and people are not configurable. That asymmetry is why the technical surfaces can be finished and the perception surface never can.