Glossary
Sender Domain Authentication
Sender domain authentication verifies that a message claiming to come from a particular domain was actually authorized, by that domain's own published policy, to be sent on its behalf. The underlying email protocol never guaranteed this on its own — a message's claimed sender has historically been trivial to forge, which is exactly what made phishing that impersonates a trusted domain so effective for so long, and exactly the gap domain authentication closes.
A domain publishes, in a place any receiving mail server can check, which sending sources are actually authorized to send on its behalf; a receiving server checks an incoming message against that published policy and can reject, flag, or quarantine anything claiming to be from a domain that never actually authorized it. This shifts email sender verification from something the recipient had to guess at entirely to something they can actually check against an authoritative source.