A host has n labels. The public suffix list rule that matches the most labels, s of them, gives the public suffix.

registrable domain = the s + 1 right-most labels

Why it holds. A registry or a hosting service sells names one label above its suffix. The buyer then controls everything to the left of that label.

depth = n − r − j

Here r = s + 1, and j is the position of the brand label from the left, counting from 0.

Why labels left of the registrable domain prove nothing. The owner of the registrable domain picks every label to its left. A brand name there, at any depth, is only text.

Punycode writes the basic characters of a label first, then one number for each other character. Each number counts how far the character moves through the label as it is inserted.

delta += (m − n) × (h + 1), then +1 for every earlier character that sorts below m

The number is written in base 36 with digits of variable length. The threshold for digit position k is

t(k) = min(max(k − bias, 1), 26)

digit = t + (q − t) mod (36 − t),   q = (q − t) div (36 − t)

Why the bias adapts. After each number the coder predicts that the next one is about as large. It sets the bias from the last delta so that likely numbers fit in fewer digits.

delta ← delta div 700 (first) or div 2,   delta += delta div (h + 1)

bias = k + 36 × delta div (delta + 38)

The Levenshtein distance counts the fewest single-character edits between two strings.

D[i][j] = min(D[i−1][j] + 1, D[i][j−1] + 1, D[i−1][j−1] + [a_i ≠ b_j])

Every Received line carries a local time and a zone offset. To compare two lines, convert each to UTC.

UTC = local time − offset,   gap_k = UTC_k − UTC_k−1

Why a negative gap is impossible. A server writes its line when it receives the message, and that is after the previous server sent it. Every gap in a true chain is zero or more, so a negative gap means a forged line or a wrong clock.

Why only your own line counts. Each server prepends its line, so a line is only as good as the server that wrote it. Lines below your boundary were already there when the message reached you.

Each include, a, mx, exists and redirect term costs one DNS lookup, and so does every record the includes pull in. Records and includes form a tree.

lookups = Σ (lookup terms in every record of the tree),   permerror when lookups > 10

Why the limit exists. Each lookup is work for the receiver's resolver and for the sender's name servers. A record that fans out can turn one message into dozens of queries.

An ip4 or ip6 term needs no lookup. It matches when the first p bits of the sender equal the first p bits of the network.

mask = 2³² − 2^32−p,   match when ip AND mask = net AND mask,   block size = 2^32−p

The body hash is a SHA-256 digest of the canonical body, written in base64. A digest is 32 bytes and base64 turns every 3 bytes into 4 characters.

bh = base64(SHA-256(canonical body)),   length = 4 × ⌈32 / 3⌉ = 44 characters

The signature is RSA with PKCS#1 v1.5 padding over the SHA-256 digest of the canonical headers. The verifier raises the signature to the public exponent and reads the padded block back.

m = s^e mod n,   EM = 0x00 ‖ 0x01 ‖ FF…FF ‖ 0x00 ‖ DigestInfo ‖ H

Why it holds. Only the holder of the private exponent d can produce an s with s^e mod n equal to the block.

The padding is k − 3 − 51 bytes long for a modulus of k bytes. The SHA-256 DigestInfo takes 19 bytes and the hash takes 32.

DMARC passes when SPF or DKIM passes and lines up with the From domain.

pass = (SPF pass ∧ SPF aligned) ∨ (DKIM pass ∧ DKIM aligned)

Why alignment is required. A message can carry a valid signature from any domain, including the sender's own. Without alignment a pass would say nothing about the domain you read in From.

Your verdicts are scored like a detector. Flagging a message that is not legitimate counts as a positive.

precision = TP / (TP + FP),   recall = TP / (TP + FN)