The specs that actually
run the internet
A curated, practical reference for the core internet and web specifications that power SaaS, APIs, authentication, email, and browser applications. Canonical links, real explanations, no fluff.
Back Office
Running the companyDNS, email, TLS certificates, and identity — the standards stack for operating a domain, sending authenticated email, and managing employee access.
Every email your company sends or receives goes through SMTP. You need this to configure mail servers, debug delivery failures, and understand SPF/DKIM/DMARC.
The structure of every email header you've ever seen is defined here. Essential for email deliverability debugging and understanding DKIM header signing.
Your email client (Outlook, Gmail app, Thunderbird, Apple Mail) uses IMAP or JMAP to read mail. Essential for mail server configuration and client integration.
Product
Building softwareHTTP, OAuth, browser platform, and real-time — the specs you work with every day when building and shipping web apps, mobile backends, and APIs.
Browsers parse URLs per this standard, not raw RFC 3986. Critical for client-side routing, form encoding, and cross-origin behavior.
A one-line HTTP header that eliminates a class of downgrade attacks. Every public web app should set HSTS.
This is the core contract of every web API, browser request, and server response. You can't design or debug HTTP without knowing this.
Browse by Topic
Grouped by what you're building — from internet operations and email to blockchain and API design.
Protocol Stack Map
How the layers fit together — from naming and transport up to the application platform.
Must-Know Specs
The minimum set every engineer running an online business should understand.
DNS is the phone book of the internet. Every domain, email MX record, SPF/DKIM TXT record, and service discovery entry depends on it.
The record types (A, MX, TXT, CNAME) you configure in every DNS panel live in this spec. Know what you're setting.
Every URL in your app, API, auth redirect, webhook, or deep link is built on this grammar. Essential for routing, redirects, and OAuth callback validation.
Browsers parse URLs per this standard, not raw RFC 3986. Critical for client-side routing, form encoding, and cross-origin behavior.
Every HTTPS connection, SMTP/IMAP over TLS, OAuth token exchange, and API call uses TLS. It is the foundational security layer.
A one-line HTTP header that eliminates a class of downgrade attacks. Every public web app should set HSTS.