DNS key verification
04The receiver resolves the selector under the signing domain and verifies the signature.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 6.1 ↗
RFC 6376 · § 6.1EXAMPLE
3 / 3
03
Report the result
A pass establishes signed-input integrity for that signing domain, not delivery safety.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Query mail._domainkey.example.org for the illustrated selector.
- Query mail._domainkey.example.org for the illustrated selector.
- Verify the body hash and signature with the published key.
- Missing keys, altered signed content, or invalid algorithms prevent an ordinary valid signature result.
Examples are illustrative. Consult the linked RFC and its errata for implementation details.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy