domainsecuritycheck

← Record Studio

SMIMEA

SMIMEA records (RFC 8162) bind an S/MIME certificate or public key to an email address in DNS — the S/MIME counterpart of TLSA/DANE. A receiving mail client can then discover and verify your certificate straight from DNSSEC-signed DNS. Paste your S/MIME certificate and this generator computes the record locally in your browser.

DNSSEC is a prerequisite. Like DANE, SMIMEA is only trustworthy in a DNSSEC-signed zone — the answer MUST validate as “Secure” (RFC 8162 §5), otherwise a client must treat the lookup as failed.
Experimental. RFC 8162 is an Experimental protocol and support in mail clients is limited. Publishing a record does no harm, but do not rely on every recipient acting on it yet. S/MIME itself is now specified by RFC 8551 (S/MIME 4.0).
Privacy. The record name contains a SHA-256 hash of the address’ local-part, so a published SMIMEA record reveals that the address exists and can be brute-forced for common local-parts. Sign the zone with NSEC3 (not NSEC) to make zone-walking harder (RFC 8162 §8). The owner name is <hash>._smimecert.<domain>, where the hash is the SHA-256 of the canonicalized local-part truncated to 28 octets; the local-part’s case is preserved.

Reads any SMIMEA record already published for this address (the local-part is hashed in your browser first). No certificate is fetched — S/MIME certificates are not served over a TLS handshake.

The full address. Its local-part (left of the @) is hashed to form the record name, with its case kept exactly as entered (RFC 8162 §3).

Paste your S/MIME (email) certificate. For a trust-anchor usage (DANE-TA 2 / PKIX-TA 0), also paste the issuer certificate as a second block — the issuer is pinned then.

Same registry as TLSA (RFC 6698). DANE (2/3) makes the DNSSEC-signed record the trust anchor, so a self-signed or privately issued certificate works; PKIX (0/1) additionally requires a public-CA chain. For publishing your own S/MIME certificate, DANE-EE (3) is the natural choice.

The default 3 0 0 publishes your entire certificate in DNS — that is the point of SMIMEA discovery: a sender can fetch your certificate and encrypt to you without already having it. A hash (e.g. 3 1 1) only lets a client verify a certificate it already holds. Full-certificate records are large, so make sure your DNS answers over TCP/EDNS.

Runs entirely in your browser. Record Studio · Verify the result with the domain security check