mail-auth playground

Single hop

MAIL FROM RCPT TO comma-separated

Message

Signed message

Multihop / revised

A forwarder changes a message and re-signs it, recording a recipe that lets a verifier reconstruct the previous instance. Uses the key, domain, selector and envelope above.

Original message (as received)

Modified message (to send)

Recipe (JSON)

New instance

Sign with DKIM1

Headers to sign comma-separated, in order Message

Signed message

Verify

Checks DKIM DKIM2 SPF DMARC

Remote IP EHLO host

MAIL FROM return-path; SPF + DMARC alignment RCPT TO comma-separated; DKIM2 envelope

Received message (full, with headers)

Signing identity

Domain Selector

Algorithm Private key (PEM)

No active key.

Private key (PEM)

Publish this DNS TXT record

Keys are generated locally and never transmitted. Demo only: do not reuse a key minted here on a real domain.

DNS source used by Verify

Resolver Format

Endpoint URL