domain's SMTP server to send email. How do I use DomainKeys?

DomainKeys relies on the domain administrator to authorize the use of the domain in an email. If you can not use the domain's authorized SMTP server because of port 25 blocking, you have a number of options.

- You should encourage your domain to accept submission services on port 587. Your domain administrator should try to control authorization of the domain. Giving users a path to submit mail will help do this. Yahoo! Mail recently began offering a submission server on port 587.

- You may be able to convince the domain administrator to grant you a user specific key. With a DomainKey, it should be possible to sign your messages using your mail client or any submission server. In fact, you could ask your submission service if you could give them a private key to use to sign your domain's mail.

- You could consider using other headers to convey your identity. For instance, the Reply-to: header allows a recipient's mail client to choose an address to which replies should be sent. The Sender: header defines the address that injects the message into the SMTP stream. You might consider sending your message From: your domain, with the Sender: header set to the address of your submission service. Be aware however, that this strategy may be viewed suspiciously by anti-spam filters, as it may become a tactic for spammers and phishers.

- Finally, you could choose to send unauthenticated mail. While this will not be a good long term strategy, it will certainly take quite a while before the vast majority of Internet email is authenticated. If you choose this path, you should carefully monitor the amount of authenticated mail over time to ensure that this strategy does not impact the deliverability of your email.

How do I deploy DomainKeys?

After installing a DomainKey aware MTA, there are several key distribution options from which to choose. Once chosen, the public key portion should be published to your domain's _domainkey subdomain's TXT record, and the private key inserted into your MTA. You can test your DNS record policy and selector, and there are several autoresponding email addresses to test your implementations.

Which mail transfer agents (MTAs) support DomainKeys?

Sendmail has released a milter implementation for both the commercial and freeware versions of their MTA. A Qmail patch, an Exim version as well as a qpsmtpd plugin are also available. CERN, the creators of the WWW has released a C# library for use in MS Exchange 2003. Port 25's PowerMTA, Etype.net's acSMTP, ActivSoftware's XMServer, OmniTI's Ecelerity, StrongMail, Alt-N Technology's MDaemon MTA for Windows, Postfix, Communigate Pro, IronPort, and Merak Mail all have DomainKey versions of their software. Finally, Yahoo! has released an open source reference implementation for DomainKeys that can be plugged into other MTAs.

Who implements DomainKeys

DomainKeys will typically be implemented/enabled by the team within a company, ISP, or email service provider that deploys and runs the incoming and outgoing mail servers. Some companies may have service providers that handle their email. As MTA vendors add support for DomainKeys to their products, the implementation of DomainKeys will become simpler.

How does DomainKeys work with mailing lists

Mailing lists that do not change the content or re-arrange or append headers will be DomainKey compatible with no changes required. Mailing lists that change the message and headers should re-sign the message with their own private key and claim authorship of the message.

Why not just use S/MIME

S/MIME was developed for user-to-user message signing and encryption and by design should be independent of the sending and receiving servers. We believe that DomainKeys should be a natural server-to-server complement to S/MIME and not a replacement. Additionally, since S/MIME is used by many security-conscious industries, we need to ensure that the two technologies can work together without breaking each other. Finally, S/MIME is not yet supported by many of the email services, client software, and server software used across the Internet, and in Yahoo!'s opinion, that standardization effort would be much more difficult than the standardization of DomainKeys.

How are DomainKeys revoked?

DomainKeys allows for multiple public keys to be published in DNS at the same time. This allows companies to use different key pairs for the various mail servers they run and also to easily revoke, replace, or expire keys at their convenience. Thus, the domain owner may revoke a public key and shift to signing with a new pair at any time.