Skip to content
Control Plane Labs
Search

SMIMEA record

Associates an email address with a certificate or public-key hash so S/MIME clients can discover and authenticate the intended key.

Written and maintained by Ben Ennis

Last reviewed July 27, 2026 · How we verify this

Zone-file example

selector._smimecert.example.com. 3600 IN SMIMEA 3 1 1 9F2A...

Typical uses

  • Publishing a recipient's S/MIME certificate association under a DNS-controlled name
  • Using a certificate fingerprint instead of distributing a full certificate in every address book
  • Supporting certificate discovery for automated mail clients and managed enterprise domains
  • Combining key association with DNSSEC where the deployment needs authenticated DNS answers

When it breaks, check

  • The owner name encodes the local-part hash and the _smimecert label, not the mailbox as plain text
  • Selector, matching type, and association data must agree with the certificate lookup profile
  • A DNS answer does not make a certificate trusted; the client still applies S/MIME policy and validity checks
  • Test the exact hashed owner name and remember that uppercase and lowercase mailbox handling is profile-specific

What the SMIMEA record does

SMIMEA adapts the certificate-association model used by TLSA to email identities. The owner name is derived from the mailbox’s local part and the domain, then placed below the _smimecert label. Its RDATA identifies how to select certificate material, how to match it, and the association bytes to compare. A profile can publish a full certificate, a subject-public-key identifier, or a hash.

That division matters operationally. The record can tell a client which key belongs to an address, but it is not a blanket replacement for S/MIME trust stores. A client must follow the profile’s mailbox canonicalization rules, validate the answer’s authenticity, and apply its local policy before encrypting or verifying mail.

Zone-file and wire format

The RDATA is certificate usage selector matching type certificate association data. The selector chooses the certificate or public key material, while the matching type says whether the association is exact data or a hash. The owner name is not normally a readable mailbox: the client computes the profile-defined hash of the local part and appends ._smimecert to the domain.

; illustrative record; the owner is profile-derived
<local-part-hash>._smimecert.example.com. 3600 IN SMIMEA \\
  3 1 1 9f2a7c1d...

Common uses

SMIMEA is most valuable when a domain controls both mail policy and DNS and wants automated clients to find keys without a proprietary directory. It can complement enterprise address books, certificate renewal automation, and DNSSEC-backed key discovery. It is not a generic public certificate search. For web-server certificates, use the TLS inspector; for mail authentication policy, compare DKIM, DMARC, and MX records.

Troubleshooting

Do not begin with the visible address as the query. First implement the profile’s local-part canonicalization and hash, then query that exact owner with DNSSEC validation where required. Check that the selector and matching type correspond to the certificate association you published. A record can be syntactically valid and still be unusable if the client hashed a different spelling of the mailbox.

If discovery works but verification fails, inspect certificate validity dates, key usage, the client trust store, and the DNSSEC chain separately. An SMIMEA answer is one input to that decision, not the decision itself.

# Replace the placeholder with the profile-derived local-part hash.
dig <local-part-hash>._smimecert.example.com SMIMEA +dnssec +noall +answer

# Check the DNSSEC status in the response.
dig <local-part-hash>._smimecert.example.com SMIMEA +dnssec

The defining RFC

SMIMEA is DNS type 53, defined by RFC 8162. The RFC specifies the owner-name construction for an S/MIME address and reuses the certificate-association fields defined by RFC 6698. The record’s security properties depend on the deployment: RFC 8162 discusses DNSSEC validation and warns that an unsigned answer is not an authenticated binding. Query the result with the site’s DNS lookup tool and verify it against the mail client’s profile.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types