dmcndcli

Overview ¶

Binary dmcndcli is the operator tool for a dmcnd deployment, and — on a live domain — the only thing that can issue anything.

It is meant to run on a DIFFERENT machine from the node, ideally one that stays offline. The domain root key is created here and never leaves: the node is given a signed bundle of public material and has no way to mint an address on its own, so breaching the node does not get an attacker the ability to create or re-point mailboxes.

domain init      mint the domain root, sign its authority record, print the DNS record
domain publish   push that record to a running node (the only step that talks to the node)
domain dns       reprint the DNS record from the existing root
petition show    look up one mailbox petition by the code its petitioner gave you
petition assign  assign an address to a petitioned key, signing with the offline root
bridge issue     sign the credential that lets a node act as an SMTP bridge for the domain
bridge dkim-keygen
                 mint the outbound DKIM key and print the DNS records to publish
bridge verify-audit
                 re-check a copied audit log against the bridge's peer ID
remove-address   root-sign a tombstone freeing an address, so it can be bound to a new key
peer-id          print the libp2p peer ID for an identity key

The node's own `dmcnd peer-id` covers the peer ID on the node side; the copy here is for keys held on this machine.