Documentation
¶
Overview ¶
Package sending owns the workspace Sending-domain authentication primitives (ADR 0010): per-domain DKIM keypair generation, the DNS records a user publishes, and DKIM DNS verification. It is transport-independent on purpose — no mail is sent here; the send path (internal/messaging) consumes the keys in a later slice.
Index ¶
- func DKIMRecord(selector, domain, pubTXT string) (host, value string)
- func DMARCRecord(domain string) (host, value string)
- func GenerateKeypair() (privPEM []byte, pubTXT string, err error)
- func NormalizeDomain(raw string) (string, bool)
- func PublicKeyFromPrivatePEM(privPEM []byte) (string, error)
- func SPFRecord(domain string) (host, value string)
- func VerifyDKIM(ctx context.Context, lookup TXTLookup, selector, domain, expectedPubTXT string) (bool, error)
- type TXTLookup
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DKIMRecord ¶
DKIMRecord returns the DNS host and value the user publishes to authenticate the domain. host is "<selector>._domainkey.<domain>".
func DMARCRecord ¶
DMARCRecord returns the suggested _dmarc TXT. Advisory bulk-readiness signal (ADR 0012): Gmail/Yahoo require at least p=none for bulk senders, but sphericon never mandates the stricter policies, which live on the organizational domain.
func GenerateKeypair ¶
GenerateKeypair mints a fresh RSA keypair for a Sending domain. It returns the PKCS#8 PEM private key (to be Tink-encrypted before storage) and the DKIM TXT record value carrying the public key ("v=DKIM1; k=rsa; p=<base64 DER>").
func NormalizeDomain ¶
NormalizeDomain validates raw as a registrable domain name (IDNA registration rules: label syntax, length limits, punycode) with at least one dot and not an IP address, and returns its lower-case ASCII (punycode) form, the form DNS records and stored domains use. ok is false for anything else.
func PublicKeyFromPrivatePEM ¶
PublicKeyFromPrivatePEM re-derives the DKIM TXT value from a stored private key PEM — used to check a published record against our key without persisting the public value separately.
func SPFRecord ¶
SPFRecord returns the suggested SPF TXT for the domain. Advisory only — native DKIM signing deliberately abstracts the sending IPs, so SPF does not gate (ADR 0010). host is the domain apex.
func VerifyDKIM ¶
func VerifyDKIM(ctx context.Context, lookup TXTLookup, selector, domain, expectedPubTXT string) (bool, error)
VerifyDKIM reports whether the DKIM TXT published at "<selector>._domainkey. <domain>" carries the same public key as expectedPubTXT. It is tolerant of TXT chunking (records split into multiple strings) and whitespace differences in the p= tag. A missing record verifies false with a nil error; a resolver failure returns the error.
Source Files