Documentation
¶
Overview ¶
Package dkim decodes a DKIM public-key DNS record (the `<selector>._domainkey.<domain>` TXT record, RFC 6376 §3.6.1, with Ed25519 keys per RFC 8463) into a structured, forensic view.
A DKIM record is the public half of an email-signing key, and it is real pentest / IR / anti-spoofing loot: the `p=` tag carries the signing key, so its **algorithm and size** are directly readable — and a short RSA key is a classic, exploitable finding (a 512/768-bit DKIM key can be factored and the domain's mail forged, the well-documented 2012 mass-disclosure class). This decoder extracts the key, reports its size, flags weak keys against the RFC 8301 minimum, and surfaces the RSA modulus so the key chains straight into roca_detect (a ROCA-vulnerable DKIM key is likewise forgeable).
Wrap-vs-native: native — tag=value parsing + base64 + stdlib crypto/x509 to read the SubjectPublicKeyInfo. No new go.mod dependency. The key-size and modulus extraction are pinned against openssl-generated records and the RFC 8463 Ed25519 test vector.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
// Version is the v= tag (should be "DKIM1" when present).
Version string `json:"version,omitempty"`
// KeyType is the k= tag: "rsa" (default) or "ed25519".
KeyType string `json:"key_type"`
// KeyBits is the RSA modulus bit length, or 256 for Ed25519.
KeyBits int `json:"key_bits,omitempty"`
// ModulusHex is the RSA modulus (hex) — surfaced for roca_detect chaining.
ModulusHex string `json:"modulus_hex,omitempty"`
// HashAlgs is the h= acceptable-hash list (e.g. ["sha256"]).
HashAlgs []string `json:"hash_algs,omitempty"`
// ServiceTypes is the s= service-type list (default ["*"]).
ServiceTypes []string `json:"service_types,omitempty"`
// Flags is the raw t= flag list.
Flags []string `json:"flags,omitempty"`
// Testing is t=y (the domain is testing DKIM; verifiers must not treat
// signed/unsigned differently).
Testing bool `json:"testing,omitempty"`
// StrictDomain is t=s (no subdomain wildcarding of the signing domain).
StrictDomain bool `json:"strict_domain,omitempty"`
// Notes is the n= human-readable note.
Notes string `json:"notes,omitempty"`
// Revoked is true when p= is empty (the key has been revoked).
Revoked bool `json:"revoked,omitempty"`
// Warnings carries objective, RFC-anchored observations (weak key, etc.).
Warnings []string `json:"warnings,omitempty"`
// Note carries interpretation guidance.
Note string `json:"note,omitempty"`
}
Result is the decoded DKIM record.
Source Files