OPENPGPKEYRecordValidator
class OPENPGPKEYRecordValidator implements DnsRecordValidatorInterface (View source)
OPENPGPKEY record validator
Validates OPENPGPKEY records according to:
- RFC 7929: DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP
- RFC 9580: OpenPGP Message Format (obsoletes RFC 4880)
OPENPGPKEY records store OpenPGP public keys in DNS for email address verification and encryption. These records are part of the DANE (DNS-Based Authentication of Named Entities) standard for publishing public keys in DNS.
Format:
Example: mDMEXEcE6RYJKwYBBAHaRw8BAQdArjWwk3FAqyiFbFBKT4TzXcVBqPTB3gmzlC...
Domain name format:
-
._openpgpkey. - Example: c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._openpgpkey.example.com
Where:
- The local part of the email address (before @) is hashed with SHA-256
- The hash is truncated to 28 octets (56 hex characters)
- The result is prepended to the label "_openpgpkey"
- The domain part of the email follows
Security considerations:
- OPENPGPKEY records REQUIRE DNSSEC for any security benefit
- Without DNSSEC validation, OPENPGPKEY offers no security advantage
- OPENPGPKEY records are not a replacement for the OpenPGP Web of Trust
- Applications should use "minimal key export" format to keep records small
- Type code: 61 (IANA-assigned)
- OPENPGPKEY records are EXPERIMENTAL per RFC 7929
Methods
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates OPENPGPKEY record content
Details
__construct(ConfigurationManager $config)
No description
ValidationResult
validate(string $content, string $name, mixed $prio, int|string|null $ttl, int $defaultTTL, mixed ...$args)
Validates OPENPGPKEY record content