SMIMEARecordValidator

SMIMEA (S/MIME Certificate Association) record validator

Validates SMIMEA records according to:

• RFC 8162: Using Secure DNS to Associate Certificates with Domain Names for S/MIME

SMIMEA records enable secure discovery and verification of S/MIME certificates through DNS, with DNSSEC providing the trust mechanism.

Format:

Example: 3 1 1 a0b9b16969687adf0323d15048fb4fa4c354c4e01594e8956522cfe3566cae74

Where:

• usage: Certificate usage type

  • 0 = PKIX-TA: CA constraint (trust anchor cert must be in validation path)
  • 1 = PKIX-EE: End entity cert constraint (cert must pass PKIX validation)
  • 2 = DANE-TA: Trust anchor assertion (trust anchor to be used for validation)
  • 3 = DANE-EE: Domain-issued certificate (cert used directly, not validated)

• selector: Which part of the cert is matched

  • 0 = Full certificate (entire cert is matched)
  • 1 = SubjectPublicKeyInfo (only the public key is matched)

• matching-type: How the cert data is matched

  • 0 = Exact match (no hash, full data)
  • 1 = SHA-256 hash (recommended)
  • 2 = SHA-512 hash

• certificate-data: Hexadecimal representation of the data to match

Domain name format:

• ._smimecert.
• Example: c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com

Security considerations:

• SMIMEA records REQUIRE DNSSEC for any security benefit
• Without DNSSEC validation, SMIMEA offers no security advantage
• Usage type 3 (DANE-EE) with selector 1 (SubjectPublicKeyInfo) is recommended
• Use SHA-256 (matching type 1) for the best balance of security and compatibility
• IMPORTANT: RFC 8162 is currently an EXPERIMENTAL protocol