SMIMEA record
An SMIMEA record publishes the S/MIME certificate for one email address, so senders can find it and encrypt mail to that person. It uses the same fields as TLSA, at a name derived from a hash of the mailbox. Support in mail apps is limited.
| Record type | SMIMEA |
|---|---|
| Type number | 53 |
| Used for | Certificates and keys |
| How common | Rare |
| Defined in | RFC 8162 |
Format
<sha256 of mailbox, 28 bytes hex>._smimecert.<domain> <ttl> IN SMIMEA <usage> <selector> <matching type> <data>
| Field | What it means | Accepted values |
|---|---|---|
| Name | The first 28 bytes of the SHA-256 hash of the part before the @, in hex, then ._smimecert. | 56 hex characters, then ._smimecert. |
| Usage, selector, matching type, data | As in TLSA. | See TLSA. |
Check an SMIMEA record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid SMIMEA record.
| Part | What it means |
|---|---|
| Namec93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert | A name under the domain. In a dashboard for example.com, “c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert” means c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert.example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeSMIMEA | S/MIME certificate for an email address. |
| Usage3 | 3 (DANE-EE): this exact server key or certificate, no CA needed. The usual choice for mail servers. |
| Selector0 | 0: the whole certificate. Changes on every renewal. |
| Matching type1 | 1: a SHA-256 hash, the usual choice. |
| Dataa2c3e4f6b8d0a2c4e6f8b0d2a4c6e8f0b2d4a6c8e0f2b4d6a8c0e2f4b6d8a0c2 | The certificate or key data, or its hash, in hex. |
Examples
Certificate for one mailbox
c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert 3600 IN SMIMEA 3 0 1 a2c3e4f6b8d0a2c4e6f8b0d2a4c6e8f0b2d4a6c8e0f2b4d6a8c0e2f4b6d8a0c2
The hash in the name stands for one local part, such as hugh.
Look up SMIMEA records
TTL
3600. How TTL works
Common mistakes
- Hashing the whole address instead of just the part before the @.
At your DNS host
- Cloudflare supports SMIMEA. Requires DNSSEC to be useful.
Questions
Do mail apps use SMIMEA?
A few do. Most S/MIME users still exchange certificates by sending a signed message first.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free