# SMIMEA record

An SMIMEA record publishes the S/MIME certificate for one email address, so senders can find it and encrypt mail to that person. It uses the same fields as TLSA, at a name derived from a hash of the mailbox. Support in mail apps is limited.

- Record type: SMIMEA
- Type number: 53
- Used for: Certificates and keys
- How common: Rare
- Defined in: RFC 8162

## Format

```
<sha256 of mailbox, 28 bytes hex>._smimecert.<domain> <ttl> IN SMIMEA <usage> <selector> <matching type> <data>
```

| Field | What it means | Accepted values |
| --- | --- | --- |
| Name | The first 28 bytes of the SHA-256 hash of the part before the @, in hex, then ._smimecert. | 56 hex characters, then `._smimecert`. |
| Usage, selector, matching type, data | As in TLSA. | See [TLSA](https://lemon.domains/dns-records/tlsa). |

## Examples

### Certificate for one mailbox

```
c93f1e400f26708f98cb19d936620da35eec8f72e57f9eec01c1afd6._smimecert 3600 IN SMIMEA 3 0 1 a2c3e4f6b8d0a2c4e6f8b0d2a4c6e8f0b2d4a6c8e0f2b4d6a8c0e2f4b6d8a0c2
```

The hash in the name stands for one local part, such as hugh.

## TTL

3600.

## Common mistakes

- Hashing the whole address instead of just the part before the @.

## At your DNS host

- Cloudflare supports SMIMEA. Requires DNSSEC to be useful.

## Questions

### Do mail apps use SMIMEA?

A few do. Most S/MIME users still exchange certificates by sending a signed message first.

## Related

- [OPENPGPKEY record](https://lemon.domains/dns-records/openpgpkey.md)
- [TLSA record](https://lemon.domains/dns-records/tlsa.md)
- [CERT record](https://lemon.domains/dns-records/cert.md)

Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/smimea