## DNS s1._colophon.acme.example. TXT "v=COLOPHON0; k=ed25519; p=fKF-JHnT8l0RiMibgA4oUYQKwUzyDxroUgxaRM6i6lI" ## Credential protected header {"alg":"EdDSA","kid":"s1","typ":"colophon-cred+jwt"} ## Credential claims { "cnf": { "jwk": { "crv": "Ed25519", "kty": "OKP", "x": "lC9PrkLW2QmPaKqAeeCY94OM3M75MeD9Uyg6oThgOLE" } }, "exp": 1793952000, "from": "maple-tiger-27@acme.example", "iat": 1793865600, "iss": "acme.example", "principal": { "id": "p_Xk29", "mode": "pseudonymous" }, "scope": "Books restaurant tables for one person, up to $500 per booking.", "sub": "ag_7Hq2" } ## Credential (compact) eyJhbGciOiJFZERTQSIsImtpZCI6InMxIiwidHlwIjoiY29sb3Bob24tY3JlZCtqd3QifQ.eyJjbmYiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoibEM5UHJrTFcyUW1QYUtxQWVlQ1k5NE9NM003NU1lRDlVeWc2b1RoZ09MRSJ9fSwiZXhwIjoxNzkzOTUyMDAwLCJmcm9tIjoibWFwbGUtdGlnZXItMjdAYWNtZS5leGFtcGxlIiwiaWF0IjoxNzkzODY1NjAwLCJpc3MiOiJhY21lLmV4YW1wbGUiLCJwcmluY2lwYWwiOnsiaWQiOiJwX1hrMjkiLCJtb2RlIjoicHNldWRvbnltb3VzIn0sInNjb3BlIjoiQm9va3MgcmVzdGF1cmFudCB0YWJsZXMgZm9yIG9uZSBwZXJzb24sIHVwIHRvICQ1MDAgcGVyIGJvb2tpbmcuIiwic3ViIjoiYWdfN0hxMiJ9.RXZMLCGGSf1h2H2vm6R62FUeHwEpBltl4vqouA43gL24o5cCzUMx8tskVEgDWEOKcBRYHw8q4PuxNfqmGDNNAw ## Signing input (JCS, one line) {"attachments":[{"sha256":"toHbGVby3dGckYAJkxBXPj9DGUnSCDiuIVwGV4oFR7w","type":"text/csv"}],"cc":[],"credential":"QyKlpHCC1M-TdbviC2iuOUhIpLY1HxufeJRGlEgEYSo","from":"maple-tiger-27@acme.example","reply_to":[],"subject":"Table for 2, Friday 7 November, 19:30","text":"JO-XRoNsBAPLwS_XAckdl7Jmo2DmjMagPnYpKzTgLkA","to":["reservations@bistro.example"],"v":0} ## Agent signature (tag b) eyJhbGciOiJFZERTQSIsImlhdCI6MTc5Mzg3MDEwMCwibm9uY2UiOiJabTl5TFdWNFlXMXdiR1V0YjI1c2VRIiwidHlwIjoiY29sb3Bob24tc2lnIn0..lmIvRov2v6U3-dRU-n08mC-Rh4s6lYP36XV3ve-OrsEkyXmHCjEIc2jLIgmzncjqL9KBWiF0Qqks4scg9ZS8Aw ## Message as sent, before the issuer's DKIM signature Colophon-Signature: v=0; c=eyJhbGciOiJFZERTQSIsImtpZCI6InMxIiwidHlwIjoiY29sb3Bob24tY3JlZCtqd3QifQ.eyJj bmYiOnsiandrIjp7ImNydiI6IkVkMjU1MTkiLCJrdHkiOiJPS1AiLCJ4IjoibEM5UHJrTFcyUW1QY UtxQWVlQ1k5NE9NM003NU1lRDlVeWc2b1RoZ09MRSJ9fSwiZXhwIjoxNzkzOTUyMDAwLCJmcm9tIj oibWFwbGUtdGlnZXItMjdAYWNtZS5leGFtcGxlIiwiaWF0IjoxNzkzODY1NjAwLCJpc3MiOiJhY21 lLmV4YW1wbGUiLCJwcmluY2lwYWwiOnsiaWQiOiJwX1hrMjkiLCJtb2RlIjoicHNldWRvbnltb3Vz In0sInNjb3BlIjoiQm9va3MgcmVzdGF1cmFudCB0YWJsZXMgZm9yIG9uZSBwZXJzb24sIHVwIHRvI CQ1MDAgcGVyIGJvb2tpbmcuIiwic3ViIjoiYWdfN0hxMiJ9.RXZMLCGGSf1h2H2vm6R62FUeHwEpB ltl4vqouA43gL24o5cCzUMx8tskVEgDWEOKcBRYHw8q4PuxNfqmGDNNAw; b=eyJhbGciOiJFZERTQSIsImlhdCI6MTc5Mzg3MDEwMCwibm9uY2UiOiJabTl5TFdWNFlXMXdiR1V 0YjI1c2VRIiwidHlwIjoiY29sb3Bob24tc2lnIn0..lmIvRov2v6U3-dRU-n08mC-Rh4s6lYP36XV 3ve-OrsEkyXmHCjEIc2jLIgmzncjqL9KBWiF0Qqks4scg9ZS8Aw From: Booking agent To: Reservations Subject: Table for 2, Friday 7 November, 19:30 Message-ID: Date: Thu, 05 Nov 2026 09:15:00 +0000 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="=_colophon_example_1" --=_colophon_example_1 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello, Could you hold a table for 2 this Friday, 7 November, at 19:30? One guest is vegetarian. Thank you --=_colophon_example_1 Content-Type: text/csv Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="booking.csv" MIME-Version: 1.0 ZGF0ZSx0aW1lLHBhcnR5CjIwMjYtMTEtMDcsMTk6MzAsMgo= --=_colophon_example_1-- ## Authentication-Results method result at mbx-reservations (ยง7.8) colophon=pass header.from=maple-tiger-27@acme.example header.sub=ag_7Hq2 header.s=s1 header.principal=pseudonymous header.cred=QyKlpHCC1M-TdbviC2iuOUhIpLY1HxufeJRGlEgEYSo ok verified replay: one mailbox, its alias, and a second mailbox ok replay ... delivery 2 ok replay ... delivery 3 ok verified ... delivery 4 ok verified Colophon-Signature refolded in transit ok verified display name changed ok verified trailing spaces on a body line ok verified charset name in capitals ok verified attachment renamed (names are not signed) ok verified subject refolded in transit ok verified spaces in the subject collapsed ok verified encoded words that decoders disagree on, signed as sent (never decoded) ok verified non-ASCII subject, as the signer encoded it ok verified unrelated TXT beside the record ok verified a Colophon record with a duplicate tag beside the record ok verified arrived exactly at exp + grace ok verified signed 1 hour before the credential's iat ok verified body in 8bit with non-ASCII text ok verified 8-bit octets inside a quoted-printable body ok verified lines end in LF alone ok verified a CR alone ends a body line ok verified empty display name in To ok verified quoted-pair in the charset ok verified empty parameter items ok verified attachment name in RFC 2231 form ok verified attachment parameter that does not parse (not read) ok verified boundary of 70 characters ok verified preamble and epilogue ok verified agent signature with another valid R (R need not be the RFC 8032 one) ok verified a non-ASCII Colophon record beside the record (not a Colophon record) ok verified 19 DNS misses for the host this hour ok signature_invalid subject changed ok signature_invalid subject re-encoded as an encoded word after signing ok signature_invalid text changed ok signature_invalid Reply-To added ok signature_invalid Cc added ok signature_invalid attachment changed ok signature_invalid body starts with a BOM (a BOM is content) ok layout HTML part added ok layout body in ISO-8859-1 ok layout charset alias utf8 ok layout body marked format=flowed ok layout unknown transfer encoding ok layout message/rfc822 attachment ok layout charset in RFC 2231 form ok layout transfer encoding on the multipart ok malformed second To field ok malformed second Subject field ok malformed second Content-Type in the body part ok malformed quoted local part in Cc ok malformed quoted local part in From ok malformed group in To ok malformed domain literal in Cc ok malformed non-ASCII domain in Cc ok malformed comment in To ok malformed unquoted @ in a display name ok malformed empty member in To ok malformed invalid UTF-8 in the subject ok malformed bad quoted-printable in the body ok malformed bad base64 in the attachment ok malformed missing v tag ok malformed tag name in capitals ok malformed padded base64url in c ok malformed a fraction in exp ok malformed a duplicate claim ok malformed credential over 2,048 octets ok malformed escaped surrogate in sub ok malformed noncharacter U+FFFF in scope ok malformed a CR alone in To ok malformed a header line that is not a field ok malformed charset given twice ok malformed a parameter without a value ok malformed boundary given twice ok malformed boundary of 71 characters ok malformed no close delimiter ok malformed two delimiter lines in a row ok malformed a line that starts with the delimiter ok malformed a delimiter in the epilogue ok multiple_signatures second Colophon-Signature ok no_signature no Colophon-Signature ok dkim_unaligned DKIM passes only for mail.acme.example ok verified DKIM passes for mail.acme.example and acme.example ok dkim_unaligned DKIM passes for two unaligned domains ok verified DKIM passes for ACME.EXAMPLE ok verified DKIM reported by header.i only, i= with an encoded octet ok dkim_unaligned DKIM reported by header.i only, i= with malformed quoted-printable ok verified DKIM reported by header.i only, no i=, domain in another case ok dkim_unaligned DKIM reported by header.i only, two fields with that identity ok verified DKIM reported by header.i only, beside a field whose tags do not parse ok unsupported_version v=1 ok dns_error DNS lookup failed ok key_not_found no record at the selector ok key_not_found two Colophon records ok key_not_found a k=rsa Colophon record beside the record ok key_not_found record without p ok key_not_found key of the wrong length ok key_not_found key in padded base64 ok key_revoked record with empty p= ok key_not_found the record with a non-ASCII tag added ok key_not_found domain key is the identity point (every credential verifies under it) ok key_not_found domain key of 32 zero octets (small order) ok key_not_found domain key not in canonical encoding ok dns_limited 20 DNS misses for the host this hour ok credential_invalid record holds a different key ok credential_invalid iss in capitals ok credential_invalid sub with a trailing newline ok credential_invalid sub as a number ok credential_invalid no from claim ok credential_invalid from claim not in canonical form ok credential_invalid lifetime of 25 hours ok credential_invalid bidi control in scope ok credential_invalid agent key of 31 octets ok credential_invalid agent key is the identity point (every signature verifies under it) ok signature_invalid agent signature with S + L in place of S ok signature_invalid agent signature with R the identity point ok signature_invalid agent signature that only a cofactored check accepts ok credential_expired arrived 1 second after exp + grace ok from_mismatch From is another address on the same host ok verified SMTPUTF8 local part, ASCII letters lowercased ok from_mismatch SMTPUTF8 local part with non-ASCII in another case ok signature_invalid signature iat 10 minutes after arrival ok not_addressed delivered to a mailbox not in To or Cc (Bcc) ok replay_unchecked replay store unavailable