dmcn protocol GitHub Read the spec
Spec Quickstart FAQ Go module
GitHub
DMCNP · Apache-2.0 · reference implementation in Go

Cryptographic identity replaces SMTP-style trust.

An open, peer-to-peer, end-to-end-encrypted store-and-forward mail protocol. Every address is a keypair whose self-certifying record is served by its own domain's fleet and discovered through DNS — so there is no global directory to censor, no authority to petition, and no server that can read your mail.

Read the spec Run a node Source
A domain joins the network by publishing one DNS record
_dmcn.example.com  TXT  "dmcn-verification=v1; fp=<40-hex>; seed=/ip4/…/tcp/7400/p2p/<peerID>"

fp= is the trust anchor; seed= is where to dial. Records are self-certifying, so a wrong or hostile fleet is a denial-of-service risk — never a forgery vector.

The layered stack

Seven layers, each specified in full. An implementation that speaks all of them interoperates with the network.

User identity
An Ed25519 signing key plus an X25519 key-exchange key. The address is local@domain, and its self-certifying IdentityRecord is served by that domain's own fleet.
Resolution
DNS _dmcn.<domain> carries a fingerprint anchor and seed multiaddrs. Signed records are fetched from the domain's fleet over libp2p and verified against the anchor — no global directory to censor.
Message model
PlaintextMessage → SignedMessage → EncryptedEnvelope. A per-message AES-256-GCM content key, X25519-wrapped per recipient, split into a listable header and a body, padded to size-class buckets.
Routing
Operator-signed RelayHints name the relays holding a mailbox. Because they sit outside the owner's self-signature, an operator can re-point routing without the owner's key — and the address never changes.
Relay service
/dmcn/relay/1.0.0 — store, fetch, mailbox operations, record resolution and publication, onion forwarding. Length-prefixed protobuf over libp2p streams.
Trust & federation
A credential PKI anchored in DNS. Each domain has a DomainAuthorityRecord delegating to issuers under a monotone grants calculus; peers exchange and verify credentials at /dmcn/join.
Transport
libp2p streams. Discovery is DNS-seeded — there is deliberately no DHT, because a resourced hostile majority in a global overlay could withhold records.

What the core specifies

Everything needed to interoperate: resolve an address, verify an identity, send mail, receive mail. Identity and addressing, the credential PKI, the three-layer message model, routing, the libp2p wire protocols, and two optional capabilities — onion routing and the SMTP bridge.

What it deliberately leaves out

Fleet administration, hosting permits, provisioning, entitlements and client conveniences are extensions. They attach through designed surfaces — separate protocol IDs, operator credentials, ext.-prefixed attributes — and never through new core fields.

Ignore every extension and you still interoperate

That is the rule the split exists to protect. Extensions may add operator capability; they may never add an interop requirement. Vacated field and arm numbers stay reserved forever.

Two names, two meanings#

DMCN — the Decentralized Mesh Communication Network — is the network: the set of interoperating deployments that actually exchange mail. DMCNP, the DMCN Protocol, is what they speak, and it is what this site specifies.

The distinction matters for a practical reason. You are free to implement DMCNP under any name you like, and the Apache-2.0 license grants you everything you need to do it — including an express patent grant with defensive termination. Calling your implementation "DMCNP" means it genuinely conforms; calling it part of "DMCN" additionally means it actually interoperates. The license covers the code and the schema; it does not hand over either name.

What "no global directory" buys you#

Most decentralized messaging designs put identity in a shared overlay — a DHT, a chain, a consensus set. DMCNP deliberately does not, and the reason is availability rather than elegance: a sufficiently resourced hostile majority in a global overlay can withhold or censor records, which is a fatal flaw for something meant to replace email.

Instead, resolution works the way mail delivery already works. A domain publishes a _dmcn TXT record naming its trust anchor and a few seed nodes; a sender reads it, dials the domain's own fleet, fetches the signed identity record and verifies it against the anchor from DNS. A domain is served only by its own fleet. Because records are self-certifying, a wrong or hostile fleet can deny you service — it can never forge an identity.

Status#

This is a reference snapshot, not a frozen specification. The schema is versioned alongside the reference implementation, which remains authoritative wherever the two disagree, and the daemon is an honest proof of concept — embedded stores, dev-oriented defaults — rather than a hardened production deployment. The wire schema is the compatibility contract; the internal/ packages carry no API-stability promise.

Run the whole protocol as one binary.

A serving node, webmail, an optional SMTP bridge and onion transport — self-hosted, zero-knowledge, one process for one domain.

Quickstart Go module