ZI² Books
Attestation the sender cannot fake.
SPF, DKIM and DMARC verify a domain. ZI² Certified verifies the server. Together they close the gap that lets an attacker send a convincing spoof from rented infrastructure.
The gap
Modern phishing rarely fails authentication. An attacker registers a lookalike domain, hosts it on a clean address, publishes correct SPF, DKIM and DMARC, and sends. Every check passes. The mail is still a fraud.
The missing signal is server identity. SPF says an address may send for a domain. DKIM says the content was not altered. Neither says this is the machine that always sends for us, and you have seen its key before.
Address
May this address send?
Content
Was the body altered?
Policy
What to do on failure?
Server
Which machine sent it?
How it works
Generate a keypair
One command on the sending server. The private key never leaves the machine. The public key gets a short identifier, the
kid.Publish the public key
A single TXT record at
_zi2cert.<kid>.<domain>carries the base64 public key. The same DNS plane as DKIM, so there is no new infrastructure to run.Sign every message
The sending server signs the sender, recipient, subject, date, message id and a body hash, then adds an
X-ZI2-Certifiedheader carrying the signature, the kid and the server hostname.Receivers verify in milliseconds
The receiving server fetches the key, verifies the signature and records the result. After a few certified messages the sender reaches a trust level, and anything claiming that domain without a valid signature stands out as a spoof.
What it catches
The attacks below all pass SPF, DKIM and DMARC. Each one is caught by a server signature, because the signature answers a question the other three never ask.
| Attack | SPF, DKIM, DMARC | ZI² Certified |
|---|---|---|
| Spoof from another tenant on the same server | All pass | Detected |
| Lookalike domain, correctly configured | All pass | Detected |
| Body tampering | Partial | Full SHA-256 |
| Replay of a captured message | Vulnerable | Nonce and timestamp |
| Recipient forgery | Not checked | Signed in the payload |
| Missing signature from a known local domain | Ambiguous | Treated as spoofed |
Install it
Two steps on the sending server, one DNS record. Existing mail keeps flowing throughout: an unsigned message is treated exactly as it is today.
Trust levels
Level 3 same server. Level 2 key exchanged directly. Level 1 key found in DNS. Level 0 no signature.
Check where you stand
Run the free check against your domain first. It reads only public DNS.
Ask for the installer
The signing software and key tooling are supplied on request, with the DNS record to publish.