SPF checks sending authorization. DKIM authenticates signed message content. MIDSIG adds an explicit domain-key binding for the Message-ID. Prepaid blockchain postage is in development: prove your domain, then pay 0.05 USDC per message per recipient.
Three moving parts. No flag day. Any receiving domain can start enforcing today.
Your domain publishes its Ed25519 public key in one DNS TXT record — the exact pattern DKIM already uses.
Every outgoing message carries a signature over (domain, Message-ID, timestamp). The binding survives relays.
The receiver checks the signature against DNS in microseconds. Forged domain = failed crypto = rejected.
# 1. publish (once) _midsig.example.com. 300 IN TXT "v=midsig1; k=ed25519; p=JwBWTqTtGzbFrFI/EEQJkguLJ1QeJI95mJiXf75n2bI=" # 2. every message carries X-Midsig: v=1; d=example.com; i=<abc123@example.com>; t=1720600000; s=<base64 sig> X-Midsig-Postage: v=1; n=000000000021f69e; x=0000097599…; b=20 # 3. receiver policy $ midsig verify --input mail.eml --required-bits 20 verdict: pass
| Attack | SPF | DKIM | MIDSIG |
|---|---|---|---|
| Forged From domain (phishing) | partial | partial | rejected |
| Stripped / unverified signing | ignorable | ignorable | quarantined |
| Mass spam from burner domains | no price requirement | no price requirement | optional work; payments in development |
| Message-ID integrity | not covered | when included in signed headers | explicitly bound |
SPF and DKIM stay. MIDSIG explicitly requires a signed Message-ID binding to the From domain. Version 1 adds optional computational work; monetary inbox pricing is a separate integration.
Real proof-of-work, minted in your browser, no server involved. Raise the bits and watch the compute cost climb. This legacy demo measures work, not money; it does not purchase stamps or establish a five-cent cost. Preview prepaid postage →
Hashcash (1997) invented PoW postage for email. Penny Black (2003) and Camram (2004) tried to make it mainstream. DKIM (2007) proved domain-key signing works at internet scale. MIDSIG is the explicit domain-to-Message-ID binding plus receiver policy. DKIM can also sign Message-ID; MIDSIG makes that binding an explicit requirement. DNS-published signatures establish the domain-key relationship, while blockchain settlement is the planned payment rail. The hard part was never crypto. It's convincing receiving domains to enforce it — which is why this is designed for incremental, unilateral adoption.