Verified-sender attestation

Every message a wallet sends is signed, but a signature only proves which wallet sent it — not who stands behind the wallet. For an organization that sends mail at any scale (receipts, notifications, a newsletter), that gap is a credibility problem: nothing on chain connects its sending wallet to the name its recipients actually recognize. A verified-sender attestation closes the gap. It is an on-chain record in which a DNS domain vouches for a wallet address as a legitimate sender — “acme.com stands behind this wallet” — and anyone, MX operator or mail client alike, can look the binding up and verify it.

The vouching works the same way authorizing a domain by proof does: whoever controls the domain’s DNS generates a cryptographic proof of that control, and the chain checks the proof itself, on the spot — no administrator signs anything, and no delegate is in the loop. The organization proves domain control once, pays a one-time fee, and the attestation stands until revoked. The cost sits entirely on the sender’s side, matching the protocol’s positioning everywhere else: senders pay to be credible, recipients never pay anything.

An attestation is deliberately less than domain authorization, and independent of it. It confers no serving rights: an attested wallet gains no ability to route, inject, or operate mail for the domain, and the domain itself gains no standing as a mail suffix. It is a freestanding record — a domain that has never been registered as a SithBit mail domain at all can still attest its sending wallets, because attesting requires only proven DNS control, not an on-chain domain account. And it is not exclusive: a domain may attest any number of wallets, one record per (domain, wallet) pair, each independently revocable.

The fee is a flat, one-time charge to the postoffice — 0.01 SOL by default, tunable by the delegate up to a hard on-chain cap of 0.1 SOL (see the tunable-constants table). A proof that fails to verify charges nothing.

Revocation belongs to the attested wallet itself: it can close its own attestation at any time and reclaim the record’s rent. No other key — not even the domain’s — can reach the record, because its on-chain address derives from the attested wallet.

Since v0.39.0 an attestation also buys a concrete economic advantage: reputation-scaled first-contact pricing prices an attested sender’s first contact with any stranger at the discount floor immediately — the cheapest rate any reputation earns — instead of the mailbox’s full default postage. Proven domain control substitutes for a long postage spending record; a recipient-set price is never affected.

The binding is otherwise consumed from the terminal and by servers: the read-only sithbit domain attestation lookup and the gateway’s GetSenderAttestation call answer “is this wallet attested for this domain, and since when”. A verified-sender badge in the mail clients is planned but has not shipped yet.

For the commands — attesting, looking a record up, revoking, and tuning the fee — see Attest a verified sender.