Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Create a domain

See Domains for what a domain is and the authority/delegate/payer role model behind domain creation. This page covers the sithbit domain create command.

sithbit domain create <domain> \
  [--authority-keypair <path>] \
  [--keypair <delegate keypair>] \
  [--payer-keypair <path>] \
  [--skip-preflight]

Arguments

  • <domain> (required) — the domain name to register, e.g. sithbit.com (case-insensitive; domain names are stored lowercased).
  • --authority-keypair <path> — the key that becomes this domain’s authority. Defaults to your configured default keypair when omitted.
  • --keypair <delegate keypair> — the delegate’s signing keypair. Required on every invocation: a signer that isn’t the postoffice’s standing delegate is refused with error 66, NotDelegate.
  • --payer-keypair <path> — funds the new domain account’s rent. Defaults to the delegate keypair when not given separately.
  • --skip-preflight (optional) — submits the transaction without a local simulation pass first.

Examples

Register a domain with a dedicated authority key, signed by the delegate:

sithbit domain create sithbit.com --authority-keypair ./authority.json

One authority key may hold any number of domains: domain accounts are keyed by the domain name alone, so a mail-server deployment that serves several domains registers each of them with the same authority key (its gateway’s signing keypair) and lists them all in [smtp] local_domains. Nothing else changes — the send path checks each recipient’s own domain account, and per-domain DKIM signers keep outbound signatures aligned.

Domain creation charges a fixed protocol fee — see Economics for the exact amount.

Note: a domain operator doesn’t have to ask the delegate holder to run this command by hand. See DNS setup and the domain-sithbit service for a self-service flow: prove ownership of a domain via a DNS TXT record, and the service submits this authorization on your behalf. A delegate-free, proof-carrying path — domain authorize — also exists on chain: its DNSSEC verifier mints the domain straight from a proof, the CLI stages and submits the witness end-to-end, and both routes charge the same authorization fee.