Expired (rotated-out) DKIM mail signing keys - private keys! These directories contain the private keys which were used in the past by this system as part of the DKIM email signing antispam system. After each key has been rotated out, the secret key is published here. This is to make emails sent by our users non-nonrepudiable: If you have what purports to be a leaked email from our system, the DKIM signature on it does not necessarily confirm that the email is genuine. The person giving you the "leaked email" might have edited it, or completely made it up, and then used one of these private keys to sign it. To obtain the private key for a particular public key, use the following procedure. Starting (say) with the DKIM selector TXT RR content: * Find the base64string following `p=`, which is the public key. * base64 decode it. * feed the resulting binary file through MD5. * Convert to hex. * The first two digits of the hex string are the directory name. * The filename is HEX.pem where HEX is the complete hex string, from above. * Strip README.txt from the end of the URL of this file and replace it with hh/xxxxx.pem, as computed above. Calculating the end of the URL can be done with a rune like this: echo 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2ycQ99x3kKz6aUKj' | base64 -d | md5sum | perl -pe 's/ .*//; s#^..#$&/$&#; s/$/.pem/' supposing MIIBIjAN... came from the DKIM selector.