keys.openpgp.org

About | News | Usage | FAQ | Stats | Privacy

Usage: WKD as a service

The Web Key Directory (WKD) is a standard for discovery of OpenPGP keys by email address, via the domain of its email provider. It is used to discover unknown keys in some email clients, such as GpgOL.

keys.openpgp.org can be used as a managed WKD service for any domain. To do so, the domain simply needs a CNAME record that delegates its openpgpkey subdomain to wkd.keys.openpgp.org. It should be possible to do this in the web interface of any DNS hoster.

Once enabled for a domain, its verified addresses will automatically be available for lookup via WKD.

The CNAME record should look like this:

$ drill openpgpkey.example.org ... openpgpkey.example.org. 300 IN CNAME wkd.keys.openpgp.org.

There is a simple status checker for testing the service:

$ curl 'https://wkd.keys.openpgp.org/status/?domain=openpgpkey.example.org' CNAME lookup ok: openpgpkey.example.org resolves to wkd.keys.openpgp.org

For testing key retrieval:

$ gpg --locate-keys --auto-key-locate clear,nodefault,wkd address@example.org

Background image retrieved from Subtle Patterns under CC BY-SA 3.0