Contracts promise. Architecture guarantees. The questions sovereignty officers ask (who holds the keys, who controls the namespace, who could be compelled) start with you: your DNS anchors the domain, your devices hold the mail keys, and any authority we hold on your domain is one your signed record grants and you can withdraw.
Your domain publishes its own trust anchor: one _dmcn record in your zone. We provide no DNS service and hold no zone, and nothing we sign counts for your domain unless that record vouches for it. The issuing key our service holds can create new addresses on your domain because your record grants it that. It cannot move an existing address to a different key: every node refuses that unless your domain root has signed the old key's removal, so a stolen copy of our key cannot take over a mailbox.
Hosting your domain takes two explicit cryptographic consents: your signed domain record enrols us as an issuer, and our fleet signs a permit to serve your domain. Neither alone is enough, and either side can withdraw: you by pointing your DNS record elsewhere and re-signing your domain record without our enrolment, we by withdrawing the permit.
Mail between DMCN users is encrypted on your devices, and a managed domain can make its own administrator the custodian of account keys. We hold no account keys and no key escrow, so stored DMCN-to-DMCN mail is ciphertext we cannot open. What we do hold, and could be ordered to produce, is delivery metadata (who wrote to whom, and when), account and billing records, and the mail that crosses our bridge to and from ordinary email.
Addresses are yours: on your own domain you hold the root key and the DNS, so the address stays the same if routing moves to another operator. Taking your stored mail with you needs the mailbox export we are building.
Identity resolves per domain, like MX records: there is no shared global registry for someone else's outage, government or majority to dominate. Your DNS names the fleet that hosts you, and you can point it elsewhere.
Identity records are self-certifying and the protocol is open: if DMCN vanished tomorrow, your keys and your domain would still be yours, and any operator running the open protocol could serve them again. Learn more about the protocol