Atproto labels
The Comail labeler publishes signed labels on member DIDs. Anyone can query these labels through the atproto network.
Why labels
Section titled “Why labels”Email authentication (DKIM, SPF, and DMARC) helps a recipient’s mail server check a message’s sending domain. Atproto labels report verified domain and relay membership status for a DID. They do not replace email authentication.
Other atproto services can read these labels. Comail does not promise that another service will use them or give mail preferential treatment.
The labels
Section titled “The labels”| Label | Issued when | Means |
|---|---|---|
verified-mail-operator |
Domain control is proven and the domain passes SPF, DKIM, and DMARC verification. | This DID controls a sending domain whose DNS authentication is in place. |
relay-member |
The verified attestation also opts in to relay membership. | This DID uses the Comail relay. |
clean-sender |
Optional. Requires recent delivery statistics and a fresh, mature green Sentinel evaluation with no alerts in the last 30 days. | This DID meets Comail’s current clean-sender checks. It does not affect SMTP authorization. |
Comail requires both verified-mail-operator and relay-member when it accepts a message. A missing label rejects the send. The relay caches label checks for five minutes for members with fewer than 100 sends, or one hour for established members. If the labeler is unavailable, an unexpired cached decision still applies; a failed refresh after expiry rejects the send.
MX records are not required for these labels: a sending-only domain can qualify without receiving mail.
The labels authorize the DID, not every From domain it might use. Each enrolled sending domain must also have current domain-control proof and valid mail DNS records.
Revocation
Section titled “Revocation”Labels can be negated. If a label no longer applies, the labeler publishes a negated version that supersedes the original. Examples:
- Your DKIM record stops resolving in DNS. The labeler reconciles every domain continuously, so it detects the drift on its next pass and negates
verified-mail-operatorautomatically, then re-applies it without any action from you if the record comes back. - You delete your relay-membership attestation from your PDS. The labeler negates
relay-member. - Your bounce or complaint rate spikes, Sentinel detects anomalous behavior, or its evidence becomes unavailable or stale. The labeler withdraws
clean-senderuntil all qualification conditions are met again. Existing accounts are reevaluated automatically; no manual replay is needed.
Querying labels
Section titled “Querying labels”Labels are queryable via the standard atproto XRPC endpoint com.atproto.label.queryLabels. The labeler is hosted at labeler.atmos.email with a did:key-style DID derived from its signing key.
curl "https://labeler.atmos.email/xrpc/com.atproto.label.queryLabels?uriPatterns=did:plc:your-did"The response is a page of queryLabels history, including positive and negated labels. Follow its cursor to read subsequent pages. The latest record for each subject and label value determines whether that label is active.
Use the query endpoint to check a member’s labels. A client’s profile display is not a substitute for reading their current state.