Struct DkimSignConfig 

pub struct DkimSignConfig {
    pub selector: String,
    pub domain: String,
    pub private_key_pem: String,
    pub extra_keys: HashMap<String, DkimDomainKey>,
    /* private fields */
}

DKIM signing configuration.

The PKCS#8 PEM is parsed into an RsaSigningKey lazily on first use and cached for the lifetime of this config — important on the hot outbound path where every delivered message triggers a sign call. Existing struct-literal callers need to add ..Default::default() (the parsed-key cache is non-public, populated on demand).

v3 (mailrs-dkim 3.0): RsaSigningKey wraps aws-lc-rs’s RsaKeyPair, so per-sign cost dropped from ~1.5 ms (pure-Rust rsa crate) to ~0.5 ms.

v4 (2026-06-03): added extra_keys to support per-domain DKIM signing. sign parses the message’s From: header and looks up the matching key by domain (exact match → ancestor-domain suffix walk → default). The pre-v4 single-domain config (just selector / domain / private_key_pem) keeps working unchanged — extra_keys empty = old behaviour.

Fields

selector: String

DKIM selector — the label under <selector>._domainkey.<domain>. Used as the default when the message’s From: domain doesn’t match any extra_keys entry.

domain: String

Signing domain (matches the d= tag in the DKIM-Signature header). Default d= when no extra_keys entry matches.

private_key_pem: String

Private RSA key in PKCS#8 PEM form.

extra_keys: HashMap<String, DkimDomainKey>

Extra DKIM keys keyed by signing domain, used when the message’s From: header domain matches an entry (exact match first, then ancestor-suffix walk — e.g. mail.example.com falls back to example.com). When no entry matches, signing uses the default selector/domain/private_key_pem above.

Keep extra_keys.is_empty() for the single-domain config.

Implementations

impl DkimSignConfig

pub fn sign(&self, message: &[u8]) -> Result<Vec<u8>, String>

Sign a message, prepending the DKIM-Signature header.

Parses the message’s From: header to determine the signing domain via key_for_from_domain. If no From: header is present (or it’s malformed enough that no domain can be extracted), falls back to the default domain/selector/key on this config.

Trait Implementations

impl Clone for DkimSignConfig

fn clone(&self) -> DkimSignConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DkimSignConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DkimSignConfig

fn default() -> DkimSignConfig

Returns the “default value” for a type.