Documentation & DNS setup
1. Verify ownership
Publish a unique TXT value at _aprf-verify.example.com. This is APRF.io ownership verification, not a record defined by the APRF draft.
2. Publish a report destination
Domain-wide owner: _aprf._domainkey.example.com. Selector-specific owner: selector1._aprf._domainkey.example.com. Wildcard owner: *._aprf._domainkey.example.com. Value: v=APRFv1;rua=mailto:YOUR-TOKEN@reports.aprf.io;
3. Confirm external authorization
For selector1 and example.com, APRF.io must publish selector1.example.com._aprf.reports.aprf.io with exactly v=APRFv1; or v=APRFv1. Wildcard authorization is subject to normal DNS wildcard behavior. Live authorization is not active in this demo.
4. Optional SDI
The sdi=Header-Name,^ tag requests segmentation using a DKIM-signed header and one printable separator. The hierarchy has at most four elements. Providers may ignore SDI. Avoid personal information in segment names.
Understand the numbers
Values may be bucketed upper bounds; classification categories need not be disjoint. Engagement actions are not necessarily message counts. Do not infer rates or combine overlapping signing scopes. Provider version changes can break comparability.