HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
robertdavidgraham
hunter-dkim
Python2020–2025
robertdavidgraham / hunter-dkim

hunter-dkim

Discusses how to verify DKIM signatures in old emails, namely one of the Hunter Biden emails in the news

Explore on GitHubRead Hacker News discussions
24Distinct people
29Mentions
0Explicit recommenders
101GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Discusses how to verify DKIM signatures in old emails, namely one of the Hunter Biden emails in the news

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year29 dated mentions

Observed mentions: 2020-10-30 04:59:25 UTC to 2025-10-02 19:14:11 UTC.

0510152020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 17 mentions; 3 submissions, 14 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC17314
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC606
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC303
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC000
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC202
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC101

What Hacker News says

29 sources
acdha·Oct 2, 2025
They at least were not historically archived. This came up during the Hunter Biden laptop investigation where people were able to verify some of the messages only because the Gmail key was archived in many places because that service is so popular. I’m not aware of anyone making a comprehensive archive but I’d be unsurprised if someone did based on news like that. https://github.com/robertdavidgraham/hunter-dkim#but-gmails-... EDIT: this one exists but is incomplete: https://archive.prove.email/about
In Email immutability matters more in a world with AI
petertodd·Oct 17, 2024
> OpenTimestamps alone can not currently prove anything because TLS session keys are symmetric. Timestamps can prove that the data existed prior to there being a known reason to modify it. While that's not as good as direct signing, that's often still enough to be very useful. The statement that OTS "can not currently prove anything" is incorrect. A really good example of this is the Hunter Biden email verification. I used OpenTimestamps to prove that the DKIM key that signed the email was in fact used by Google at the time, by providing a Google-signed email that had been timestamped years ago: https://github.com/robertdavidgraham/hunter-dkim/tree/main/o... That's convincing evidence, because it's highly implausible that I would have been working to fake Hunter's emails years before they even came up as an election issue.
In ArchiveBox is evolving: the future of self-hosted internet archives
midmagico·Oct 10, 2024
Most people have no way to more-deeply authenticate those emails because you didn't provide headers. Many people, myself included, would love some way to better-rule-out whether parts of the messages had been elided, for example. A DKIM signature would have been a perfect integrity check of the message. It's just good protocol. As a result of timestamping emails with their DKIM into Bitcoin, now even rotated, broken, or released keys can be used to partially authenticate e.g. Google messages. You can see this for example in this project here: https://github.com/robertdavidgraham/hunter-dkim And in particular, here: https://github.com/robertdavidgraham/hunter-dkim/pull/5 So you see, even historical DKIM signatures can act as strong authentication.
In HBO Documentary Suggests Bitcoin Creator Satoshi Nakamoto Is Peter Todd
hunterb123·Mar 4, 2022
Not to mention: - The DKIM hashes of the emails on the laptop were verified. - The pictures on the laptop contain him in it doing various illicit activities. - His business partner came out against him. - He won't deny its inauthentic, he said it "could be". - There's a video of him talking to a Russian prostitute saying they stole his laptop and he's worried it'll be used to blackmail his father who is running for President. https://github.com/robertdavidgraham/hunter-dkim https://www.dailymail.co.uk/video/hunterbiden/video-2479077/... https://nypost.com/2021/04/02/hunter-biden-says-laptop-at-ce...
In Russia to punish ‘fake news’ about Ukraine war with 15 years’ jail
throwaway4china·Apr 22, 2021
> After obtaining a copy of the hard drive, DailyMail.com commissioned top cyber forensics experts Maryman & Associates to analyze its data and determine whether the laptop's contents were real. Company name is listed. You'd have to go ask the cyber-firm they used, any outlet could verify it and write a story debunking it if they wanted. Something tells me they don't want to because they know it's true. An email from the laptop has been DKIM validated, here's the repo: https://github.com/robertdavidgraham/hunter-dkim What are you suggesting was made up?
In Daily Mail owner sues Google over search results
throwaway4china·Apr 21, 2021
Projection. This is scary to you because you're not allowed to know it's true. Your President and his son are corrupt. --- to others in the thread --- > After obtaining a copy of the hard drive, DailyMail.com commissioned top cyber forensics experts Maryman & Associates to analyze its data and determine whether the laptop's contents were real. Company name is listed. You'd have to go ask the cyber-firm they used, any outlet could verify it and write a story debunking it if they wanted. Something tells me they don't want to because they know it's true. An email from the laptop has been DKIM validated, here's the repo: https://github.com/robertdavidgraham/hunter-dkim What are you suggesting was made up?
In Daily Mail owner sues Google over search results
vannevar·Mar 19, 2021
AFAIK, only a single email was verified this way, and it is innocuous, only suggesting that a Burisma executive met Joe Biden sometime through Hunter. https://github.com/robertdavidgraham/hunter-dkim Graham notes upfront: "Remember that while the email is validated, the context isn't. It's possible this reflects a secret meeting to conspire with Vice President Biden. Or, it's possible the guy attended one of the many Washington D.C. social functions whereby people shake hands with politicians and exchange pleasantries. As Richelieu is claimed to have said 'Give me six words by the most honest of men and I'll find something to hang him by'. Give me an email dump from the most honest of persons, and I'll pull one out of context to hang them in the court of social media."
In Greenwald: Yesterday Journalists Spread a Significant Lie All over Twitter
afuchs·Jan 11, 2021
> https://github.com/robertdavidgraham/hunter-dkim That appears to be one single email with limited context. The README.md in that repo outright states that the context for the email is absent and does not necessarily provide concrete proof of any specific narrative: > ... Remember that while the email is validated, the context isn't. It's possible this reflects a secret meeting to conspire with Vice President Biden. Or, it's possible the guy attended one of the many Washington D.C. social functions whereby people shake hands with politicians and exchange pleasantries. As Richelieu is claimed to have said "Give me six words by the most honest of men and I'll find something to hang him by". Give me an email dump from the most honest of persons, and I'll pull one out of context to hang them in the court of social media. ... > ... I personal
Read the rest
ly have many doubts about where this email came from, and the overall "narrative" they are trying to push. Regardless, I can validate the basic facts about this email. Are there any more emails with full headers?
In Parler LLC vs. Amazon Web Services Inc
tigger0jk·Nov 16, 2020
I believe you are referring to this quote (correct me if not): "In fact, in the early DKIM configurations were kind of a joke: mail providers chose DKIM signing keys that were trivial for motivated attackers to crack. Back in 2012 a security researcher named Zachary Harris pointed out that Google and several other companies were using using 512-bit RSA to sign DKIM. He showed that these keys could be “cracked” in a matter of hours on rented cloud hardware, and then used these keys to forge emails from Larry and Sergey. Providers like Google reacted to the whole “Larry and Sergey” embarassment in the way you’d expect. Without giving the implications any serious thought, they quickly ramped up their keys to 1024-bit or 2048-bit RSA. This stopped the forgeries, but inadvertently turned a harmless anti-spam protocol into a life-long cryptogra
Read the rest
phic authenticity stamp — one that can be used to verify the provenance of any email dump, regardless of how it reaches the verifier." Note that the "few hours" attack here is only relevant if they were using easily crackable 512-bit keys. The author of this article suggests (and I agree) that the 1024 or 2048 bit RSA keys are not easily crackable. (see https://crypto.stackexchange.com/a/42830) Maybe you are suggesting that someone could sign emails using the old crackable 512-bit keys. And they could, although we should disregard this as "not verification" given the weak keys. The article links to https://github.com/robertdavidgraham/hunter-dkim#short-dkim-... - which verifies an email using a since-rotated 2015 key (which was 2048 bits), although that github erroneously states that Google was using 1024 bit before that (they were using 512). I would concede that the notion of "sometimes we should disregard some DKIM verifications based on the key length" is not easy to grasp and that email verification stories in the media could become muddier and harder to present. I would hope that interviewing experts gets you a reasonable estimation of how likely an email is to be legitimate.
In Ok Google: please publish your DKIM secret keys

Showing the 15 most recent of 29 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.