# Peppol SMP and SML explained: how invoices find the buyer

> The SML is Peppol's DNS-based locator and the SMP is the registry of what each participant can receive. How a lookup works, step by step, with a UK example.

- Canonical URL: https://einvoices.uk/news/peppol-smp-sml-explained
- Published: 20 October 2026 (2026-10-20)
- Last updated: 20 October 2026 (2026-10-20) (not updated since publication)
- Author: Floris Lindenaar, Editor, e-invoicing expert (https://einvoices.uk/authors/floris-lindenaar)
- Publisher: einvoices.uk (https://einvoices.uk)
- Type: Explainer
- Topics: Peppol, Technical, Four-corner model
- Language: en-GB (UK English); covers the United Kingdom

## Sources

- [Peppol Service Metadata Locator (SML) v1.3.0](https://docs.peppol.eu/edelivery/sml/Peppol-EDN-Service-Metadata-Locator-1.3.0-2025-02-06.pdf)
- [Peppol Service Metadata Publishing (SMP) v1.4.0](https://docs.peppol.eu/edelivery/smp/Peppol-EDN-Service-Metadata-Publishing-1.4.0-2025-02-06.pdf)
- [Peppol Policy for use of Identifiers v4.4.0](https://docs.peppol.eu/edelivery/policies/Peppol-EDN-Policy-for-use-of-identifiers-4.4.0-2025-02-06.pdf)
- [OpenPeppol eDEC Specifications](https://docs.peppol.eu/edelivery/)
- [Peppol Directory v1.1.1](https://docs.peppol.eu/edelivery/directory/PEPPOL-EDN-Directory-1.1.1-2020-10-15.pdf)

---

The **SML** (Service Metadata Locator) and **SMP** (Service Metadata Publisher) are Peppol's address book. The SML is a single, DNS-based locator that answers "which SMP knows about this participant?" The SMP, run by service providers, answers "can this participant receive this type of document, and at which Access Point?" Together they let any provider deliver to any other without a central hub carrying the invoices.

## Why Peppol needs them

In the [four-corner model](https://einvoices.uk/news/four-corner-model-explained), the supplier's Access Point (C2) knows only the buyer's Peppol ID, for example `9932:gb123456789` (made up). It does not know who the buyer's provider is. Before every send, C2 performs **dynamic discovery**: it uses the SML to find the buyer's SMP, then the SMP to find the buyer's Access Point and certificate.

The SML specification explains why DNS is used: it "does not need a single central server to run the Discovery interface, with its associated single point of failure". The SML's job is to control who can create and update entries in DNS.

## Step by step

The SML specification (v1.3.0, valid from 1 November 2025) sets out the discovery flow.

**1. Build the DNS name.** The format is:

```
<hash over recipientID>.<schemeID>.<SML domain>
```

The Identifier Policy (POLICY 7) defines the hash. Lower-case the participant ID (scheme code and value) using en_US rules. Take the SHA-256 hash of its UTF-8 bytes. Then Base32-encode the result and drop the trailing `=` padding.

**2. Query DNS for a U-NAPTR record** at that name, with service name `Meta:SMP`. The record returns the SMP's base URL, which must use `https`.

**3. Ask the SMP.** The sender calls:

```
<smpBaseUrl>/<recipientID>/services/<documentType>
```

The SMP returns signed metadata. This includes the Access Point's endpoint URL, the transport profile (AS4) and the Access Point's certificate.

**4. Send.** C2 sends the invoice over AS4 to C3.

## Worked UK example

Take the fictional participant `9932:GB123456789`.

| Step | Value |
|---|---|
| Lower-cased ID | `9932:gb123456789` |
| SHA-256, Base32, no padding | `O4DBUQH7GHS5WZIDLSGRUGMYODY4GDQYQHNMVLOTRIMEZ6X26LEA` |
| Scheme | `iso6523-actorid-upis` |
| DNS name (using the zone in the policy's examples) | `O4DBUQH7GHS5WZIDLSGRUGMYODY4GDQYQHNMVLOTRIMEZ6X26LEA.iso6523-actorid-upis.edelivery.tech.ec.europa.eu.` |
| SMP request | `https://smp.example.org/iso6523-actorid-upis::9932:gb123456789/services/busdox-docid-qns::urn:oasis:names:specification:ubl:schema:xsd:Invoice-2::Invoice##urn:cen.eu:en16931:2017#compliant#urn:fdc:peppol.eu:2017:poacc:billing:3.0::2.1` |

In a real request, the parts after the SMP's base URL are percent-encoded (`::` becomes `%3A%3A`, `#` becomes `%23`). We calculated the hash ourselves and checked our method against the worked example in the Identifier Policy (`0088:123abc`).

Because the ID is lower-cased before hashing, `9932:GB123456789` and `9932:gb123456789` produce the same DNS name. This is how the policy's rule that participant IDs are case insensitive works in practice. But `9932:123456789`, without the GB prefix, produces a **different** hash, so it is a different participant.

## What lives in an SMP

For each participant (a "service group"), the SMP holds:

- the participant identifier, with scheme `iso6523-actorid-upis`
- a list of **document types** the participant can receive (for example the BIS Billing 3.0 invoice and credit note)
- for each document type, the **process** (for example `urn:fdc:peppol.eu:2017:poacc:billing:01:1.0`), the **endpoint URL** and the **certificate** of the receiving Access Point
- optionally, a business card that can be published to the [Peppol Directory](https://einvoices.uk/news/peppol-directory-lookup-uk)

The SMP signs its responses, so a sender can check that the metadata is genuine. Each participant ID can be registered with **one and only one SMP**.

## Registration and migration

SMPs do not write to DNS directly. Through the SML's management interface, the SMP asks the SML to create, update or delete the DNS record for a participant.

Changing provider uses the same interface. The current SMP calls **PrepareToMigrate**, which sets a migration code. The participant gives that code to the new SMP, which calls **Migrate** to take over. After that, lookups point to the new provider and the Peppol ID itself does not change. This is why "can I get a migration code?" is a fair question when [choosing an Access Point](https://einvoices.uk/news/how-to-choose-a-peppol-access-point).

## What changed in November 2025

Two specifications published on 6 February 2025 became valid on 1 November 2025:

- **SML 1.3.0:** "Switching from CNAME to U-NAPTR DNS records", and the CNAME wildcard option was removed.
- **Identifier Policy 4.4.0:** "Changing POLICY 7 to use a different DNS zone name algorithm" (the SHA-256 and Base32 hash above), and longer maximum identifier lengths.

The older scheme produced DNS names starting with `B-`, which you may still see in older documentation and tools. If you maintain your own Peppol integration, make sure your lookup code uses the current method.

## Is there anything UK-specific?

No. The SML and SMP are the same for every country on Peppol. What the UK has not yet settled (as of 20 October 2026) is which **identifier schemes** UK participants should register under, and whether participants must publish Directory business cards. See [Peppol ID UK](https://einvoices.uk/news/peppol-participant-id-uk) and [Who is the UK Peppol Authority?](https://einvoices.uk/news/peppol-authority-uk)

## What to do now

1. Ask your provider which IDs and document types it has registered for you in its SMP.
2. Make sure both invoice and credit note are listed, and Invoice Response if you plan to use it.
3. Check your contract lets you get a migration code if you leave.
4. Developers: implement lookups to SML 1.3.0 and SMP 1.4.0, and test with case variations of IDs.

See also the glossary entry for [Service Metadata Publisher](https://einvoices.uk/news/peppol-smp-sml-explained).

## Frequently asked questions

### What is the difference between SMP and SML in Peppol?

The SML (Service Metadata Locator) is a single DNS-based service that tells a sender which SMP holds a participant's details. The SMP (Service Metadata Publisher) is run by service providers and says which documents that participant can receive and at which Access Point.

### Who runs the Peppol SMP?

SMPs are run by certified Peppol service providers, usually the same provider that runs your Access Point. Each participant identifier is registered with one and only one SMP.

### What changed in the SML in 2025?

SML specification 1.3.0 and Identifier Policy 4.4.0, valid from 1 November 2025, moved lookups from DNS CNAME records to U-NAPTR records and changed how the DNS name is built, using a Base32-encoded SHA-256 hash of the lower-cased participant ID.

### Do I need to know about the SMP as a business?

Only a little. Your provider registers you in its SMP. What matters to you is that your Peppol ID is registered correctly, for the right document types, and that you can migrate it if you change provider.

---

How to cite: "Peppol SMP and SML explained: how invoices find the buyer", einvoices.uk, 20 October 2026, https://einvoices.uk/news/peppol-smp-sml-explained

einvoices.uk is an independent publication and is not affiliated with HMRC or the UK Government. Nothing here is tax advice; check the sources and official GOV.UK guidance before acting.