EVP Domain Checker

Look up the _email-verification discovery record, issuer metadata and signing keys for any email domain.

Check an email domain

Enter a domain (or a full email address). The checker looks up the DNS TXT record at _email-verification.<domain>, the discovery record a browser reads before anything else, then follows it to the issuer metadata and signing keys.

Try: gmail.com (a live EVP issuer) or your own mail domain.

How EVP discovery works, in thirty seconds

Before a browser asks anyone for a token, it reads DNS. The email domain publishes a TXT record at _email-verification.<domain> naming the one issuer allowed to speak for its addresses. That single record is the trust anchor: a relying party later compares the issuer inside a token against this record, so a random site cannot mint tokens for Gmail addresses.

The browser then reads the issuer metadata at /.well-known/email-verification on the issuer origin, which publishes the issuance endpoint and a JWKS address holding the signing keys. This checker walks the same chain a browser and a verifying server walk, and shows you every link in it.

Frequently Asked Questions

A DNS TXT record published at _email-verification.<email-domain>. It names the issuer origin authorized to verify addresses at that domain. Browsers read it during discovery, and verifying servers read it again to confirm that the issuer named inside a token (its iss claim) is the issuer the domain actually appointed.

A JSON document the issuer serves at /.well-known/email-verification on its origin. It publishes the issuance endpoint the browser posts to, and a jwks_uri pointing at the public keys used to verify token signatures. Without reachable metadata and keys, a domain record alone cannot complete a verification.

Not today. EVP is an experimental origin-trial protocol, and nearly every domain on the internet has no record, including most large mailbox providers. Browsers simply fall back to the classic verification email. Publishing a record only matters if you are building an issuer.

No. A token is only trusted when its issuer matches the origin your DNS record appoints, and its signature verifies against that issuer published keys. A third party can sign anything it likes; verifiers reject it because the DNS record never named them.

No. The lookup runs live against public DNS and the issuer public endpoints, read-only, and nothing is stored or logged by the tool.

EVP Developer Lab

EVP Support Checker

Test whether this browser and provider can run the Email Verification Protocol.

EVP Token Decoder

Decode an SD-JWT email verification token and read every claim.

EVP Token Validator

Validate claims, key binding and the issuer signature on a token.

Was this tool helpful?

Comments

Loading comments...

Check Out Other Popular Tools

Compress PDF

Compress PDF files online for free. Reduce PDF file size while maintaining quality. Choose from Extreme, Recommended, or Less compression levels.

PDF859

Country Language Finder — What Language Do They Speak in Every Country?

Select any of 200+ countries and territories to see its official language(s), the approx. share of people who speak the main language, and other widely spoken languages. Links straight to the matching level quiz.

Education29

Korean Proficiency Assessment (TOPIK Check)

Test your Korean level with our adaptive 20-question quiz. Get your official TOPIK score estimate (Level 1-6) and download a certificate.

Education1,696