WICG
Proof of email existence and spam
If anyone can become an issuer by just adding the correct DNS records for this protocol, a question that comes to mind is: What's stopping spam services or a malicious domain for using this protocol to grant verification tokens to any fake email under their domain?
So my point is: This doesn't actually verify that a mailbox actually exists and can receive emails, we just trust what the domain owner says.
How is this trust model any different than how things work today? Yes, we are making it just as easy for a legitimate user to provide a verified email as we are for a malicious user -- detecting a spam domain is not the objective -- simpler email verification is.
I had some similar concerns when discussing this at IIW, but I eventually became convinced that this does not change anything from the RP's perspective. Nothing is stopping sites from still blocking any domains they "don't like" for whatever reason.
Though I agree that it should be made explicit that deliverability verification is a non-goal of this proposal, cf. #23.
