Google’s Email Verification Protocol (EVP) Explained: What It Does and Does Not Do

Google is testing a new way to confirm email addresses at signup. It is called the Email Verification Protocol, or EVP. With EVP, Chrome checks with your email provider that you are logged in to the address you typed. The website gets proof in seconds. You never wait for a code or click a link in your inbox.

That sounds like the end of email verification. It is not.

The short answer: EVP proves that a person controls an email address at the moment they sign up. It does not prove that the address can receive mail. The protocol’s own specification says so: it “does not verify that the email address can receive mail.” EVP also does nothing for the contacts already on your list, for lists you import, or for addresses at providers that do not support it.

This guide explains what EVP is, how it works, what it checks and what it misses. It also covers what it means for marketers, SaaS signup forms and double opt-in.

What is Google’s Email Verification Protocol (EVP)?

EVP is a proposed web standard that lets a website confirm you control an email address without sending you an email. Your browser talks to your email provider for you. Three parties take part:

• The browser (Chrome, for now) sits in the middle and passes messages.
• The website wants to know your email is really yours.
• The email provider (the “issuer”, for example Gmail) confirms you are logged in to that address.

The idea comes from an IETF draft written by Dick Hardt of Hellō and Sam Goto of Google. A separate W3C proposal covers the browser side.

How EVP works, step by step

1. You pick your email address. Chrome suggests addresses from autofill. Typing an address by hand is supported from Chrome 151.
2. The website adds a one-time code to the request. This ties the check to your session so it cannot be replayed on another site.
3. Chrome finds who can vouch for the address. It reads a DNS record on the email domain (_email-verification.<domain>) and the provider’s settings file (/.well-known/email-verification).
4. The provider checks you are logged in. If you are signed in to that mailbox in the browser, the provider returns a signed token that says the address is verified.
5. Chrome hands the proof to the website. The token is locked to that website and that session.
6. The website checks the signatures. If they are valid, the address is confirmed. If anything fails, or the provider does not support EVP, the site falls back to the normal email code or link.

EVP also has privacy features. The email provider does not learn which website asked. A provider can also hand out a private relay address for each website, so your real address is not shared.

For developers: the token is a signed JWT with an email_verified: true claim, plus a key-bound JWT tied to the website’s origin and nonce. Websites must register for Chrome’s origin trial and verify the token, nonce and signatures. See the IETF draft and Chrome’s origin trial guide for details.

EVP vs double opt-in vs email verification

These three tools answer different questions. EVP answers “is this person logged in to this address right now?” Email verification answers “will mail to this address be delivered?” Double opt-in answers “did this person confirm they want our emails?”

Question	EVP (Chrome)	Double opt-in email	Email verification
Does the person control the address?	Yes, at signup	Yes, when they click	No. It checks the mailbox, not the person
Can the address receive mail?	No. The spec says it does not check this	Yes, the email arrived	Yes. Checks syntax, domain, mail server and mailbox
Flags disposable addresses?	Not designed to	No	Yes
Flags catch-all and role-based addresses?	No	No	Yes
Works on lists you already have?	No. Signup only, with the user in the browser	No. Needs a new email and a click	Yes, in bulk
Works for any email provider?	Only providers that support EVP. Gmail is in the trial	Yes	Yes
Is the address still alive 6 months later?	Not known. The check happens once	Not known	Re-verify any time
Extra step for the user?	None, if their provider supports it	Yes, they must open the email and click	None

The takeaway: EVP can replace the confirmation code at signup for some users. It cannot replace checking whether your list is deliverable. Addresses go stale after signup, lists get imported, and most providers do not support EVP yet. For those, you still need to verify. You can check any single address now with the free Email Checker.

What EVP means for marketers and SaaS teams

For SaaS signup forms

If EVP ships widely, Gmail users could confirm their address in one tap. Fewer people would drop off while waiting for a code. But EVP only works when the user’s provider supports it. Everyone else still needs a check at the door. Keep real-time email verification on your forms so typed, mistyped and throwaway addresses are caught for all users. Our guide to SaaS fake signup prevention covers the full setup.

For double opt-in

Double opt-in costs signups. Validity reports that the confirmation step loses an average of 20 to 35 percent of signups. EVP could win some of those back, because the user never leaves the page. There is a catch. In GDPR markets, the confirmation click is often used as proof of consent. Whether an EVP token can serve the same purpose has not been settled. Talk to your legal team before you drop double opt-in.

For how verification fits with EU consent rules, see our guide to GDPR-compliant email verification.

For your email list

• Addresses still go stale. EVP checks an address once, at signup. Jobs change, mailboxes close and domains expire after that. Our guide to email list decay explains how fast this happens and how to fix it.
• Imported lists get no help from EVP. Event lists, purchased lead lists and CRM exports never pass through a browser signup.
• Expect more private relay addresses. The EVP draft lets providers hand out a different address for each website. These addresses are real and deliverable, but they will not match the same person’s address in other tools.

What to do now

Nothing urgent. EVP is an experiment, and Validity’s advice is that there is “no need to secure a budget line just yet.” Developers who want to test it can join Chrome’s origin trial. Everyone else should keep verifying lists before campaigns and watch for news on a wider launch.

Where EVP stands today

EVP is an experiment, not a standard. The IETF draft says it is “not endorsed by the IETF” and “has no formal standing.” Google is testing it in a Chrome origin trial, where websites can try a feature before Google decides whether to ship it.

Date or version	What happened
October 5, 2026	Chrome updated its origin trial guide
August 25, 2026	IETF draft version 02 published (expires February 26, 2027)
July 8, 2026	Chrome announced the EVP origin trial
Chrome 150	Origin trial available
Chrome 151	Typing an address by hand supported
Chrome 153	HTTP message signatures added, which Chrome warns may cause issues

Who supports it so far (as listed in the IETF draft): Gmail as an email provider in the origin trial, Hellō as an exploratory provider, and Chrome and Edge as browsers in origin trials. Gmail users can be tested with no extra setup, according to Chrome’s guide.

Google Email Verification Protocol FAQ

What is Google’s Email Verification Protocol?

The Email Verification Protocol (EVP) is a proposed standard that lets a website confirm a user controls an email address without sending a code or link. Chrome asks the user’s email provider, the provider confirms the user is logged in, and the website receives a signed token as proof.

Does EVP replace email verification?

No. EVP proves a person controls an address at signup. It does not check whether the address can receive mail, and its specification says so directly. It also cannot check existing or imported lists, so you still need email verification before you send.

Does EVP replace double opt-in?

Not yet. EVP can remove the confirmation email at signup for users whose provider supports it. But in GDPR markets, the double opt-in click is often used as proof of consent, and it is not settled whether an EVP token can do the same job.

Which email providers support EVP?

Gmail is taking part in Chrome’s origin trial as an email provider. The IETF draft also lists Hellō as an exploratory provider. Other providers would need to publish a DNS record and support the protocol before their users could use it.

Is EVP available in all browsers?

No. EVP is in a Chrome origin trial from Chrome 150, and the IETF draft lists Edge as testing it too. It is an experiment, and Google has not said whether it will ship to all users.

Will EVP reduce fake signups?

It can help for supported providers, because a user must be logged in to the mailbox to pass. It does not flag disposable addresses or check deliverability. Keep real-time email verification on your forms to cover every user.

Do I need to change anything today?

No. EVP is an origin trial, not a launched feature. Keep verifying new signups and existing lists, and let your developers test the trial if faster signups matter to your business.

Keep verifying while EVP grows

EVP may make signups smoother one day. Until then, and even after, your list still needs a deliverability check. Verify one address free with the Email Checker, grade up to 500 with the Email List Health Grader, or sign up to verify your full list with free daily credits. Want to see what a verifier actually checks? Read SMTP Email Verification Explained and How to Verify an Email Address.