Verified_email coverage: plans to expand the DKIM domain allowlist or enable the DNSSEC path?

Developers internet-identity
1

I’m building a consumer app on ICP that relies on Internet Identity’s verified-email attribute so a user can prove control of an email address before an action completes.

Coverage as measured against the live II config today (2 Sep 2026, rdmx6-jaaaa-aaaaa-aaadq-cai):

  • The magic-email DKIM path accepts a fixed allowlist of 24 consumer domains (gmail/googlemail, outlook/hotmail/msn/live, icloud/me/mac, yahoo/ymail, aol, zoho, fastmail.com/.fm, hey, yandex.com/.ru, mail.ru, qq, 163, 126, naver, daum), matched exactly, so regional variants such as yahoo.co.uk fall outside it (as reported in another thread in June).
  • enable_dnssec_email_recovery = false.
  • Beyond that, Google sign-in yields a verified email for Google-hosted addresses, Microsoft sign-in for personal Microsoft accounts (work/school tenants excluded, as far as I can tell from the code), and Apple sign-in yields none (email_verification = Unknown).

Three roadmap questions for the II team:

  1. Is the DKIM allowlist expected to grow? Is there a process for requesting a domain, or the regional variants of domains already listed?
  2. Is there a target release for enabling the DNSSEC path, which would generalize verification beyond the allowlist?
  3. Are Microsoft work/school (Entra ID) accounts planned for verified_email support via the Microsoft OpenID integration?

Even a rough timeline helps a lot. It decides how much I invest in handling addresses that can’t be verified today. Thanks!

2
  1. This list can indeed grow a bit with providers that don’t support DNSSEC, currently it’s indeed missing some regional variants.
  2. It was disabled as a precaution after we had some security findings. We haven’t gotten around yet to revisiting and reworking things where needed in the implementation.
  3. Unfortunately, for emails to be considered “verified” they need to be actually verified at some point. This is straightforward with personal Microsoft accounts, but for work/school accounts, the addresses could be added without verification by a tenant admin. There probably are some improvement that can be made here though, something we can revisit at a later point.