Email is already generally signed and verified when sent and received by competent email providers. DKIM and DMAC are the technologies that do this. DKIM emplo

Email is already generally signed and verified when sent and received by competent email providers. DKIM and DMAC are the technologies that do this. DKIM employs asymmetric cryptography to sign all outbound emails from a domain name using a key for which the public part is published in the domain’s DNS. Receiving mail servers validate signatures automatically, looking up each domain’s public key from DNS. DMARC allows senders to advertise the fact that all email they send will be authenticated, such as with DKIM or SPF, so that receivers may drop anything else (kind of like HSTS for websites). Messages that lack a DKIM signature, from sending domains that require it, will simply be dropped. Quality email providers, including most webmail providers, offer these capabilities built in. These technologies are table stakes for email, like HTTPS is for websites. Take a look at received email in your mailbox for DKIM/DMARC status headers and you might find that many messages are protected by these technologies. However, even strong authentication of email addresses is not enough to prevent abuse. Attackers can send email from addresses that are similar (but not identical) to the person they want to impersonate (typo-similar domains). An attacker can fully set up the domain and employ DKIM+DMARC. Just like with TLS, possessing a key is not by itself an indicator of trustworthiness. Signing our email won’t stop people from being tricked by impersonators unfortunately. It’s similar to the phone system: if someone calls you and claims to be an employee of your bank, how do you know if it’s really them? The best answer is often to independently navigate to the bank’s website, look up their contact info, and then use it to reach them. The same is the for email addresses: you can’t assume that an address belongs to someone - you have to verify it somehow (using an existed trusted channel). Then DKIM+DMARC can help by making it impossible for anyone to forge messages from that address. A starting point for a better solution to the identity discovery problem could be a better address book experience, calling to the user’s attention the first time they’re communicating with a new person, especially at a new or different organization. Defending against phishing is more of a user experience design problem than a crypto engineering problem in my opinion.