How email recovery is verified on the network:
A new SMTP gateway forwards an email to a canister, which checks the DKIM signature that email servers already attach. To get the public key it uses a root of trust: DNSSEC where supported, or DNS over HTTP via an HTTPS outcall.
The gateway is not trusted. The canister does the verification.
Set it up at
id.ai