How to publish Email Verification issuer discovery

1. Confirm prerequisites

You need edit access to DNS for the email domain (where mailboxes live) and deploy access on the issuer host (where tokens and JWKS will live). Both issuance_endpoint and jwks_uri must be https URLs on that issuer host. This pack does not create signing keys or OT tokens.

2. Fill domains and endpoints in the tool

Open the generator. Enter the email domain, the bare issuer hostname (no scheme), and the two https endpoints. Rebuild and inspect the three outputs before you touch production DNS.

3. Keep Ed25519 and EdDSA together

Chrome 154–155 recognize EdDSA; Chrome 156+ also accepts the fully-specified Ed25519 identifier. Listing both in signing_alg_values_supported reduces breakage during the cutover. Only drop one if you have measured every client version you care about.

4. Publish the DNS TXT exactly

On the email domain zone, create:

_email-verification.<email-domain>  TXT  "iss=<issuer-host>"

Common mistakes Chrome rejects: prefixing https://, adding a port or path, using uppercase letters, or putting the TXT on the issuer zone instead of the mailbox zone. The value is a bare lowercase hostname only.

5. Host the well-known JSON on the issuer origin

Serve the downloaded file at https://<issuer-host>/.well-known/email-verification (no .json extension in the live path). The JSON issuer field must match that HTTPS origin byte-for-byte — no trailing slash.

6. Apply Pages _headers (or equivalent)

Copy the recipe from the tool into the root _headers of the Cloudflare Pages project that serves the issuer host (or your custom domain on Pages). Redeploy, then confirm the response header is Content-Type: application/json. On Nginx, set default_type application/json (or an explicit types map) for that extensionless path — HTML fallbacks break discovery.

7. Curl self-check

From any machine:

curl -sSI "https://<issuer-host>/.well-known/email-verification"
curl -sS  "https://<issuer-host>/.well-known/email-verification" | head
dig +short TXT _email-verification.<email-domain>

Expect HTTP 200, application/json, parseable JSON whose issuer matches the origin, and a TXT string exactly like iss=<issuer-host>.

8. Keep Origin Trial tokens separate

Relying parties still need an origin trial token from Chrome’s OT portal (meta tag or HTTP header). That token is not part of this discovery pack. Renew and redeploy OT tokens on each RP origin independently. Tokens issued before the extension may expire around 2026-11-17 — put a calendar reminder; do not wait for a mysterious “discovery works but verification fails” incident.