Verified Authenticated Messaging ProtocolIdentity First Mail

Spam exists today because of weaknesses in legacy email. Email was never designed as an adversarial system, but we live in an adversarial world.
Sending millions of emails for spam / phishing / marketing is essentially free, and fighting it costs hundreds of millions of dollars.
VAMP aims to invert that equation through identity, cryptographic chain of custody, and marginal cost applied to the sender instead of the reciever, making bulk spam economically unviable.

Read the Research Explore the proposal Get Involved

Do your users know who to trust?

Can your email do this?

VAMP turns provenance into something recipients can actually read: who sent the message, how it arrived, and whether the trust state is normal, new, degraded, or dangerous.

Direct Trust

Alice Smith

alice@example.org

9:14 AM

Verified Sender

Trusted Device

Subject: Notes from Tuesday’s sender policy review

I pulled the action items into one place and marked the device enrollment changes we should ship first.

Device Change

Alice Smith

alice@example.org

9:18 AM

Verified Sender

New Device

Subject: Updated rollout notes for Thursday

I am sending from my travel laptop this morning, but the plan and approvals are unchanged from the draft I shared yesterday.

Custody

Alice Smith

alice@example.org

10:02 AM

Redistributed by team-updates@example.org

Subject: Updated schedule for the operator briefing

This message was authored by Alice and redistributed through the team updates list with the custody path preserved.

Consent

Launch Updates

launch-updates@example.org

10:11 AM

Subscription Consent Verified

Subject: The VAMP developer preview launches today

We opened the first wave of access this morning, published the launch notes, and included the rollout milestones for early adopters below.

First Contact Indicators

Sam Patel

sam@example.org

10:02 AM

Verified Sender

First Contact

Subject: Covering for Alice

Hi, this is Alice’s coworker sam. I’m reaching out about the project so i can cover for Alice while she’s out next week.

Phishing Attempt

Alice S

alice@examp1e.com

10:49 AM

Unverified Domain

First Contact

Subject: Quick favor before the finance review?

I need you to send over a few prepaid cards before the meeting starts. Keep this between us and reply as soon as you can.

Why Change Email

Modern email is still organized around weak identity and after-the-fact defense.

The current system asks receivers to infer trust from headers, heuristics, and reputation after a message is already in motion. By that point, the protocol has already handed the receiver the cost and the risk.

Email addresses are weak identity claims, not cryptographic principals tied to a real actor.
Message handling is opaque; recipients rarely get a trustworthy chain of custody from origin to inbox.
Attackers can send unsolicited bulk mail at near-zero marginal cost.
Operators spend billions each year filtering abuse at industrial scale just to keep inboxes usable.
Users are still expected to inspect headers, wording, and context manually to spot fraud.

VAMP starts from a different premise: identity should be verifiable before or during delivery, provenance should be explicit, and unauthorized scale should impose cost on the sender instead of being dumped on the receiver.

Weak sender identityLegacy email makes sender identity easy to spoof. Display names, headers, and even whole message paths can be manipulated to make malicious mail look legitimate.

No chain of custodyRecipients rarely get a trustworthy record of who originated a message, which systems handled it, what changed in transit, or whether it was redistributed by an authorized service.

Abuse is cheapSpam, phishing, and mass solicitation are cheap to send at scale. The protocol gives attackers near-zero marginal cost while letting them externalize the damage.

Filtering is expensiveReceivers pay the bill for a broken trust model: filtering, storage, machine learning, user training, incident response, and fraud recovery all happen after the message is sent.

Consent is weak and sender-controlledOpt-in, subscription state, and unsubscribe handling are usually maintained by the sender. Receivers can verify that a sender supports these workflows, but not that the recipient actually consented.

Trust is evaluated too lateLegacy email usually discovers security, capability, and recipient validity after the message is already in motion. By then, the receiver is left to sort out what should have been rejected earlier.

Identity-First Mail

VAMP changes the default story of a message.

This is not just a better spam filter. VAMP is a different substrate for email-shaped messaging: domain-authoritative identity, explicit custody, secure native transport, and sender accountability built into the protocol instead of layered on top of SMTP.

Domain-authoritative identity

The namespace owner is the identity authority. Trust begins at a domain trust anchor, not at a string in a From field.

Encrypt to the user, sign with the device

Messages target the user for asynchronous, multi-device mail, while device signatures make origin-specific trust visible.

Make custody explicit

A message is not just payload plus signature. It is a cryptographically verifiable record of who originated it and which meaningful actors handled it.

Attach policy to the real edge

Native delivery runs from sender-edge to receiver-edge, giving the protocol a clean place to attach identity, policy, downgrade rules, and sender-side cost.

Make unauthorized scale expensive

Unauthorized bulk delivery should impose sender-side marginal cost instead of dumping the burden on receivers, filters, and incident response teams.

Prove consent for redistribution

Mailing lists, newsletters, and notifications should carry verifiable membership or subscription proof instead of relying on sender-maintained opt-in claims.

Trust Model

Trust flows from device to user to organization to domain.

VAMP is fundamentally domain-authoritative. Devices hold the signing keys, users remain the stable messaging principals, organizations manage enrollment and revocation, and domains act as the trust anchors for the namespace. Humans never touch the crypto.

Encryption: target the user identity, not each device.

Signing: device-level origin remains visible and policy-relevant.

Transport: sender-edge adds organizational attestation for external delivery.

Device

Cryptographic origin

Hardware-bound signing keys establish where user actions actually came from.

User

Stable messaging principal

The identity recipients reason about and the identity to which messages are encrypted.

Organization

Administrative authority

Enrolls devices, authorizes outbound transport, and revokes compromised state.

Domain

Trust anchor for the namespace

Defines which authority is actually responsible for identities under that domain.

Chain Of Custody

Every message already has a provenance story.

In VAMP, chain of custody is not a special mechanism reserved for mailing lists or forwarding. It is the normal shape of a message. That lets recipients distinguish authorship, redistribution, service-generated delivery, and explicit handling without relying on loose header conventions.

Human Message

Direct authorship

device → user → organization

List Redistribution

Explicit rebroadcast

device → user → list service → organization

Service Message

Application origin

service identity → organization

Published Now

Start with the pieces that define the model.

The current docs are research-heavy, but together they sketch the architecture: why the protocol exists, how native transport works, how sender accountability is enforced, and how identity-backed consent and redistribution should behave.

Why The Model Exists

Verified Authenticated Messaging ProtocolIdentity First Mail

Can your email do this?

Modern email is still organized around weak identity and after-the-fact defense.

VAMP changes the default story of a message.

Domain-authoritative identity

Encrypt to the user, sign with the device

Make custody explicit

Attach policy to the real edge

Make unauthorized scale expensive

Prove consent for redistribution

Trust flows from device to user to organization to domain.

Cryptographic origin

Stable messaging principal

Administrative authority

Trust anchor for the namespace

Every message already has a provenance story.

Direct authorship

Explicit rebroadcast

Application origin

Start with the pieces that define the model.

Sender-Cost Enforcement, Downgrade Resistance, and Operator Value

VAMP Native Transport Topology

WebAuthn-Style Subscription Authorization for VAMP

MTA-scoped, non-monetary sender-cost mechanics for VAMP

Email volume baselines for VAMP threshold design

Proof-of-Work Families for VAMP