Gmail's native interface does not tell you whether a sender is who they claim to be. A new Chrome extension aims to fix that by adding a verification layer directly into your inbox, matching senders against a user-controlled allow-list and flagging anything unverified.
How sender verification works in practice
The Secure Gmail Sender Verifier, version 1.1.0, updated September 17, 2026, takes a straightforward approach to the spoofing problem. Users maintain a local list of trusted email addresses and domain names, such as billing@trustedcompany.com or an entire partner domain. The extension then reads the Gmail DOM in real time, matches incoming sender addresses against that list, and applies visual indicators to every row.
Verified senders get a green checkmark badge. Unverified external senders get a warning tag. The free tier dims unverified rows to 35% opacity so they are easy to skip when scanning. Two paid features add more aggressive filtering: collapsing rows to 8% opacity to emphasize verified correspondence, and hiding unverified rows entirely from the active view for an ultra-focused inbox.
The extension is lightweight, at 15.68 KiB, and runs on Chrome Extension Manifest V3. It requires only two permissions: local storage for the allow-list and preferences, and access to mail.google.com for reading sender elements and rendering badges in the Gmail web interface.
Encryption for the allow-list itself
The Pro tier adds a feature that addresses a secondary concern: the allow-list itself is sensitive data. If someone gains access to your machine, a plaintext list of every trusted sender and domain reveals your communication patterns. The extension encrypts the allow-list on local disk using AES-GCM 256-bit encryption with PBKDF2-derived keys and 100,000 iterations, all through the browser's native Web Crypto API.
No part of the cryptographic process leaves the browser. There are no remote servers involved in list management, DOM parsing, or encryption. The developer, DataCash, based in Bluemont, Virginia, states that no telemetry, trackers, or third-party data access are part of the architecture.
The phishing problem it targets
Email spoofing remains one of the most common attack vectors for phishing campaigns. Gmail's spam filters catch many obvious attempts, but targeted attacks often use compromised or lookalike domains that pass standard checks. The gap between "delivered to inbox" and "actually from a trusted source" is where this extension operates.
The approach is not a defense against sophisticated spear-phishing where an attacker compromises a legitimate account. It is a defense against the far more common scenario where an attacker impersonates a known contact using a slightly different address or domain, and the recipient does not notice the discrepancy before clicking a link or opening an attachment.
Practical limitations to consider
The allow-list model puts the burden on the user to maintain their trust boundaries. Add a domain once and every sender from that domain passes verification, even if the specific account has been compromised. The extension does not perform cryptographic email authentication checks like SPF, DKIM, or DMARC. It is purely a visual and organizational tool, not a cryptographic verification of sender identity.
For teams or organizations that already enforce email authentication at the gateway level, the extension adds a second layer of human-facing protection. For individual users managing their own security, it is a simple way to make the distinction between known and unknown senders visible in the inbox itself rather than relying on Gmail's sometimes inconsistent spam labeling.