This guide assumes Common Mark Certificates (CMC) is already deployed and passing. It covers what breaks at scale and how mature teams operate it.
Edge cases that break a working setup#
- Expecting the blue checkmark; CMC does not qualify.
- Changing the logo after issuance, which invalidates the certificate.
- Mail forwarded through mailing lists or personal forwarders, which alters headers and content.
- Acquisitions and rebrands that introduce domains nobody audited.
- Vendors silently changing their sending infrastructure.
Operating it as infrastructure#
- Assign an owner for each sending domain and each vendor relationship.
- Put DNS records under version control or a change-review process.
- Alert on authentication pass rate drops and reputation changes, not just outages.
- Run a quarterly audit against the setup steps below.
- Document runbooks for the three most common failures.
Reference: the baseline setup#
- Document at least 12 months of logo use (Wayback Machine snapshots, marketing materials).
- Prepare the logo as SVG Tiny PS.
- Complete organization validation with DigiCert or Entrust.
- Publish the certificate URL in the a= tag of your BIMI record.
Frequently asked questions#
Which providers accept CMC?
Gmail accepts CMC as of 2024. Apple accepts VMC and CMC. Yahoo does not require a certificate.
Can I upgrade from CMC to VMC?
Yes, once the trademark registers. Reissue the certificate and update the a= tag.