Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Expecting the blue checkmark; CMC does not qualify.
- Changing the logo after issuance, which invalidates the certificate.
Fix and re-verify#
- Document at least 12 months of logo use (Wayback Machine snapshots, marketing materials).
- Prepare the logo as SVG Tiny PS.
- Complete organization validation with DigiCert or Entrust.
- Publish the certificate URL in the a= tag of your BIMI record.
Frequently asked questions#
Which providers accept CMC?
Gmail accepts CMC as of 2024. Apple accepts VMC and CMC. Yahoo does not require a certificate.
Can I upgrade from CMC to VMC?
Yes, once the trademark registers. Reissue the certificate and update the a= tag.