Give the project a decision owner before a launch date
BIMI crosses the boundaries between brand management, legal review, DNS administration, email operations and web hosting. A project can stall even when every team finishes its own task: marketing approves one logo, a certificate covers another version, and DNS points at a third file. The first deliverable should be an agreed scope and acceptance record that connects those decisions.
Name one coordinator who can keep unresolved dependencies visible. Define the sending domains, mail streams, target receivers and desired display surfaces. “Make our logo appear everywhere” is not a testable requirement. A narrower goal, such as preparing one approved sender for documented Gmail eligibility and a separately identified Apple Mail receiving path, gives the team concrete evidence to collect without promising display.
BIMI Group warns that participating mailbox providers apply their own display criteria. Treat a recipient-specific matrix as a planning input rather than a compatibility checklist copied once and forgotten. BIMI implementation guide.
Split responsibilities without splitting the evidence
Marketing should supply the approved brand variant and explain where it will be used. Legal or the brand-rights owner should establish who may use that mark, which entity controls it and what certificate route is appropriate. The email administrator should inventory every legitimate sender affected by the proposed authentication policy. The DNS and hosting owners should identify their change controls, public endpoints and recovery options.
Store the decisions in one proposed acceptance packet. Each approval needs a scope, date and referenced asset or configuration version. “Logo approved” is insufficient when several files share a name. A file hash ties approval to specific bytes, while the domain list ties it to a defined sender scope. This is an operational control proposed here, not a claim that any approval has been obtained.
The coordinator should also identify the people who can approve spending, certificate enrollment, external data sharing and DNS changes. Technical preparation does not itself authorize those consequential actions. Keep those approvals separate from an editor's judgment that the article or checklist is complete.
Make authentication readiness the first technical milestone
Before requesting stronger enforcement, list marketing, transactional, support and employee mail that uses the domain. Inspect actual received-message identities and results for the relevant routes. DMARC evaluates aligned authenticated identifiers, so a sending platform's “DKIM enabled” screen cannot prove that the domain's messages pass at the receiver. RFC 9989, sections 4.3–4.4.
The email owner should give a specific recommendation about readiness and outstanding senders. A brand launch should pause if essential mail remains unverified. The resolution is to correct authentication or narrow the authorized plan, not to adopt enforcement blindly and hope the logo validates the decision.
Record provider compatibility caveats as their own work item. Google's BIMI guidance still lists pct=100, while RFC 9989 removed the percentage tag. Neither a project manager nor a designer should silently resolve that discrepancy by changing a live policy. Ask the email specialist to document the receiver requirements and intended policy behavior before release. Google BIMI setup; RFC 9989, Appendix A.6.
Resolve the certificate route before freezing artwork
For Gmail, Google's current documentation accepts VMCs and CMCs, while its checkmark is associated with VMC-verified senders. Its VMC path requires an eligible registered trademark; a CMC follows issuer-specific requirements. Legal should obtain the relevant issuer criteria rather than assuming the two products offer interchangeable rights, validation or display results. Google BIMI setup.
Have the issuer or responsible certificate operator confirm the accepted mark, covered domains and renewal process before the team commits to a production asset. A seasonal design or acquisition-related logo may need a new review. Do not overwrite an approved hosted file merely because the new artwork looks better; the relationship between the indicator and evidence must remain valid.
Apple Mail's BIMI path introduces another owner: the receiving mailbox provider. Apple documents checks and headers that the provider must supply. The sender's certificate purchase cannot substitute for that receiving-side participation. Keep Apple Branded Mail, if it is also desired, as a separate business-verification project rather than quietly adding it to the certificate task. Apple BIMI server guidance.
Use staged handoffs with concrete exit evidence
A proposed five-stage handoff works well: approve the scope; prove authentication readiness; approve and validate the asset and evidence route; verify hosted resources and the DNS assertion; then collect controlled receiving-side observations. Each stage should identify the next owner and what would cause work to stop.
In a fictional project, marketing approves a centered square logo, but legal has not confirmed its certificate eligibility. DNS remains on hold while design prepares a technically valid candidate. That is useful progress without a false launch claim. In a second hypothetical state, the certificate is available but one essential sender still fails alignment. The team holds enforcement changes and works on that sender rather than removing it from the inventory to make the checklist pass.
Retain the previous assertion and hosted resources where authorized, and agree how to reverse the BIMI-specific change if required. Authentication protection should not be weakened as a generic logo rollback. Restoration of an earlier URL or assertion also needs verification because caches and receiving behavior may delay the visible effect.
Define evidence and maintenance responsibilities
The proposed matrix distinguishes documentary eligibility from observed results. For every receiver row, request a current source, certificate applicability, actual DNS response, exact asset version, public fetch result and controlled message authentication. Record the display outcome with mailbox provider, client and date. Missing evidence stays open even if the launch meeting is complete.
Assign ongoing ownership for mark-certificate renewal, HTTPS certificate continuity, asset changes, sender onboarding and source-policy changes. A passing test is a dated observation, not permanent certification of the whole domain.
The catalogue requires “A receiver-specific eligibility matrix and evidence for DNS, logo, certificate and message authentication.” The matrix in this draft is a planning document only. No original deployment evidence, purchases, submissions, tenant changes or display tests were performed. Those gates, independent technical review and an authorized owner's release decision remain outstanding.