Identify the launch object

Name the visible From domain, sending streams, BIMI selector, brand/legal entity, expected logo, target providers, launch owner, and UTC decision date. State whether the launch is self-asserted, VMC-backed, or CMC-backed. Do not describe a certificate as universally accepted.

Attach authentication evidence

Include the applicable DMARC record and discovery path, enforcement decision, SPF/DKIM aligned paths, and fresh trusted Authentication-Results from each representative stream. Add aggregate-report review periods and any material unresolved senders. Sanitize recipient addresses and omit message bodies unless absolutely required in an approved repository.

Fingerprint assets and evidence

For the SVG, record the exact HTTPS URL, checksum, byte size, content type, Tiny P/S validator result, visual approval, and brand owner. For the mark certificate, record URL, checksum, issuer, serial/fingerprint, validity, covered domains, logo match, certificate class, and legal approval. Keep sensitive application documents outside the general pack and link to the controlled system.

Capture DNS and hosting

Store the full BIMI assertion, authoritative and recursive query evidence, TTL, publication time, and rollback record. Add external HTTPS checks for TLS chain, redirects, status, MIME type, and CDN/WAF accessibility. Record monitoring and ownership for DNS, host, certificate, and assets.

Report provider observations precisely

Use a table with provider, account type, client/view, message time, selector, display observed, screenshot/evidence, official requirement page, and date checked. “Not displayed” should keep likely gates and unknown provider criteria separate. Do not turn a successful test account into a global promise.

Approve and operate

Obtain named technical, security, brand/legal, and business approvals. Define rollback, certificate renewal, asset-change, incident, and revalidation schedules. Keep the previous asset pair through the transition.

The final decision should say “eligible configuration validated and display observed at these named surfaces” or explain the outstanding gate. BIMI does not change SMTP delivery and must not be marketed as an inbox-placement guarantee. A launch pack is valuable because it makes that boundary—and every accountable dependency—visible.