Frequently asked questions

Is XCIM a standard?

No. XCIM v0.1 is a draft design under development and has not been submitted or adopted as an IETF standard.

Does XCIM compete with the Email Verification Protocol?

No. EVP verifies that a user controls an email address. XCIM uses independently verifiable identity evidence such as EVP or OIDC as input to a separate permission decision. XCIM records which application the recipient authorized, for which communication purposes, and the resulting portable permission state.

Does EVP verification mean the user accepted marketing?

No. Email-address verification is not communication permission. Marketing, newsletter, promotional and other optional purposes require an explicit XCIM decision against a defined Consent Manifest.

Does XCIM still require a Google OAuth client?

No as a protocol requirement. OIDC remains a supported identity-evidence profile, but XCIM application identity is independent from an OAuth client. Experimental EVP support can remove the need for vendor OAuth configuration where browser/provider support is available.

Is EVP production-ready?

XCIM currently treats EVP as experimental. It is an active Internet-Draft and browser-origin-trial feature, and its browser/provider behavior may change. OIDC remains available as a fallback/reference identity-evidence path.

Is the network live?

No production verification infrastructure or trust assertions are active. xcim.net reports the public operational state.

Does XCIM replace SPF, DKIM, or DMARC?

No. Those mechanisms continue to authenticate sending infrastructure and domains. XCIM explores evidence about application-scoped recipient authorization.

Does a valid proof guarantee inbox delivery?

No. The recipient system retains full control over filtering, abuse prevention, trust selection and delivery.

Does XCIM publish recipient addresses?

The design goal is to avoid exposing plain recipient identifiers in public infrastructure. The precise privacy-preserving representation is not yet normative and remains subject to security review.

Can I implement it now?

You can review the architecture and use the published draft tools in shadow mode, but interoperable implementation claims should wait for canonical Identity Evidence schemas, serialization rules, vectors and resolver behavior.

How can I contribute?

Review the documents, join the Early Partners cohort, inspect open questions in status and use the published contact channel.