XCIM / Introduction

Introduction

XCIM is a draft protocol for attaching verifiable, application-scoped consent evidence to email while keeping delivery compatible with the existing mail stack.

Problem statement

Email authentication can establish facts about domains and messages, but it does not by itself prove that a recipient authorized a particular application to send a particular class of mail. XCIM explores a portable proof layer for that missing relationship.

Protocol model

  1. An application requests consent through an issuer-hosted flow.
  2. The issuer records an application-, recipient-, and scope-specific grant.
  3. A sender carries a compact reference and proof with the message.
  4. A verifier checks cryptographic evidence, current public state, and its own trust policy.

Trust boundaries

XCIM does not replace SPF, DKIM, DMARC, ARC, mailbox policy, or abuse controls. A valid XCIM proof is one input to a verifier; it is not a guarantee of delivery, safety, or endorsement. Issuers and verifiers remain independently governed.

Current scope

The work is at draft v0.1 and pre-launch. Canonical schemas, test vectors, transparency proofs, and resolver behavior remain in development. See protocol status and documents.