BIMI (Brand Indicators for Message Identification)

Brand Indicators for Message Identification (BIMI) is a standard that lets a domain owner publish a logo to be displayed beside its emails in supporting mail clients. The logo appears only when the message passes DMARC, so BIMI works as a visible reward for strong email authentication. Gmail, Apple Mail and Yahoo are among the mailbox providers that support it.

How it works

A domain needs several things in place before a logo appears:

• DMARC at enforcement, meaning p=quarantine or p=reject applied to all mail.
• The logo as an SVG file in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, served over HTTPS.
• A BIMI TXT record at default._bimi.example.com, such as v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/mark.pem.
• For most major providers, a mark certificate from an authorized certificate authority.

There are two kinds of mark certificate. A Verified Mark Certificate (VMC) requires a registered trademark. A Common Mark Certificate (CMC) is aimed at logos without a registered trademark that have a documented history of use; Gmail accepts both, but shows its blue verified checkmark only with a VMC. Requirements differ between providers, so check each provider's current documentation.

Example

An illustrative case: a fictional bank reaches p=reject, obtains a VMC for its registered logo and publishes a BIMI record. Its messages in Gmail now show the logo and a checkmark. A phishing email sent from examplebank-alerts[.]com cannot show the bank's logo through BIMI, because the attacker cannot obtain a mark certificate for it.

How to spot problems

• Your logo does not appear because DMARC is still at p=none.
• The SVG file is rejected because it is not in the required profile.
• Attackers paste your logo into the message body or use it as a profile picture; that is not BIMI and proves nothing.
• A missing logo is not proof of fraud, since many clients do not support BIMI.

What brands can do

• Reach DMARC enforcement first; BIMI comes after that.
• Prepare a compliant SVG and obtain a VMC or CMC.
• Explain to customers that the logo is a helpful signal, not a guarantee.

BIMI makes genuine mail easier to recognize, but lookalike domains still exist. Phishvoid finds and takes them down; contact the team to learn more. Background on the underlying standards: SPF, DKIM and DMARC against email spoofing.

Read more: SPF, DKIM and DMARC: Stop Spoofed Email in Your Brand’s Name