BIMI and mail-authenticity UX

BIMI and mail-authenticity UX

TL;DR: BIMI (Brand Indicators for Message Identification) lets mailbox providers render a brand’s logo next to authenticated messages, but only after the sender enforces DMARC (p=quarantine or p=reject) and, for the major providers, presents a Verified Mark Certificate (VMC) proving trademark ownership. It is best understood as a UX layer on top of dmarc-spf-dkim-deep and survives forwarding only when arc-and-mail-forwarding is in play. Critics argue VMCs turn anti-fraud into a paid feature; defenders argue the logo is the only authentication signal users actually see.

Why it matters

End users do not read Authentication-Results headers. They look at the avatar circle in Gmail or the sender chip in Apple Mail. Before BIMI, that avatar was either a Gravatar, a contact-photo, or a coloured initial generated by the client - all easy for phishers to mimic by changing the display name. BIMI binds the avatar to a DNS record under the organisational domain, which can only be set if the attacker controls DNS, and (for Gmail/Yahoo/Apple) to a VMC issued against a registered trademark.

The security value is therefore indirect: BIMI itself does not authenticate anything new, it forces the prerequisite (DMARC enforcement) and gives the legitimate brand a visible reward for getting alignment right. For brand-protection teams it is often the lever that finally unlocks budget for a long-stalled DMARC project. See case-study-okta-2023-support-system and aitm-evilginx-modern-phishing for why the visible-trust channel matters even when the cryptographic chain is intact.

How BIMI works

The DNS record

A BIMI record is a TXT record at default._bimi.<domain> (selectors other than default are allowed but rarely used). Example:

1

default._bimi.example.com.  IN TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Tags:

  • v=BIMI1 - version.
  • l= - HTTPS URL to an SVG Tiny PS (Portable/Secure) logo. The SVG profile forbids scripts, external references, animations and raster fallbacks.
  • a= - HTTPS URL to the VMC (or CMC - Common Mark Certificate, for non-trademarked logos, accepted by Gmail since 2024).

If a= is missing, only providers that accept self-asserted BIMI (historically Fastmail) will render the logo. Gmail, Yahoo, Apple Mail and AOL all require a certificate.

The Verified Mark Certificate

A VMC is an X.509 certificate issued by a small number of CAs (DigiCert and Entrust at time of writing) under the BIMI Working Group profile. To get one, the requester must:

  1. Own a registered trademark for the logo in one of the accepted jurisdictions (USPTO, EUIPO, UK IPO, JPO, IP Australia, CIPO, plus a few others).
  2. Pass identity verification of the legal entity (similar to EV certificate vetting).
  3. Submit the SVG; the CA pins its SHA-256 hash into the certificate extension id-pe-logotype.

Annual cost has been in the USD 1,000-1,500 range. CMCs (cheaper, no trademark required) were introduced in 2024 and produce a “verified by Gmail” style indicator that is visually distinct from a trademarked VMC tick.

Render path in the mailbox

  1. Inbound message arrives, MTA evaluates SPF, DKIM, DMARC. See dmarc-spf-dkim-deep.
  2. If DMARC passes and the policy is quarantine or reject and the organisational domain has a BIMI record, the mailbox provider fetches the SVG and VMC.
  3. The provider verifies the certificate chain, checks the SVG hash matches the logotype extension, and confirms the certificate’s subjectAltName covers the DMARC organisational domain.
  4. On success, the avatar circle is replaced with the logo and (Gmail/Apple) a small tick.

Failure at any step silently falls back to the default avatar - users never see a “BIMI broken” warning.

Deployment status

  • Gmail - generally available since 2021, added CMC support in 2024, requires DMARC enforcement and a VMC/CMC.
  • Yahoo Mail / AOL - shipped first in 2020 as the original pilot.
  • Apple Mail - rolled out with iOS 16 / macOS Ventura (2022), VMC required.
  • Fastmail - supports BIMI without VMC (self-asserted) for its own users.
  • Microsoft 365 / Outlook.com - announced preview in 2024, still rolling out at time of writing; check current docs before promising it to a brand team.

MTA-STS, TLS-RPT and the transport story

BIMI does not mandate MTA-STS, but a brand that has invested in BIMI usually wants the same message to be delivered over authenticated TLS so the logo is not the only trust signal at risk. Pair the BIMI rollout with:

  • MTA-STS (_mta-sts.<domain> TXT plus the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt) so sending MTAs refuse to deliver to your domain over downgraded or unauthenticated TLS.
  • TLS-RPT (_smtp._tls.<domain> TXT) to get aggregate reports on TLS failures.

For receivers, DANE for SMTP is the alternative; pick one based on whether your DNS is DNSSEC-signed - see dnssec-misconfig-attacks for the cost of getting DNSSEC wrong.

Defensive baseline

If you are the brand:

  • Get DMARC to p=reject with full alignment first. BIMI is meaningless at p=none.
  • Inventory sending services (marketing, transactional, helpdesk, payroll, support ticketing). Each must SPF-align or DKIM-align under the organisational domain or a subdomain you control.
  • Decide on an SVG that survives the Tiny PS profile - many brand logos need a custom redraw. Keep the master file under version control.
  • Buy the VMC under the legal entity that owns the trademark, not a marketing agency.
  • Publish BIMI on the organisational domain and on any subdomain that sends mail and has its own DMARC record - children do not inherit the parent BIMI lookup.
  • Monitor DMARC aggregate reports for new senders that would silently lose the logo.

If you are the receiver (running your own mail platform), treat BIMI as untrusted input: fetch the SVG with a hardened parser, enforce size limits, and never render it before the cryptographic checks have passed. The 2022 research on SVG-based XSS in mail clients is the cautionary tale.

Criticism and trade-offs

  • Cost as a barrier. VMCs cost real money annually, which means smaller brands cannot get the logo even if they enforce DMARC perfectly. Critics argue this turns anti-phishing into a luxury good.
  • Trademark gating. Only logos registered as trademarks in supported jurisdictions qualify for a VMC. Open-source projects, NGOs and individuals are effectively excluded unless they buy a CMC.
  • No protection against lookalike domains. BIMI binds a logo to a domain. An attacker registering examp1e.com simply gets no logo - but to the user, a missing logo is not alarming because most mail still has no logo.
  • Provider concentration. The render decision is made by a handful of mailbox providers. A change in Gmail’s BIMI policy can invalidate a brand’s investment overnight.
  • SVG attack surface. Every parser is a target. Tiny PS reduces but does not eliminate the risk.

Workflow to study

  1. Read the BIMI Group’s technical overview and the IETF drafts (draft-blank-ietf-bimi and draft-fetch-validation-vmc-wchuang).
  2. Set up a lab domain with p=reject, publish a self-asserted BIMI record pointing at a Tiny PS SVG you generated. Verify on Fastmail.
  3. Read the VMC profile in the CA/Browser Forum BIMI requirements document - note the logotype extension format and the SAN constraints.
  4. Take a known-good BIMI deployment (large bank, large retailer) and trace it: dig TXT default._bimi.<domain>, fetch the SVG, fetch the VMC, decode with openssl x509 -text, inspect the logotype extension.
  5. Build a small checker script that mirrors what Gmail does: DMARC lookup, BIMI lookup, SVG fetch, VMC chain validation, hash match. Compare its verdict against Google’s Postmaster Tools BIMI tab.
  6. Read at least one phishing case where the attacker abused a permissive subdomain to obtain a “verified” logo - usually the failure was in DMARC alignment on a forgotten subdomain, not in BIMI itself. See case-study-okta-2023-support-system for the general pattern of forgotten sending surfaces.
  7. Pair the study with arc-and-mail-forwarding to understand why BIMI vanishes after a mailing-list hop unless ARC is preserved.

References

  • BIMI Group, “BIMI Overview”: https://bimigroup.org/
  • AuthIndicators Working Group, BIMI specification drafts: https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/
  • Google, “About Brand Indicators for Message Identification (BIMI)”: https://support.google.com/a/answer/10911321
  • Apple, “Use Business Connect to verify your brand in Mail” (BIMI/VMC handling on Apple platforms): https://support.apple.com/guide/business-connect/welcome/web
  • CA/Browser Forum, Verified Mark Certificate requirements: https://cabforum.org/working-groups/code-signing/documents/
  • Fastmail, “BIMI support without VMC”: https://www.fastmail.help/hc/en-us/articles/4406536368911-BIMI-and-your-logo