What is BIMI?
BIMI, Brand Indicators for Message Identification, is a DNS-published standard that lets an organization display its logo beside its messages in mailbox providers that support it. The logo appears only when a message passes DMARC and the sending domain's DMARC policy is at enforcement. BIMI authenticates nothing on its own. It rewards domains that have finished deploying SPF, DKIM and DMARC, and it gives recipients a visual cue that a message really came from the brand.
How BIMI works
- The domain reaches DMARC enforcement,
p=quarantineorp=reject, applied to all of its mail. A policy ofp=nonenever qualifies. - It prepares its logo as an SVG file in a restricted profile called SVG Tiny Portable/Secure (SVG P/S), which forbids scripts and external references.
- It obtains proof that it owns the mark, usually a Verified Mark Certificate (VMC). A certificate authority issues a VMC only after confirming the logo is a registered trademark held by the applicant. Some providers now also accept a Common Mark Certificate for a logo with a documented history of use but no trademark registration.
- It publishes a TXT record at
default._bimiunder its domain that points to both files. - When a supporting receiver gets a message that passes DMARC, it looks up the record, validates the logo and certificate, and displays the logo.
Example: the BIMI record
default._bimi.example.org. 86400 TXT "v=BIMI1; l=https://example.org/assets/brand-mark.svg; a=https://example.org/assets/brand-vmc.pem"
The v=BIMI1 tag identifies the record, l= gives the HTTPS location of the logo, and a= gives the location of the mark certificate, called the authority evidence. A sender can publish records under other selector names and choose one per message with a BIMI-Selector header, but most use default. A receiver that finds the record while the domain's DMARC policy is still p=none ignores it, so the most common reason a logo never appears is a DMARC rollout that stopped at monitoring.
What BIMI does and does not protect
- It gives organizations a visible business reason to finish their DMARC rollout, and DMARC enforcement is the control that actually stops direct spoofing of the domain.
- Mail that fails the domain's DMARC check never shows the logo, and where a provider requires a mark certificate, a lookalike domain cannot obtain one for someone else's trademark.
- It does not stop lookalike domains from sending mail, and it does nothing about a compromised legitimate mailbox, whose messages pass DMARC and carry the logo.
- Support varies. Some large providers display BIMI logos and many mail clients do not, and the requirements are set by each provider and have changed over time.
BIMI vs. SPF, DKIM and DMARC
| Record | What it establishes |
|---|---|
| SPF | The sending server is authorized for the envelope domain |
| DKIM | A domain signed the message and the signed parts were not altered |
| DMARC | SPF or DKIM passed for a domain aligned with the visible From address, plus the policy and reporting |
| BIMI | No new check; a logo for mail that passed DMARC at enforcement |
BIMI on the CompTIA Security+ exam
BIMI is one of the email security items added in SY0-801, taught with SPF, DKIM and DMARC among the mitigating controls in objective 4.1, and it is on the exam's acronym list. Wording such as display the company's logo next to its messages in customers' inboxes points to BIMI, and the prerequisite to name is DMARC at quarantine or reject. Distractors include S/MIME, which signs and encrypts individual messages with user certificates; DKIM alone, which signs mail but does not tie the result to the visible From address; and an extended validation certificate, which applies to websites rather than email.