BIMI

What it means

BIMI stands for Brand Indicators for Message Identification. It lets a company publish its logo in DNS so that supporting mailboxes can show it next to messages from that domain. It works only for mail that already passes authentication, so the logo acts as a visible sign that a message is genuine. It is a trust signal for recipients, not a lock on your domain.

The idea that makes it click: BIMI does not protect anything on its own. It rewards you for doing the underlying work. To qualify, your domain needs enforced DMARC, which in turn depends on correct SPF and DKIM. Check what each provider requires.

Why it matters

The benefit is trust and recognition. A customer scanning an inbox sees a familiar logo on real messages and none on lookalikes, which makes fakes easier to spot. For brands that send invoices, password resets or alerts, that helps against phishing that copies their look.

The side effect that matters most is the push to enforce DMARC. Many domains publish a policy that only monitors and never blocks, so spoofed mail still gets through. BIMI gives marketing a reason to fund the work. Do not count on it as a defence: it only helps users who notice and whose mailbox supports it.

How it shows up

You set it up with a DNS record that points to a logo in SVG format, and, for most major mailbox providers, a certificate that proves you own the mark. Gmail, for example, asks for a verified mark certificate before it shows the logo and a verified check mark. Support varies by mailbox provider, so the logo appears for some recipients and not others.

Repeating mistakes: starting with the logo before DMARC is enforced, using a logo file in the wrong format, forgetting that every sending service for the domain, including marketing and billing tools, must authenticate correctly, and expecting it to stop email spoofing on lookalike domains. Check each sender in your DMARC reports first.