BIMI (Brand Indicators for Message Identification)

BIMI (Brand Indicators for Message Identification) is an email specification developed by the AuthIndicators Working Group. A domain owner publishes a TXT record at default._bimi.<domain> pointing to an SVG logo and, usually, to a Verified Mark Certificate. When a message passes DMARC, a supporting mailbox provider can fetch the logo and display it beside the message in the inbox.

Why it matters

BIMI turns email authentication work into something visible: the logo is only eligible if the message passes DMARC and the domain enforces DMARC with a quarantine or reject policy. For brands, this gives recognizable inbox presence and an incentive to finish a DMARC rollout, which in turn makes spoofing the domain harder. Gmail, for example, requires the logo to be backed by a mark certificate such as a VMC before displaying it; the certificate is fetched as a PEM file and validated like any other X.509 chain. Because each provider sets its own rules, the same domain may show a logo in one inbox and not in another.

Example

dig +short TXT default._bimi.example.com
# "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
dig +short TXT _dmarc.example.com
# "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Common misconceptions

• BIMI is an anti-spoofing protocol. The protection comes from SPF, DKIM and DMARC; BIMI is a display layer that rewards having them in place.
• Publishing the DNS record is enough. Without DMARC enforcement, and usually a VMC, providers will not show the logo.
• BIMI is related to S/MIME. S/MIME signs or encrypts individual messages with personal certificates; BIMI only governs how the sender's brand is displayed.