BIMI.

Brand Indicators for Message Identification (BIMI), defined across IETF drafts (notably draft-ietf-dmarc-bimi) and the AuthIndicators Working Group specifications, allows a domain to publish a TXT record at default._bimi.example.com pointing to an SVG Tiny Portable/Secure (P/S) logo and, optionally, a certificate. Crucially, BIMI is not itself an authentication check — it is a reward layered on top of DMARC. A mailbox provider only renders the logo when the message passes DMARC with alignment and the domain enforces a policy of p=quarantine or p=reject, so BIMI gives organisations a visible incentive to finish DMARC enforcement rather than leaving it at p=none.

Two certificate types back the logo. A Verified Mark Certificate (VMC), issued by DigiCert or Entrust, proves the logo is a registered trademark and is the only path that earns Gmail's blue verified checkmark. Gmail began showing BIMI avatars in 2021 (VMC only); the AuthIndicators group added the Common Mark Certificate (CMC) in late 2024, which Gmail supports to extend logos to organisations without a registered trademark — but without the checkmark. Apple Mail displays BIMI logos since iOS 16 / iPadOS 16 / macOS Ventura 13, accepting either VMC or CMC. Because a VMC anchors the logo to a trademark and DMARC enforcement, BIMI raises the cost of brand impersonation and business email compromise.

flowchart TD
  M[Inbound message] --> A{SPF/DKIM pass and DMARC aligned?}
  A -->|no| N[No logo shown]
  A -->|yes| E{DMARC policy quarantine or reject?}
  E -->|no| N
  E -->|yes| B[Fetch BIMI record and SVG logo]
  B --> C{VMC or CMC present and valid?}
  C -->|VMC| V[Show logo + verified checkmark in Gmail]
  C -->|CMC| L[Show logo, no checkmark]
  C -->|none| L2[Some clients show logo, others require a cert]