BIMI — Brand Indicators for Message Identification

What BIMI means

BIMI — Brand Indicators for Message Identification — is a specification from the AuthIndicators Working Group, still an IETF draft rather than a published RFC. A BIMI record is a TXT record at default._bimi.example.com reading v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem, where l names the logo and a names a certificate vouching for the right to use it.

The logo must be SVG Tiny Portable/Secure, a restricted profile with no scripting, no external references and a square viewport. The a= tag points at a Verified Mark Certificate or a Common Mark Certificate, issued after a check on a registered trademark or on prior use; several large mailbox providers display nothing without one, and none of them promise to display anything at all.

Nothing about BIMI works until DMARC does. The specification requires an enforcing DMARC policy — p=quarantine or p=reject — on the domain in the header From, and providers apply their own reputation tests on top of it. A valid BIMI record is a necessary condition for a logo and never a sufficient one.