For the newcomers to the discussion, what this means is that Gmail will display the company\u2019s logo right in the user\u2019s inbox, after the email passes a few security checks. That\u2019s great for brands and great for users (it makes it easy to spot emails that are verified.)<\/p>\n\n\n\n
But what does this move to BIMI standardization by Google mean for you in terms of your brand authentication and security? We\u2019ll answer these questions about BIMI and more in this article, which also features a Q&A at the end.<\/p>\n\n\n\n
Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span><\/span>\n\n\n (Editor\u2019s Note<\/strong>: Since this article was originally published, BIMI now works with a second type of Mark Certificate<\/a>, called a Common Mark Certificate<\/a>. A CMC is a certificate that allows you to display your brand\u2019s logo next to your company name in emails to Gmail recipients.<\/em> <\/p>\n\n\n\n Learn about how BIMI and Common Mark Certificates make it easier to display your logo in Gmail<\/a>.)<\/em><\/p>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n BIMI, the acronym for brand indicators for message identification<\/a>, is an email standard that allows you to display your designated, verified brand logo next to in the \u201cfrom\u201d name on authenticated emails. While this open system relies on existing authentication protocols like DMARC, DKIM, or SPF, it isn\u2019t a new authentication protocol in and of itself.<\/p>\n\n\n\n The BIMI standard uses two different mechanisms to verify emails before displaying the company\u2019s logo: DMARC and verified mark certificates (VMCs).<\/p>\n\n\n\n But wait, isn\u2019t authentication what email signing certificates already do?<\/p>\n\n\n\n Yes and no. An email signing certificate<\/a> is issued for an individual user (for example bob@example.com) and it doesn\u2019t include a logo. It not only authenticates an email sender but it also encrypts email as well (if the recipient also uses an S\/MIME certificate).<\/p>\n\n\n\n A verified mark certificate, on the other hand, is issued at the organization level. You can effectively fight misrepresentation of your brand by ensuring that any emails you send will display your company logo and brand.<\/p>\n\n\n\n So, in some ways, VMCs are kind of like SSL\/TLS certificates<\/a> in that they\u2019re issued once a CA verifies your organization. But unlike SSL\/TLS certificates, which display a padlock in the web address bar, these will put your organization\u2019s logo front and center. This means that no one can question whether an email came from your organization. (EV SSL certificates do display your organization\u2019s name in the certificate information, but it still won\u2019t show your logo.)<\/p>\n\n\n\n To put it simply, BIMI takes your email and brand authentication capabilities to a whole new level. As Google put it in their announcement:<\/p>\n\n\n\n Our BIMI pilot will enable organizations, who authenticate their emails using <\/em>DMARC<\/em><\/a>, to validate ownership of their corporate logos and securely transmit them to Google. Once these authenticated emails pass all of our other anti-abuse checks, Gmail will start displaying the logo in existing avatar slots in the Gmail UI.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Dean Coclin<\/a>, Senior Director of Business Development at DigiCert, says that while using DMARC is great, brands often underutilize it.<\/p>\n\n\n\n At DigiCert, strong validation is one of the things we do best, and we are excited about participating in the Gmail BIMI pilot. DMARC can provide companies great value, but not enough brands take advantage of its protection. The BIMI working group and DigiCert are collaborating to increase usage of this important security standard while delivering additional value to those increasing security for their users.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n While Google isn\u2019t the first to implement BIMI \u2014 the BIMI Group<\/a> says that Verizon Media Group actually paved the way for it when they adopted it for their Yahoo and AOL email services \u2014 they certainly won\u2019t be the last.<\/p>\n\n\n\n In 2019, DigiCert issued a VMC to CNN<\/a>, which made their emails display like this:<\/p>\n\n\n\n According to Coclin:<\/p>\n\n\n\n VMCs play a major role in providing cryptographic assurance that the trademarked logos have been vetted per BIMI standards and that the individual requesting is who they say they are and from the company they say they represent. This is a high hurdle to pass! VMCs provide the following benefits for organizations: All of this is to say that if you care about organizational identity, then you should care about BIMI. I say that because using brand indicators for message identification is a great step forward in the battle against email-based cybercrimes and fraud schemes. With BIMI, you can:<\/p>\n\n\n\n Basically, it\u2019s a win-win for your company and customers and throws a massive monkey wrench in cybercriminals\u2019 plans. <\/em><\/p>\n\n\n<\/span><\/span>\n\n\n To help you better understand the impact of Google\u2019s announcement and how to prepare for the changes it\u2019ll bring to inboxes and your approach to DMARC, here are answers to a few questions you may have:<\/p>\n\n\n\nWhat Is BIMI and Why Should I Care?<\/h2>\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/vmc-phone.png\")
\n
VMCs vs Other PKI Digital Certificates<\/h3>\n\n\n\n
Why Google\u2019s BIMI Move Matters for Your Organization<\/h3>\n\n\n\n
\n
\n
This Move by Google Marks a Major Step Toward Greater Email Security for Everyone<\/h3>\n\n\n\n
![\"This](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2020\/07\/cnn-vmc-email-logo-display-1024x640.png\"){kind=logo}
\n
What You Should Know About the BIMI Pilot (And How It Will Affect Your Organization)<\/h2>\n\n\n\n
What Is BIMI?<\/h3>\n\n\n\n