Everything marketers need to know about BIMI: The latest email standard

BIMI serves as a highly visibly tactic for authenticating emails by indicating to the recipient that a message is from who it says it is and safe to open. It allows companies to leverage their existing DMARC enforcement policies to increase brand value by displaying logos to your customers. “DMARC is the switch,” said Blank.

So, what is BIMI?

The BIMI standard validates email senders through a multi-step process, verifying that the sender’s data is aligned with the sender’s owned brand domain. If the email passes each step, the brand’s logo will appear in the recipients’ inbox — next to the sender’s name. The recipient can be assured upon seeing the logo that the message is safe to open and isn’t from someone impersonating your brand.

BIMI is a way for brands to publish their logos in their customers’ inboxes and allows logos to be easily incorporated into messaging. BIMI does this with built-in protections that safeguard the brand, application providers and consumers from impersonation attempts.

“By increasing consumer confidence in the authenticity of our messages, we believe brand indicators will increase response rates, magnifying the power and reach of our marketing efforts,” said Torsten Reinert, senior manager messaging delivery at Groupon.

Inbox provider Yahoo! is currently piloting BIMI with a number of brands, including Groupon, Aetna and The Home Depot, among others.

How does BIMI work?

For a BIMI logo to be displayed, the sender needs to have DMARC, SPF and DKIM set in place so that the source can be marked as trusted. The brand also needs to publish its logo in the DNS (Domain Name System) record.

BIMI is a text file that resides on your sending server and follows a specific format similar to other email authentication formats like SPF, DKIM, and DMARC. Once the recipient receives the email, the email service (inbox provider) locates the BIMI file to verify the message. Once authenticated, the BIMI file points the recipient’s email service to the brand logo and displays it in the inbox.

Pre-requirements for BIMI: While this list of required standards isn’t overwhelmingly long, it is critical to recognize that verifying your email authentication to publish an enforcement-level DMARC record will take time, effort and investment to get right.

The following email authentication standards are required:

• Emails are authenticated with SPF, DKIM, and DMARC
• DMARC policy is at enforcement; set to either “p=quarantine” or “p=reject”
• Publish a BIMI record for the domain in DNS

Logo verification. The next step is to select a logo and work with a Mark Verifying Authority (MVA), an organization that can provide evidence of verification of certain indicators standards, including size, trademark and content, to receive a Verified Mark Certificate (VMC). It is important to note that while obtaining a VMC is not explicitly required for BIMI at this time, the AuthIndicators Working Group anticipates that VMC will become a requirement in the relatively near future.

“The problem this certificate solves is, you have to prove you own the rights to the logo,” Blank said. Last October, CNN became one of the first brands to receive a VMC after working with identity and encryption provider DigiCert to validate the authenticity of the brand’s logo.

Companies (email senders) receive free added value to their email programs by increasing brand visibility in the inbox by implementing BIMI. It is critical to note, however, that BIMI does not guarantee inbox placement — you still need to follow email best practices and maintain a stellar sender reputation.

BIMI in action

Financial institutions — banks, for example — can use BIMI to display their logo next to its email message, assuring recipients that the message really was sent by that institution.

Pilot program: initial results

Initial results from the pilot program are encouraging — but the BIMI group reminds us that these results are still earlier. The group is hopeful that increased pilot programs with brands and inbox providers will continue to yield positive results.

“Early data from the pilot with Yahoo! show increased engagement with emails that display a BIMI logo, on average yielding a 10% increase in open rates,” said Blank.

With widespread use of VMC, BIMI, and DMARC — in addition to existing SPF and DKIM policies — companies will be able to amplify and protect their online presence through authenticated messages to consumers that are instantly recognizable by their known, protected brand marks.

---