BIMI logos start with DMARC enforcement, not design

An inbox logo looks like a branding project. Mailgun and Red Sift’s message to senders is that it starts somewhere less glamorous: finding every system that sends email from your domain, then making sure those messages authenticate correctly.

In a joint webinar recap, the companies describe the route to Brand Indicators for Message Identification (BIMI), which can display a sender’s logo in supporting inboxes. Red Sift also demonstrated BIMI Maker, a free tool that handles logo preparation and readiness checks. It can simplify the application work, but it does not replace domain authentication or the paid certificate.

What happened

Red Sift’s Natalie Hays hosted the session with Mailgun’s JT Torres and Red Sift’s Iris Cox. Their agenda connected three jobs that senders sometimes treat separately: authenticating messages, enforcing a domain policy and preparing a logo for inbox display.

The threshold described in the recap is a Domain-based Message Authentication, Reporting, and Conformance (DMARC) policy of p=quarantine or p=reject, applied at 100%. A reporting-only policy, p=none, is useful for discovery but does not meet that enforcement requirement. Publishing a DMARC record and being ready for BIMI are therefore different milestones.

BIMI Maker tackles the preparation stage. Users can upload or search for a logo, and the tool converts it into a suitably formatted Scalable Vector Graphics (SVG) file. Previews show light and dark modes, plus the circular and rounded-square crops used by different inbox apps. That gives teams a chance to spot presentation problems before paying for a certificate.

The guided flow then covers certificate choice, domain and logo ownership verification, and a readiness check before applying. Mailgun’s recap says the tool is live, free and open to anyone. Those terms apply to the preparation tool—not to the certificate that follows.

The recap names two certificate options: a Common Mark Certificate (CMC), or a Verified Mark Certificate (VMC) for trademarked logos. It puts a CMC at around $1,000 a year for the first domain, with additional domains using the same logo at around $450 each. It does not give a VMC price, so this is not a complete comparison of certificate costs.

The background

The first layer is Sender Policy Framework (SPF): a published list of IP addresses authorized to send for a domain. Receiving providers can check the sending server against that list. This is why an inventory of sending services matters; authentication records need to reflect the systems actually handling the mail.

DomainKeys Identified Mail (DKIM) adds a digital signature to messages. Mailgun recommends using a 2048-bit key rather than the older 1024-bit standard where possible, and rotating keys regularly. That makes key maintenance part of the project, rather than treating authentication as a record published once and forgotten.

DMARC adds a policy and reporting framework around SPF and DKIM. Its roots go back to 2011, when Gmail, Yahoo, Hotmail, PayPal, Bank of America and LinkedIn were among the organizations working on a shared problem: authentication checks existed, but senders lacked a standard way to request handling of failures. The first specification appeared in January 2012.

The three policy settings have different purposes. p=none is for monitoring without requesting enforcement; p=quarantine asks receivers to treat failing messages as suspicious, commonly sending them to spam; and p=reject requests rejection. The distinction is central to our email authentication coverage: visibility into failures is not the same as asking receivers to act on them.

Mailgun’s recap says only about 7% of organizations have reached quarantine or reject at 100%, describing the remaining 93% as sitting at p=none. But it supplies no population, sample size or measurement date. That makes the figure a webinar claim, not a sufficiently documented estimate of enforcement across all organizations.

Torres offered a more concrete illustration of the discovery problem: an office printer-scanner still sending email from a 2003 configuration, found through a DMARC report audit. A forgotten device can sit outside the email team’s normal inventory while still relying on the company’s domain. Transactional messages and small senders need attention too; the recap explicitly rejects the idea that either category can ignore authentication.

What people are saying

Cox explained the relationship between the protocols with an event-entry analogy: SPF is the invitation list, DKIM is the badge and DMARC is the bouncer. The practical point is that a list of approved infrastructure and a message signature serve different roles from a policy telling receivers how to handle authentication failures.

Torres emphasized internal coordination before enforcement. Recruiting and sales tools may send from the company domain without IT or marketing knowing about them. The consequence is organizational as much as technical: the person editing the domain’s policy may not know every department whose messages will be affected.

Red Sift’s commercial case for BIMI rests partly on its own research. The recap reports a 44% increase in brand recall, a 39% increase in email open rates and a 32% increase in purchase intent compared with no logo. Torres said Mailgun had seen similar uplifts in its research, but the recap supplies neither that study’s figures nor methodology for the Red Sift findings. These are vendor-reported results, not a forecast for an individual sender.

The companies also make clear that logo display concerns supporting inboxes, rather than every mailbox. That limits how broadly a sender should frame the benefit internally. Authentication is also a distinct topic from the operational and security issues covered in Email Vox’s Mailgun email-alert guide and Cisco email-gateway patch report; a BIMI project should not be presented as a replacement for either kind of work.

What happens next

Mailgun’s recommended starting point is several weeks of reports at p=none. Teams should use that period to identify their email service provider, customer relationship management platform, older marketing tools and any other systems sending for the domain. The useful output is an inventory of legitimate senders, not simply a folder full of reports.

Next comes remediation: correct authentication for approved services and remove authorization for systems that should no longer send. The recap recommends moving to quarantine before reject, giving teams an intermediate stage in which failures may land in spam rather than be rejected outright. That still carries a delivery consequence for legitimate messages, so unresolved senders need attention before the policy changes.

Once enforcement is at 100%, the work shifts to logo readiness and certificate selection. BIMI Maker lets teams inspect the artwork and check prerequisites before applying. The recap gives no webinar date, certificate issuance timetable or deadline for adoption. This is a staged implementation path—not an announcement that every sender must buy an inbox logo on a new schedule.