BIMI's Security Model: What It Protects Against and What It Doesn't

BIMI's logo signals trademark ownership and DMARC enforcement — not email quality or sender reputation. It protects against spoofing the exact registered domain, not against lookalike domains (examp1e.com). Here's BIMI's four-layer authentication stack context, what VMC vs CMC actually certifies (trademark ownership, not email quality), why DMARC p=reject is the real security benefit in the BIMI requirement chain, and why major brands remain the primary BIMI adopters.

BIMI is positioned as an email trust signal — and it is — but the specific trust it signals is trademark ownership and technical authentication competence, not email content quality or sender reputation, which is why a perfectly configured BIMI logo doesn't prevent a brand-impersonating phishing campaign using a lookalike domain

The previous articles on this site covered BIMI setup, email deliverability, VMC/CMC certificates, why configured logos don't display, and SVG Tiny 1.2 requirements. This article addresses BIMI's security model — specifically what threat BIMI is designed to address, what threats it doesn't address, and how it fits into a broader anti-phishing strategy.

What BIMI actually protects against

BIMI's stated purpose is brand impersonation in email — specifically, making it harder for attackers to send email that appears to be from a brand's official domain by requiring:

DMARC at enforcement (p=quarantine or p=reject) — meaning email not authenticated with the brand's actual SPF/DKIM fails DMARC and is treated as suspicious
A Verified Mark Certificate (VMC, for Google/Yahoo) proving trademark ownership

The specific attack BIMI addresses: a phisher who obtains the domain example.com cannot display the real example.com's BIMI logo in Gmail when sending from example.com — because they don't have the VMC registered to the trademark owner.

The attack BIMI does not address: a phisher who registers examp1e.com (with a numeral 1 instead of letter l), example-security.com, or example-notification.com — lookalike domains. BIMI provides no protection against emails sent from different but similar-looking domains. The recipient sees no BIMI logo for the lookalike domain (which is actually correct behavior), but the phishing email can still look convincing with careful HTML design of the "From" display name.

The DMARC prerequisite: the actual security benefit

The more significant security benefit in the BIMI requirement chain is DMARC enforcement, not the logo itself.

A domain that implements DMARC at p=reject (required for BIMI) means:

Unauthorized senders cannot send email that passes DMARC from that domain — attackers can't spoof email from example.com to Gmail users without SPF/DKIM alignment
DMARC aggregate reports reveal all sources sending as the domain, enabling discovery of unauthorized use

BIMI provides the visible reward for implementing DMARC — a brand logo that signals "this is genuinely from us and the domain has strong email authentication." But the security comes from the DMARC requirement, not from the logo display itself.

An organization that implements DMARC p=reject without BIMI gets the same authentication security as one with BIMI — they just don't get the logo in supported inboxes.

VMC vs CMC: what the certificate actually certifies

Verified Mark Certificate (VMC): issued by certificate authorities (Entrust, DigiCert) after verifying trademark registration. The CA confirms that the applicant:

Controls the domain in the BIMI record
Owns a registered trademark matching the logo
The trademark is registered in an approved trademark office (USPTO, EUIPO, UK IPO, and several others)

Common Mark Certificate (CMC): a newer, lower-barrier alternative that doesn't require trademark registration — it verifies domain control and brand identity without the trademark prerequisite. CMC has more limited inbox support (Apple Mail supports both VMC and CMC; Google currently requires VMC for logo display in Gmail).

What the certificate verifies vs what it doesn't:

Verifies: the entity presenting the certificate legally owns the trademark and controls the domain.

Doesn't verify: the sender's reputation, the content of their emails, their compliance with email marketing regulations, or that their emails are valuable and not spam.

A brand that sends spam can have a valid VMC. The certificate is about trademark ownership and domain control, not about email quality or recipient consent.

BIMI in the context of the full email authentication stack

BIMI is the top layer of a four-layer email authentication stack:

Layer 1: SPF (Sender Policy Framework) — which IP addresses are authorized to send email for this domain. Prevents unauthorized mail servers from sending.

Layer 2: DKIM (DomainKeys Identified Mail) — cryptographic signature on the email content. Proves the email wasn't modified in transit and was signed by the claimed domain's key.

Layer 3: DMARC (Domain-based Message Authentication, Reporting & Conformance) — policy for what to do with messages that fail SPF and DKIM alignment. At p=reject, unauthorized messages are rejected.

Layer 4: BIMI (Brand Indicators for Message Identification) — visual brand indicator displayed for authenticated messages passing DMARC with a verified mark certificate.

Each layer depends on the one below: BIMI without DMARC is meaningless (BIMI requires DMARC); DMARC without SPF and DKIM is incomplete; SPF and DKIM without DMARC enforcement means unauthenticated messages still get delivered.

Google's BIMI adoption timeline: what changed and when

Gmail's BIMI support history:

2021: Gmail announced BIMI support in beta
2021-2022: expanded rollout to Gmail and Google Workspace
2023: Yahoo! Mail expanded BIMI support
2024: Apple Mail added BIMI support via CMC/VMC

The slow adoption reality: despite years of availability, BIMI logo display remains uncommon in most inboxes because:

VMC acquisition requires trademark registration and CA validation (months of process)
SVG Tiny 1.2 logo preparation is technically demanding
The required DMARC p=reject prerequisite requires careful email infrastructure preparation
Small organizations and bootstrapped businesses rarely prioritize the effort relative to other email improvements

Current state (2024): BIMI is most visible for large enterprise brands — banks, major retailers, airlines — that have both the trademark infrastructure and the email engineering resources to implement the full stack correctly.

How to use the BIMI Lookup on sadiqbd.com

Verify your BIMI DNS record: check that the TXT record at default._bimi.yourdomain.com is correctly formatted and resolves with the correct l= (logo URL) and a= (authority record URL) tags
Check prerequisites: before investigating BIMI-specific issues, verify that DMARC at p=quarantine or p=reject is in place — BIMI cannot work without DMARC enforcement
For competitive research: look up BIMI records for major brands to see how they structure their records and which certificate type they use

Frequently Asked Questions

If BIMI doesn't protect against lookalike domains, what does? A combination of tools, none individually sufficient. DMARC protects the exact domain; Brand Indicators protect against direct spoofing of the registered domain. Against lookalike domains, the most effective protections are: (1) defensive domain registration of common lookalike patterns (exampIe.com with capital I, examp1e.com with numeral 1, example-security.com); (2) monitoring certificate transparency logs for new certificate issuances to lookalike domains; (3) user security awareness training to verify the exact sender address; and (4) phishing-detection systems in email gateways that flag lookalike domain patterns. No single control eliminates the lookalike domain risk — defense in depth is required.

Is the BIMI Lookup free? Yes — completely free, no sign-up required.

Try the BIMI Lookup free at sadiqbd.com — check any domain's BIMI record, logo URL, and certificate configuration.

A BIMI Logo Doesn't Stop Phishing — What BIMI's Security Model Actually Protects Against