What's BIMI - and should your business be using it?

Fri, 23 Jan 2026 14:14:50 +0000

Email security has come a long way in recent years. Most businesses are now familiar with SPF, DKIM and DMARC as the foundations of protecting their domain from spoofing and phishing. But there’s a newer standard gaining attention: BIMI.

BIMI promises better brand recognition, improved trust, and a visual stamp of authenticity in your customers’ inboxes. Sounds great… but is it actually realistic for small businesses right now?

Let’s break it down.

What is BIMI?

BIMI (Brand Indicators for Message Identification) allows your organisation’s logo to appear next to emails you send in supported inboxes (such as Gmail and Yahoo).

Instead of just seeing a sender name or generic initial, recipients can see your verified brand logo alongside your email. This helps users quickly recognise legitimate messages and reduces the risk of phishing.

In short:

Stronger brand visibility
Increased trust with recipients
Clearer separation from spoofed or fraudulent emails

But BIMI isn’t just a logo upload. It’s tightly linked to email authentication and security standards.

Without BIMI

With BIMI

The Prerequisites for BIMI

Before BIMI is even an option, your email domain must meet strict security requirements:

So far, all reasonable… until we get to the biggest barrier.

1. DMARC enforcement

Your domain must have DMARC set to p="quarantine" or p="reject.

This means:

SPF and DKIM must be correctly configured
You must be confident that legitimate mail won’t be blocked
Any unauthorised senders are actively rejected or quarantined

You can read more about DMARC here.

2. A compliant BIMI logo

Your logo must be:

In SVG Tiny 1.2 format
Square and properly optimised
Hosted securely and publicly accessible

This isn’t a standard SVG export and often requires specialist design or conversion work.

3. A BIMI DNS record

A DNS record is added to your domain that:

Points to your logo
References your Verified Mark Certificate (VMC)

So far, all reasonable… until we get to the biggest barrier.

The Blocker: Verified Mark Certificates (VMCs)

To display a BIMI logo in major inboxes like Gmail, you need a Verified Mark Certificate.

A VMC:

Proves you own the logo
Confirms you have the legal right to use it
Is issued by a recognised Certificate Authority (such as DigiCert)

Why this is a problem for small businesses

VMCs come with two major costs:

Trademark registration - Your logo must be a registered trademark. This alone can cost hundreds to thousands of pounds and take months to complete.
Annual certificate fees - VMCs typically cost £800–£1,500+ per year, depending on the provider.

For large brands, this is a reasonable investment.

For most small businesses, it simply isn’t.

Is BIMI worth it right now?

For enterprise organisations and well-known brands, BIMI makes sense:

They already have trademarks
The cost is marginal relative to marketing budgets
Brand impersonation is a serious risk

For small and growing businesses, the reality is different.

While BIMI is technically impressive, it’s currently:

Expensive to implement
Dependent on trademark ownership
Limited in inbox support
Hard to justify compared to other security improvements

Right now, BIMI is more of a “nice to have” than a necessity for most SMEs.

What should small businesses focus on instead?

If your goal is email trust and security, your effort is usually better spent on:

Properly configured SPF, DKIM and DMARC
Gradually moving DMARC to enforcement (quarantine → reject)
Monitoring DMARC reports to prevent legitimate mail issues
Reducing spoofing and phishing risks at the domain level

These steps deliver real security benefits without the high costs attached to BIMI.

Our View

BIMI is a great idea, but it’s not yet accessible for most small businesses.

As the ecosystem matures and costs come down, we expect BIMI to become far more achievable. Until then, getting your email authentication right is the most effective way to protect your brand and your customers.

If you’re unsure where your domain stands - or want help tightening up your email security - we can help you get there, without unnecessary complexity or expense.

Contact

Get in touch with the team to discuss how we support your business with practical, people-first technology and long-term solutions.

About

Learn who we are, what we stand for, and how Ostratto helps businesses make their work, less work through practical technology solutions.

Learn More

Our Approach

Discover how we partner with you - focusing on strategy, simplicity and long-term value to deliver technology that truly supports your business.

Learn More

DMARC: What's going on?

Wed, 26 Feb 2025 10:54:36 +0000

Email security is a critical component of any organisation's cybersecurity strategy. Yet, despite its importance, many businesses have been slow to adopt DMARC (Domain-based Message Authentication, Reporting & Conformance). DMARC helps prevent email spoofing, phishing, and other cyber threats, but its implementation has lagged behind.

In this article, we'll explore why DMARC adoption has been slow and provide a step-by-step guide on how to set it up for your domain.

What is DMARC?

DMARC is an email authentication protocol designed to protect domains from being used for email spoofing and phishing attacks. It works by ensuring that emails sent from your domain are properly authenticated using SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

A DMARC policy tells receiving mail servers what to do when an email fails authentication—whether to monitor (no action), quarantine (send to spam), or reject (block outright) unauthorised emails.

How DMARC Works

SPF and DKIM Check: The recipient's mail server checks if the email passes SPF and DKIM authentication.
DMARC Policy Evaluation: Based on the configured DMARC policy (none, quarantine, or reject), the server determines what to do with the email.
Reports Sent: The recipient’s mail server sends DMARC reports back to the domain owner, providing insights into email activity and unauthorised email attempts.

Why Has DMARC Adoption Been Slow?

Despite its benefits, DMARC adoption has been sluggish. Here’s why:

Complexity of Implementation - Setting up DMARC requires proper configuration of SPF and DKIM records, which can be confusing for businesses without dedicated IT teams.
Risk of Email Deliverability Issues - If DMARC is misconfigured, legitimate emails could be rejected or marked as spam, disrupting communication. This risk makes many hesitant to enforce strict policies.
Lack of Awareness - Many businesses don’t realise that their domains can be exploited for email spoofing. Without awareness of the risks, there’s little urgency to adopt DMARC.
Perceived as a ‘Big Business’ Solution - Some SMEs believe DMARC is only necessary for large enterprises, not realising that any domain can be targeted by email fraud.
The "Set It and Forget It" Mindset - Some companies implement DMARC at the none policy level for reporting purposes but never move to stricter enforcement (quarantine or reject).

How to Set Up DMARC for Your Domain

To implement DMARC, you need access to your domain’s DNS settings. Here’s how to do it step by step.

Step 1: Set Up SPF (Sender Policy Framework)

SPF helps verify that emails sent from your domain come from authorised mail servers.

1. Log into your DNS provider (e.g., Ostratto Hosting, GoDaddy, 123Reg.
2. Locate the DNS settings for your domain.
3. Add a TXT record with the following format:

v=spf1 include:mailprovider.com -all

Replace mailprovider.com with your email service provider (e.g., Google Workspace, Microsoft 365).
The "-all" means that emails not listed in SPF should be rejected.

4. Save the record and allow time for propagation.

Step 2: Set Up DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to emails, verifying their authenticity.

1. In your email provider’s admin panel, look for DKIM settings.

2. Enable DKIM and generate a public key.

3. Add a TXT record in your DNS settings using the provided values.

4. Save the record and enable DKIM signing.

Step 3: Configure DMARC

Once SPF and DKIM are in place, set up DMARC to define how unauthorised emails should be handled.

1. In your DNS settings, add a new TXT record for _dmarc.yourdomain.com.

2. Use the following format:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-failures@yourdomain.com; pct=100;

p=none: This starts DMARC in monitoring mode (change to quarantine or reject later).
rua: Email address to receive aggregate reports.
ruf: Email address to receive forensic reports.
pct=100: Applies the policy to 100% of emails.

3. Save the record and wait for propagation.

Step 4: Monitor Reports & Adjust Policy

1. Use DMARC report analysis tools like DMARC Analyzer, Agari, or Postmark to interpret reports.

2. If all legitimate email sources pass DMARC, update the policy:

p=quarantine or p=reject

3. Continue monitoring to ensure no critical emails are affected.

Final Thoughts

DMARC is a crucial tool for preventing email spoofing and phishing attacks, yet its adoption remains slow due to its perceived complexity and risk of email deliverability issues. However, with careful setup and monitoring, businesses can implement DMARC effectively without disrupting legitimate email flow.

If you're still unsure about setting up DMARC for your domain, or would like this to be taken care of - we're just a message away.

Ostratto - Blog | Ostratto #DNS