Summary
Setting up DMARC (Domain-based Message Authentication, Reporting, and Conformance) as a prerequisite for BIMI (Brand Indicators for Message Identification) is a critical step in modern email deliverability and brand presence. BIMI allows your brand's logo to appear next to your emails in supporting inboxes, but it relies heavily on a robust DMARC implementation. This process isn't trivial and requires careful planning and execution, typically involving a phased approach to ensure all legitimate email streams are properly authenticated.
Key findings
- DMARC foundation: BIMI mandates that your domain has an active DMARC record with an enforcing policy, meaning p=quarantine or p=reject. A p=none policy, while useful for monitoring, is insufficient for BIMI.
- Authentication alignment: For DMARC to pass, both SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) must be configured correctly and aligned with your domain. This means the domain in the From header must match the domains used in SPF and DKIM.
- Monitoring is key: Implementing DMARC successfully involves starting with a p=none policy and meticulously analyzing DMARC reports. These reports reveal which of your email streams are passing or failing authentication, allowing you to identify and fix issues before moving to an enforcing policy.
- Phased implementation: Transitioning to p=quarantine or p=reject should be done incrementally (e.g., gradually increasing the percentage for enforcement) to avoid legitimate emails being blocked or marked as spam.
- BIMI specific requirements: Beyond DMARC, BIMI requires your brand logo to be in SVG Tiny 1.2 format and, for most prominent placements, a Verified Mark Certificate (VMC) issued by an accredited authority. More details can be found on the BIMI Group website.
Key considerations
- Mailstream inventory: Identify all sources sending email on behalf of your domain. This includes marketing platforms, transactional email services, internal corporate email systems, HR software, and any third-party cloud services.
- Time investment: The full DMARC implementation and enforcement process can take several months, as it involves monitoring reports and making adjustments to ensure all legitimate email is authenticated.
- Subdomain policies: Ensure that both your primary organizational domain and any relevant subdomains have DMARC policies in place, particularly if you use subdomains for different email types (e.g., marketing, transactional).
- Collaboration: DMARC and BIMI setup often requires collaboration between marketing, IT, and legal teams (for VMC). Clear communication is vital.
- Logo preparation: Beyond technical specifications, ensure your logo is officially copyrighted and represents your brand accurately, as it will be publicly displayed.
What email marketers say
Email marketers often approach DMARC and BIMI with a focus on tangible benefits like brand visibility and increased trust, while also expressing concerns about the technical complexities involved. Their experiences highlight the practical challenges of implementation, such as managing multiple sending platforms and understanding technical reports, but also emphasize the perceived value once these systems are in place.
Key opinions
- Brand visibility boost: Marketers are primarily interested in BIMI for the enhanced brand recognition it offers, displaying their logo directly in the inbox, which they believe improves engagement and trust.
- Technical hurdle: Many marketers find the initial DMARC setup, especially understanding alignment and report analysis, to be a significant technical challenge requiring IT or expert assistance.
- Deliverability improvement: There's a strong belief that implementing DMARC (and by extension, BIMI) positively impacts overall email deliverability by signaling trustworthiness to mailbox providers.
- Value of enforcement: Marketers understand that a p=quarantine or p=reject policy is necessary for BIMI, despite the potential initial fear of blocking legitimate emails.
Key considerations
- Understanding DMARC reports: Marketers often need clearer explanations of DMARC aggregate reports to understand what email streams are failing and why.
- SVG logo creation: The specific technical requirements for the BIMI SVG logo (e.g., SVG Tiny 1.2, square dimensions) can be challenging.
- VMC acquisition: The process of obtaining a Verified Mark Certificate (VMC) is often seen as complex and involves legal and financial commitments, as highlighted in guides like The SSL Store's BIMI setup guide.
- Client support: Marketers question which email clients support BIMI to justify the investment in its setup.
Marketer view
Email marketer from Email Geeks suggests starting with SPF and DKIM. It is crucial to ensure both authentication methods are properly configured and aligned with the From address your brand uses for sending emails. This foundational step is non-negotiable before moving to DMARC.
Marketer view
Marketer from Mailgun notes that BIMI setup involves confirming email authentication alignment. This means verifying that SPF and DKIM are correctly set up and align with the domain in your emails' From header.
What the experts say
Email deliverability experts highlight that DMARC is not merely a technical checkbox for BIMI, but a fundamental security measure that validates email authenticity. They emphasize a disciplined, multi-stage deployment process for DMARC, particularly moving from a monitoring policy (p=none) to enforcement (p=quarantine or p=reject), which is essential for BIMI eligibility.
Key opinions
- Phased DMARC deployment: Experts universally recommend starting DMARC with a p=none policy to collect reports and understand email flows before moving to enforcement.
- Importance of alignment: Achieving DMARC compliance hinges on proper SPF and DKIM alignment, ensuring that the visible From domain matches the authenticated domains in SPF or DKIM.
- DMARC reports are crucial: DMARC aggregate reports (RUAs) provide invaluable insights into email authentication results across all sending sources for a domain, which is essential for identifying unauthenticated mailstreams.
- Org domain enforcement: For BIMI, the organizational domain (not just subdomains) typically needs to be at DMARC enforcement (either p=quarantine or p=reject) to be eligible.
Key considerations
- Comprehensive mailstream identification: Ensure all mailstreams, including less obvious ones like HR, payroll, or internal system notifications, are properly authenticated. Missing any can lead to deliverability issues once DMARC is enforced.
- Gradual policy escalation: The transition from p=none to p=quarantine and then p=reject should be a measured process, often taking several months, to allow for adjustments and mitigate risks.
- Understanding DMARC reports: Leverage DMARC aggregate reports effectively. Tools that simplify these XML reports are highly recommended to accurately assess authentication status and identify spoofing attempts.
- Leveraging external resources: Refer to authoritative sources like DMARC.org for detailed explanations and best practices regarding DMARC implementation and its prerequisites for BIMI.
- Potential for issues: Be prepared for issues such as DKIM signature failures or SPF mismatches, which require careful troubleshooting and adjustments to mail generation processes.
Expert view
Expert from Email Geeks explains that you should deploy SPF and DKIM. It is crucial to ensure both authentication methods are correctly configured and aligned with the From address your brand uses for sending emails. This foundational step is non-negotiable before moving to DMARC.
Expert view
Expert from Spamresource.com states that proper DMARC implementation is foundational. He highlights that without a correctly configured DMARC record, ideally at an enforcing policy like p=quarantine or p=reject, BIMI cannot be leveraged for brand logo display in inboxes. This emphasizes the sequential nature of these protocols.
What the documentation says
Official documentation from various standards bodies and industry groups provides the definitive guidelines for DMARC and BIMI implementation. These sources emphasize the strict technical requirements, the importance of adherence to specifications, and the phased approach necessary for successful deployment, ensuring security and brand integrity.
Key findings
- DMARC is a prerequisite: BIMI leverages the existing DMARC protocol, requiring that email messages pass DMARC authentication checks before displaying brand-controlled logos.
- Enforcing DMARC policy: To be eligible for BIMI, the DMARC policy for the sending domain (or organizational domain) must be set to p=quarantine or p=reject, ideally at 100% enforcement.
- Authentication alignment: DMARC requires either SPF or DKIM to align with the From domain. This is a fundamental concept for DMARC to authenticate messages effectively.
- SVG format specifics: BIMI explicitly requires logos to be in SVG Tiny 1.2 format, hosted on a secure (HTTPS) server, and often with specific dimensions and formatting guidelines for optimal display.
- Verified Mark Certificate (VMC): For many participating email clients, a VMC, issued by a trusted Certificate Authority (CA), is required to prove ownership of the logo and associated brand, adding an extra layer of trust.
Key considerations
- DMARC record structure: Properly structuring the DMARC TXT record in DNS, including tags like p (policy), rua (aggregate reports), and ruf (forensic reports), is critical for effective monitoring and enforcement. You can learn more about DMARC tags here.
- Gradual policy rollout: Documentation often advises a phased approach (starting with p=none, then p=quarantine, then p=reject) to ensure legitimate mail is not impacted. This is a common recommendation across various guides, including those discussing BIMI implementation requirements.
- Subdomain handling: The DMARC policy for the organizational domain generally needs to be at enforcement for BIMI to function, even if a subdomain is used for sending. This is a key detail for proper setup.
- Official source: The BIMI Group FAQs for Senders & ESPs serves as a primary source for understanding BIMI requirements and how it interacts with DMARC.
Technical article
BIMI Group documentation specifies that BIMI relies on existing email authentication protocols. It requires that email messages pass DMARC authentication checks before any brand-controlled logos are displayed. This integration ensures that only authenticated and legitimate senders can leverage BIMI.
Technical article
Scaleway Documentation clarifies DMARC policy requirements for BIMI. To pass the necessary authentication checks, DMARC should be set either to QUARANTINE with 100% filtering, or to REJECT with no filtering restrictions. This strict policy ensures that only authorized mail is considered valid for BIMI display.
Related resources
7 resources
Related pages
How to implement DMARC p=reject policy safely to avoid email deliverability issues?
How does DMARC work, why implement it with SPF and DKIM, and what tools are available for DMARC record creation?
Is BIMI available for email clients and what are its implementation requirements?
What are the requirements and implementation steps for BIMI?
What are common questions and answers about BIMI email authentication?
A simple guide to DMARC, SPF, and DKIM
How to safely transition your DMARC policy to quarantine or reject
Which email clients actually support BIMI?
Understanding the business value and ROI of implementing BIMI
List of DMARC tags and their meanings
