Webinar recap: Building up to BIMI with Mailgun and Red Sift

Everyone wants their logo to appear next to their emails in Gmail, but few companies are willing to do what it takes to earn it. Together, Red Sift and Mailgun walked through the whole path to BIMI, from the basics of authentication to the BIMI application.

Missed the webinar? We're going to catch you up here, or you can always watch the playback.

BIMI is the prize for getting DMARC to enforcement. And most companies aren't there yet. Only about 7% of organizations have DMARC fully locked down at quarantine or reject. That leaves roughly 93% of domains open to anyone who wants to send email pretending to be them.

But before we talked logos, we covered the foundations.

Jonathan Torres, Technical Account Manager at Mailgun, has a very easy way to remember how SPF works: it's like having your name in a guest list or phone book. More specifically, the SPF record is a single TXT record in your domain's DNS that lists every server and service authorized to send email on your behalf.

When a message arrives, the receiving server looks up the domain's SPF record in the return path and checks whether the sending IP address is on the list. That said, an attacker can pass SPF on a domain they own while putting your brand in the “From” line. It's in this way that SPF isn't enough protection, which is why other authentication methods came after it.

DKIM works like a lock-and-key system. You publish a public key in the DNS, and every message you send gets signed with that key. When a message arrives, the receiving server reads the selector and domain from the header, fetches the public key, and checks the signature against the message. The signature covers the body and key headers like “From” and “Subject”. If anyone changes the message in transit, DKIM will fail.

It's important to note that the signing domain matters as much as the signature. Some providers sign with their own domain by default, so your mail passes DKIM under someone else's name. DMARC needs the d=domain to match the domain in your “From” address, which means setting up DKIM with your own domain at every service that sends for you.

If you're worried about your DKIM key breaking, there are two very easy ways to protect yourself. The first is to use 2048-bit keys instead of 1024-bit keys for a much harder-to-crack key, and the second is to rotate them regularly. Many providers handle rotation automatically through CNAME-based setups. But if, for whatever reason, yours does not, remember to schedule manual rotation as part of your email security workflow.

Iris Cox, Customer Success Engineer at Red Sift, put it in event terms. SPF is the guest list, DKIM is the conference badge, and DMARC is the bouncer at the door deciding who gets let in. DMARC checks if the message passes SPF or DKIM using a domain that matches the “From” address recipients see. That matching is called alignment, and it closes the spoofing gap SPF and DKIM leave open on their own.

The p= tag sets your DMARC policy for mail that fails. With p=none, nothing happens to messages that are out of alignment; all you get is reporting. With p=quarantine, failing mail goes to spam. And lastly, with p=reject, messages that do not match will bounce. The pct= tag sets what share of failing mail the policy applies to, and BIMI requires it at 100.

The days of spinning up a mail server and hitting send are long gone. Authentication is the new normal, and plenty of ESPs and mailbox providers require it before you can send at all.

It all comes back to trust. Mailbox providers want to know the mail claiming to come from your domain actually does. Recipients want to know the same thing. When senders authenticate properly, inbox providers reward them with better treatment. Google, Yahoo, and Microsoft now require authentication for bulk senders. Mailgun broke down what the Gmail and Yahoo requirements mean for your program, and spoke with Yahoo directly about these requirements to get an understanding from mailbox providers themselves, and it was clear that reporting wasn't enough to protect their customers.

And if you're thinking “we're not a bulk sender, so this doesn't apply to us,” think again. Receipts, password resets, and other transactional mail add up fast, and it's easy to surpass the email volume minimum without even realizing it. Plenty of companies are bulk senders and just don't know it yet.

Once your domain reaches quarantine or reject at 100%, you can finally apply for a BIMI certificate. Mailgun calls it your reward for solid authentication, and that's exactly right. It's a DNS record plus an SVG version of your logo, backed by a certificate that proves you are who you say you are.

There are two certificate types. A VMC (Verified Mark Certificate) requires a registered trademark. A CMC (Common Mark Certificate) requires that you've been using your logo publicly for at least 12 months, verified by a certificate authority. Either way, in Gmail you get your logo plus a blue checkmark next to your sender name. For the fine print on each, read Red Sift's breakdown of VMC and CMC requirements.

Getting to BIMI the do-it-yourself way is frustrating. Formatting the SVG correctly, checking the record, and wrangling the certificate application all trip people up. So we built BIMI Maker, a free tool that helps make the entire process as painless as possible.

You can preview your logo in light and dark modes, in circles and rounded squares, and adjust the size down to the pixel. BIMI Maker then generates a compliant SVG. From there, you pick your certificate type (CMC today, with VMC support on the way), verify your email address, and get a full readiness analysis of your record and logo. You can download a PDF of your evidence, email yourself the results, and start the application right there.

A CMC runs around $1,000 per year for the first domain. Additional domains with the same logo are available at a discounted rate of around $450 each.

Start by collecting DMARC reports for a few weeks and identifying every service sending on your behalf. Sort them into what you pay for, what you allow, and what should never be sending mail. Remove stale SPF entries, authenticate the legitimate senders, and shut down the rest. Then, move to quarantine first and reject second. Jumping straight from none to reject is a recipe for surprise bounces, unless it's a parked domain.

That said, coordination matters as much as configuration. Teams regularly discover that recruiting or another department has been sending from the main domain without anyone in IT knowing. Announce the change broadly, work from your primary domain down to subdomains, and expect bigger organizations to have more surprises.

Both directly and indirectly. Mailbox providers focus mostly on DMARC. BIMI's bigger effect comes from recipients. When people recognize your brand in the inbox, they open and engage more, and that engagement drives a stronger reputation and better inbox placement. More organizations are tightening inbound policies to accept mail only from domains with DMARC enforcement, and some may start requiring BIMI. You don't control their inbound. You do control your outbound.

In Red Sift's research comparing emails with and without a visible logo, we saw up to a 44% increase in brand recall, a 39% increase in open rates, and a 32% increase in purchase intent.

• Try BIMI Maker free and see how close your domain is to BIMI-ready.
• Start a free OnDMARC account with Red Sift to see who's sending on your behalf.
• Need help on the sending side? Mailgun offers free accounts plus deliverability services backed by JT's technical account management team.