The little brand logos next to emails in Gmail and Apple Mail look like a cosmetic feature. They're not. BIMI — Brand Indicators for Message Identification — is a deliberately constructed incentive scheme: the logo is the carrot, and strict DMARC enforcement is the price of admission. Understanding how it works tells you a lot about how email authentication actually gets adopted.
Email authentication has a chronic adoption problem. SPF, DKIM, and DMARC have existed for well over a decade, and the cryptography works — but a DMARC policy of p=none (monitor, don't enforce) is where many domains stall, because moving to enforcement risks breaking legitimate mail flows. Nobody gets promoted for tightening a DMARC policy. That's the gap BIMI was designed to close: it offers something marketing departments measurably want — a verified logo in the inbox — and hands it over only when the security team finishes the DMARC work.
How BIMI Works: One DNS Record, Three Prerequisites
Mechanically, BIMI is simple. You publish a DNS TXT record at a well-known location under your domain:
default._bimi.example.com TXT
