#bimi — Public Fediverse posts

BIMI: your logo in the inbox, verified

DMARCguard BIMI checker validates your BIMI record, SVG format, and VMC certificate chain

getting your brand logo to appear next to your emails in Gmail and Apple Mail requires correct DMARC enforcement plus a verified mark certificate

the checker tells you where you stand

but BIMI records reference certificates that expire, and when they do, your logo disappears

https://dmarcguard.io/tools/bimi-checker/

#DMARC #EmailSecurity #BIMI #BrandProtection

BIMI checker: verify your brand logo in inboxes

BIMI (Brand Indicators for Message Identification) lets you display your brand logo next to authenticated emails in supported clients

DMARCguard BIMI checker validates your entire chain: DNS record syntax, SVG accessibility, logo format compliance, DMARC policy prerequisite, and VMC certificate if present

https://dmarcguard.io/tools/bimi-checker/

#DMARC #EmailSecurity #BIMI #BrandSecurity #EmailMarketing

BIMI is a specification to allow you to tell email clients to show your brand logo in the inbox. Well, kinda…

Today I had to set up BIMI for someone. I wrote down the process:

https://blog.thms.uk/2026/03/setting-up-bimi?utm_source=mastodon

#bimi #email

Would you pay 1100-1500 USD to show a logo of your brand when users of some e-mail services receive your mail? :blobcatthinkowo:

Brand Indicators for Message Identification (BIMI) are a combination of DNS records, SVG image and a certificate to sign your domain name and then show a logo of your choice (must be a trade mark or at least 12 months publicly used logo) to users of Gmail, Proton Mail and some others.

I think it's insanely overpriced and doesn't give too much of a benefit. But more companies tend to adopt BIMI, so they don't seem to mind this amount of money :blobcatroll:

#bimi #email #sysadmin #certificates

https://www.wacoca.com/media/468616/ “Bimi Live Galley #08 -2nd Anniv. side TOKYO-“開催記念し、Skream!／激ロック有する激ロックエンタテインメントが運営するMusic Bar ROCKAHOLIC-Shinjuku-にてコラボ企画第4弾10/17-19実施決定 #Bimi #music #ROCKAHOLIC #ロカホリ下北 #音楽

https://www.wacoca.com/media/367008/ Bimiコラボ・カクテル購入者特典詳細発表！”Bimi Release Party Tour 2025 -Ｒ- Tour Final”記念し、Skream!／激ロック有する激ロックエンタテインメントが運営するMusic Bar ROCKAHOLIC-Shinjuku-にてコラボ企画第3弾6/27-7/6実施決定！ #Bimi #music #ROCKAHOLIC #ロカホリ #ロカホリック #音楽

https://www.wacoca.com/media/364301/ “Bimi Release Party Tour 2025 -Ｒ- Tour Final”記念し、激ロック／Skream!有する激ロックエンタテインメントが運営するMusic Bar ROCKAHOLIC-Shinjuku-にてコラボ企画第3弾6/28-7/6実施決定！ #Bimi #music #ROCKAHOLIC #ロカホリ #ロカホリック #音楽

I added BIMI to my personal email domain after seeing @fastmail’s latest update, but then learned Gmail won’t show my image to its users unless I pay $1,000 to a company to verify my identity. That is dumb.

https://bimigroup.org/?ref=activitypub

#email #BIMI

I don't understand:
are you suggesting that #BIMI can help eliminate #SPAM or, that i am spamming in asking about the 3rd party verification?

[ the thing from other day @OutOnTheMoors i haven't gotten around to my proper query composition yet ]

Is U Doin' Bui'ness?

According to #Google
Set up #BIMI

You can use the #BrandIndicatorsForMessageIdentification (BIMI) #standard to add your organization’s logo to #outgoingemail messages sent from your organization. #Emailclient that support BIMI display the #logo along with your organization’s messages in the recipient's #mailbox. #Logos used with BIMI are #verified by a #thirdparty so #recipients can be sure logos in their inbox are #legitimate.
BIMI requires third-party certification for your domain and logo. The third-party #certification must be a #VerifiedMarkCertificate (#VMC) or a #CommonMarkCertificate (#CMC)."

https://support.google.com/a/answer/10911320

Okay. So, who is the "Verified Third Party"?
@zombiewarrior

#verification #identity #gmail

@cabel I know/you know #BIMI is pitched to senders as "show your brand," but it's also an incrementally helpful approach to verifying sender identity/reducing phishing. But it sucks in terms of implementation. I think Apple's implementation here makes it more pragmatic.

Is there #opensource #company that use #bimi ??

How use #bimi ?

> What is BIMI?
>Brand Indicators for Message Identification or BIMI is an emerging email specification that enables the use of brand-controlled logos within supporting email clients.

https://bimigroup.org/

#BIMI is een indicator voor berichten die positief valideren voor #DMARC. De toepassing is echter duur en lijkt vooral gemaakt voor marketeers, brand managers en grote ondernemingen die "graag betalen" voor een hogere deliverability van hun berichten en een grotere zichtbaarheid van hun merk.

Self-asserted BIMI is wel makkelijk op te zetten, maar wordt op dit moment aan validerende zijde niet ondersteund door Gmail en Apple Mail.

#InternetSecurity #infosec

just configured BIMI for my domain names.
Self-asserted BIMI is just a matter of creating a logo and adding a BIMI record to your zone (assuming that you already have a fully functional SPF/DKIM/DMARC configuration).
Note that Gmail and Apple Mail in addition require an (expensive) Verified Mark Certificate (VMC), i.e. certified BIMI, before they will display your logo in their mail clients.

#BIMI #Gmail #AppleMail #SPF #DKIM #DMARC #InternetSecurity

🍿🍿🍿 #bimi
https://groups.google.com/a/ccadb.org/g/public/c/29CRLOPM6OM/m/UG3d2gJ1AAAJ

I was looking into #BIMI again i.e. a TXT record in #DNS that points to two things that might allow a fancy logo to magically appear in webmail inboxes

1) The location of your preferred inbox image

2) the location of your $$$$ cert that says to the world 'yes that is my logo' and I paid for it

Still, years later... I'm not sure I can justify $129 minimum per month to say I have a cert. So, I left off "a=" but I'm not sure if that breaks anything else.🤷‍♂️

( see also: https://bimigroup.org/bimi-generator/ )

🆕 blog! “Getting lots of BIMI images using Python”

I've written before about the moribund BIMI specification. It's a way for brands to include a trusted logo when they send emails. It isn't much used and, apparently, is riddled with security issues. I thought it might be fun to grab all the BIMI images from the most popular websites, so I can potentially use […]

👀 Read more: https://shkspr.mobi/blog/2024/06/getting-lots-of-bimi-images-using-python/
⸻
#BIMI #dns #svg

Getting lots of BIMI images using Python

https://shkspr.mobi/blog/2024/06/getting-lots-of-bimi-images-using-python/

I've written before about the moribund BIMI specification. It's a way for brands to include a trusted logo when they send emails. It isn't much used and, apparently, is riddled with security issues.

I thought it might be fun to grab all the BIMI images from the most popular websites, so I can potentially use them in my SuperTinyIcons project.

BIMI images are SVGs. Links to a site's BIMI are stored in a domain's DNS records. All BIMI records must be on a default._bimi. subdomain.

If you run dig TXT default._bimi.linkedin.com you'll receive back:

;; ANSWER SECTION:default._bimi.linkedin.com. 3600 IN TXT "v=BIMI1; l=https://media.licdn.com/media/AAYQAQQhAAgAAQAAAAAAABrLiVuNIZ3fRKGlFSn4hGZubg.svg; a=https://media.licdn.com/media/AAYAAQQhAAgAAQAAAAAAALe_JUaW1k4JTw6eZ_Gtj2raUw.pem;"

Awesome! We can grab the .svg URl and download the file.

Getting a list of BIMI enabled domains is difficult. Thankfully, Freddie Leeman has done some excellent analysis work and was happy to share a list of over 7,000 domains which have BIMI.

Let's get cracking with a little Python. First up, install DNSPython if you don't already have it.

This gets the TXT record from the domain name:

import socketimport dns.resolverresponse = dns.resolver.query('default._bimi.linkedin.com', 'TXT')result = response.rrset.to_text()print(result)

There are various ways of extracting the URl. I decided to be lazy and use a regex. Sue me.

import repattern = r'l=(https[^;"]*[;"])'match = re.search(pattern, result)if match:   # Remove the trailing semicolon or quote mark   url = match.group(1).rstrip(';\"')   print(f'Matched URL: {url}')else:   print(f'No match: {result}')

Putting it all together, this reads in the list of domains, finds the BIMI TXT record, grabs the URl, and saves the SVG.

import socketimport dns.resolverimport reimport requestsheaders = {  'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0'}pattern = r'l=(https[^;"]*[;"])'domain_file = open('domains.txt', 'r')domains = domain_file.readlines()domains.sort()for domain in domains:   bimi_domain = "default._bimi." + domain.strip()   try:      response = dns.resolver.query(bimi_domain, 'TXT')      result = response.rrset.to_text()      match = re.search(pattern, result)      if match:         # Remove the trailing semicolon or quote mark         svg_url = match.group(1).rstrip(';\"')         print(f'Downloading: {svg_url}')         try:            svg = requests.get(svg_url, allow_redirects=True, timeout=30, headers=headers)            open(domain.strip() +'.svg', 'wb').write(svg.content)         except:            print(f'Error with {domain}: {result}')      else:         print(f'No match from {domain}: {result}')   except:      print(f'DNS error with {bimi_domain}')

Obviously, it could be made a lot more efficient and download the files in parallel.

I found a few bugs in various BIMI implementations, including:

• ted.com and homeadvisor.com uses a http URl
• consumerreports.org and sleepfoundation.org has a misplaced space in their TXT record
• audubon.org had an invalid certificate
• mac.com was blank - as was discogs.com, livechatinc.com, icloud.com, me.com, lung.org, miro.com, protonmail.ch and many others.
• alabama.gov had a timeout - as did nebraska.gov, uclahealth.org and several others.
• politico.com had a 404 for their BIMI - as do lots of others.
• coopersurgical.com is 8MB!
• There are loads of SVGs which bust the 32KB maximum size requirement - some by multiple megabytes.

I might spend some time over the next few weeks optimising the code and looking for any other snafus. I didn't find any with ECMAScript in them. Yet!

#BIMI #dns #svg