So, in the ongoing battle to make email trustworthy again (you can catch-up here), a new player has "broken cover"***. Please meet BIMI (Brand Indicators for Message Identification). Beep-beep. The BIMI project is being managed by an industry working group, with members Fastmail, Google, MailChimp, Proofpoint, SendGrid, Validity, ValiMail and Yahoo! The project began TEN YEARS ago, in 2014, and so far, the display of BIMI logo icons is supported by Apple, Cloudmark, Fastmail, Google, Yahoo! And Zoho. So, what's a BIMI, you might cleverly ask?
Many/most/almost all email clients display a icon/avatar beside the email in the listings.
Systems like Gravatar might provide that icon, or it might just be initials in a coloured circle. Idea! Let's make that icon a trust-anchor, like a verified checkmark for email, but way (comically WAY) more stringent. Imagine if Twitter's blue checkmark process involved a full corporate audit, legal reviews, Home Affairs, FICA, RICA and trademark verification... that's BIMI.
Here's what it takes:
First, you need perfect email security (SPF, DKIM, DMARC) with the strictest settings.
Then you need your logo in a arcane SVG format that's so specific and locked-down that most companies need specialized help to create it.
Then you need a "Verified Mark Certificate" (VMC) which is like a super-charged version of a website security certificate.
And, right now, the only two CA's who can issue these VMCs (atm) are.. Digicert and Entrust**
The certification process is thorough. Requirements are:
Corporate documentation proving you are who you say you are. Brabys, Dun & Bradstreet, people calling your company phone number. NSA Mega Extended Validation certificate process stuff.
Legal proof you own the trademark for the logo.
Verification that you have the rights to use the logo in every country you operate in.
The logo itself has to meet strict design guidelines.
The end result? A tiny little logo shows up next to your emails in supporting email clients (mainly Gmail right now). It's probably the most complex and expensive way ever invented to display a 32x32 pixel image - but it does mean that if you see a BIMI logo, you can be REALLY sure it's legitimate!
The irony is that most email users have no idea what BIMI is or why that little logo means so much more than just a standard email logo.
*** Used ironically, to mock the Car Journo mob
** Yes, *that* Entrust, who Chrome and now Firefox have just labelled "untrusted" and are no longer trusting certs from. I guess it's just inertia. This project has been JARRE in the making and is moving pretty slowly. Hilariously, Google are part of the BIMI working group.