BIMI is a DNS-published claim that ties a verified brand logo to an authenticated domain, so mailbox providers can display it. Here is what each part of that claim requires.
BIMI, or Brand Indicators for Message Identification, is a way for a domain to publish a verified brand logo so mailbox providers can show it next to the sender. It has four parts: an authenticated sending domain, a verified brand identity backed by a certificate and trademark, a published record that points to the logo, and a mailbox provider that checks the claim before rendering anything. Authentication comes first, which is why setup starts with a DMARC policy of p=quarantine or p=reject. Engineers should care because the logo is only the visible end of a chain of proof; if any earlier link is missing, the brand gets no indicator at all.
No. The setup path starts with a DMARC policy of p=quarantine or p=reject, because BIMI is a claim layered on top of an authenticated domain. A monitoring-only policy leaves the domain unenforced, so there is no trusted identity for the logo to attach to.
Apple Branded Mail is free, shipped in iOS 18.2 in 2024, and is set up through Apple Business Connect with a logo of at least 1024 by 1024 pixels; verification can take up to seven business days. It covers Apple Mail only, so brands that need broader client coverage are directed toward BIMI and the certificates and trademarks it can require.
Not necessarily. In Apple's flow, root-domain branding covers unconfigured subdomains, so starting at the root is sensible and subdomains become exceptions rather than the default. Treat each domain you actually send from as a deliberate decision.
The posts behind it
Databricks · · ExplainerPersonal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.
Okta · · AnnouncementOkta will end support for Self-Service Registration, Desktop Single Sign-On using Integrated Windows Authentication (IWA), and Device Trust on Classic Engine on March 5, 2027. After that deadline, the capabilities will be turned off unless organizations upgrade to Okta Identity Engine, and Okta will no longer address related bugs, security vulnerabilities, or broken flows. The migration paths are Profile Enrollment Policy for self-service registration, Agentless Desktop Single Sign-On or Okta FastPass for desktop authentication, and management attestation with Okta Verify for mobile device trust. Identity Engine adds passwordless authentication, device assurance, phishing-resistant multifactor authentication, identity verification, zero-trust capabilities, and a newer policy framework, with the upgrade included at no additional licensing cost. Organizations are advised to assess feature usage, test in non-production, and schedule production migration before the hard deadline.
Auth0 · · AnnouncementAuth0 Agent Gateway is announced in beta as a Customer Identity and Access Management (CIAM) control plane for governing product-native, customer-facing AI agents in multi-tenant SaaS applications. It addresses a trust model involving organizations, delegated user access, customer consent, independently owned connected accounts, and cross-tenant data boundaries, rather than workforce-only identity. Positioned between an agent and its tools, the gateway evaluates each call using agent, user, and organization context; it uses Organizations, Agents as Principals, Token Vault, token exchange, tenant logs, and administrative controls. The described capabilities include short-lived agent-only tokens, user-scoped credentials, runtime tool authorization, audit logging with optional SIEM streaming, and an agent kill switch. Auth0 is seeking product and engineering teams to join the beta.
Resend · · TutorialDisplaying a company logo in Apple Mail can improve inbox recognition, trust, and visual distinctiveness, while cited studies associate logos with higher brand recall, open rates, purchase likelihood, and email confidence. The article presents Apple Branded Mail, a proprietary format shipped in iOS 18.2 in 2024, as a free alternative to inconsistent provider settings and the paid certificates and trademarks sometimes needed for broad BIMI coverage. Setup begins with a DMARC policy of p=quarantine or p=reject, then uses Apple Business Connect to add a brand, upload a PNG, HEIF, or JPEG logo at least 1024 × 1024 pixels, select domains, and verify identity. Verification can take up to seven business days; root-domain branding covers unconfigured subdomains, while brands needing broader client coverage are directed to BIMI.
More like this
A car rental is a search layer over many fleets plus a contract enforced at the counter. This explainer maps its four parts and why the advertised daily rate never equals the total cost.
An app store is a distribution surface, a versioned contract, and a health loop between a platform and its developers. Here is how those parts fit together and why each one fails loudly if ignored.
A GPU-resident astronomy pipeline keeps every stage of image analysis — load, align, subtract, detect, review — inside GPU memory instead of round-tripping through the CPU.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
