---
title: "BIMI: The Identity Proof Behind the Logo"
description: "BIMI is a DNS-published claim that ties a verified brand logo to an authenticated domain, so mailbox providers can display it. Here is what each part of that claim requires."
---

# BIMI: The Identity Proof Behind the Logo

**Type:** [What is it?](https://yomu.fyi/visual-explainers/category/what-is-it.md)

![A central panel labeled BIMI surrounded by four parts: authenticated domain with DMARC enforcement, verified brand identity, published DNS record, and inbox logo display, with a footnote strip comparing Apple Branded Mail and BIMI.](https://yomufyi.s3.us-east-1.amazonaws.com/visual-explainers/4ff7bc6c-81ab-44ff-8c57-739505f407da/image-a90644d5-ffd6-4006-8de5-b1fa7e9bc6e5.webp)

> BIMI is a DNS-published claim that ties a verified brand logo to an authenticated domain, so mailbox providers can display it. Here is what each part of that claim requires.

## Explanation

BIMI, or Brand Indicators for Message Identification, is a way for a domain to publish a verified brand logo so mailbox providers can show it next to the sender. It has four parts: an authenticated sending domain, a verified brand identity backed by a certificate and trademark, a published record that points to the logo, and a mailbox provider that checks the claim before rendering anything. Authentication comes first, which is why setup starts with a DMARC policy of p=quarantine or p=reject. Engineers should care because the logo is only the visible end of a chain of proof; if any earlier link is missing, the brand gets no indicator at all.

## FAQ

### Does BIMI work if my domain only has DMARC monitoring?

No. The setup path starts with a DMARC policy of p=quarantine or p=reject, because BIMI is a claim layered on top of an authenticated domain. A monitoring-only policy leaves the domain unenforced, so there is no trusted identity for the logo to attach to.

### When is Apple Branded Mail enough instead of BIMI?

Apple Branded Mail is free, shipped in iOS 18.2 in 2024, and is set up through Apple Business Connect with a logo of at least 1024 by 1024 pixels; verification can take up to seven business days. It covers Apple Mail only, so brands that need broader client coverage are directed toward BIMI and the certificates and trademarks it can require.

### Do I need a separate branding setup for every subdomain?

Not necessarily. In Apple's flow, root-domain branding covers unconfigured subdomains, so starting at the root is sensible and subdomains become exceptions rather than the default. Treat each domain you actually send from as a deliberate decision.

**Tags:** [BIMI](https://yomu.fyi/topic/bimi.md), [Deliverability](https://yomu.fyi/topic/deliverability.md), [Digital Identity](https://yomu.fyi/topic/digital-identity.md), [DMARC](https://yomu.fyi/topic/dmarc.md), [DNS](https://yomu.fyi/topic/dns.md), [Email](https://yomu.fyi/topic/email.md)

## Related reading

### [Enabling secure, productive work on personal devices](https://yomu.fyi/post/enabling-secure-productive-work-on-personal-devices.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Steven Angle, Brian Schaffner
- Published: Sep 18, 2026
- Type: Explainer

Personal devices let employees use Slack, approve requests, and access internal apps, but they combine corporate data with private content that Databricks cannot inspect or control. The proposed mobile security model layers Mobile Device Management (MDM), identity and context-aware authentication, Zero Trust Network Access (ZTNA), and application management. On iOS, Account-Driven User Enrollment creates an encrypted workspace without full device management, while Android Work Profile provides comparable separation; per-app VPN keeps work traffic apart from personal traffic. Access requires strong authentication, a managed device, and a trusted tunnel, with continuous posture checks able to block unhealthy devices. Managed apps, configurations, tenant controls, and sensitivity tiers contain data where supported, while transparency about privacy encourages enrollment and supports mobile apps such as Genie.


### [Classic Engine Feature EOL: SSR, Desktop SSO, Device Trust](https://yomu.fyi/post/classic-engine-feature-eol-ssr-desktop-sso-device-trust.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Vanshika Pandey
- Published: Sep 18, 2026
- Type: Announcement

Okta will end support for Self-Service Registration, Desktop Single Sign-On using Integrated Windows Authentication (IWA), and Device Trust on Classic Engine on March 5, 2027. After that deadline, the capabilities will be turned off unless organizations upgrade to Okta Identity Engine, and Okta will no longer address related bugs, security vulnerabilities, or broken flows. The migration paths are Profile Enrollment Policy for self-service registration, Agentless Desktop Single Sign-On or Okta FastPass for desktop authentication, and management attestation with Okta Verify for mobile device trust. Identity Engine adds passwordless authentication, device assurance, phishing-resistant multifactor authentication, identity verification, zero-trust capabilities, and a newer policy framework, with the upgrade included at no additional licensing cost. Organizations are advised to assess feature usage, test in non-production, and schedule production migration before the hard deadline.


### [Auth0 Agent Gateway: The Identity Control Plane for Customer-Facing AI](https://yomu.fyi/post/auth0-agent-gateway-the-identity-control-plane-for-customer-facing-ai.md)
- Company: [Auth0](https://yomu.fyi/company/auth0.md)
- Author: Andrés Aguiar
- Published: Sep 18, 2026
- Type: Announcement

Auth0 Agent Gateway is announced in beta as a Customer Identity and Access Management (CIAM) control plane for governing product-native, customer-facing AI agents in multi-tenant SaaS applications. It addresses a trust model involving organizations, delegated user access, customer consent, independently owned connected accounts, and cross-tenant data boundaries, rather than workforce-only identity. Positioned between an agent and its tools, the gateway evaluates each call using agent, user, and organization context; it uses Organizations, Agents as Principals, Token Vault, token exchange, tenant logs, and administrative controls. The described capabilities include short-lived agent-only tokens, user-scoped credentials, runtime tool authorization, audit logging with optional SIEM streaming, and an agent kill switch. Auth0 is seeking product and engineering teams to join the beta.


### [How to Show Your Logo in Apple Mail](https://yomu.fyi/post/how-to-show-your-logo-in-apple-mail.md)
- Company: [Resend](https://yomu.fyi/company/resend.md)
- Published: Aug 6, 2026
- Type: Tutorial

Displaying a company logo in Apple Mail can improve inbox recognition, trust, and visual distinctiveness, while cited studies associate logos with higher brand recall, open rates, purchase likelihood, and email confidence. The article presents Apple Branded Mail, a proprietary format shipped in iOS 18.2 in 2024, as a free alternative to inconsistent provider settings and the paid certificates and trademarks sometimes needed for broad BIMI coverage. Setup begins with a DMARC policy of p=quarantine or p=reject, then uses Apple Business Connect to add a brand, upload a PNG, HEIF, or JPEG logo at least 1024 × 1024 pixels, select domains, and verify identity. Verification can take up to seven business days; root-domain branding covers unconfigured subdomains, while brands needing broader client coverage are directed to BIMI.