Email is a vital tool for the lifeblood of business communication all around the world. It’s so critical to the everyday running of organizations big and small, that many would agree it’s just as essential a service as electricity or water.

But its importance is exactly what makes email vulnerable from a cybersecurity perspective. With 3.4 billion phishing emails sent every day, it's evident that email systems are the prime target for cybercriminals seeking access to your business. All it takes is a single employee  to fall victim to a socially engineered scam, click on an infected link, or download a malicious attachment, and your entire operation could grind to a halt.

Given how important it is for organizations to secure their email, we’ve developed this comprehensive guide to help both beginners and buyers with their email security related queries. In the following chapters, you’ll find in-depth information on:

The email landscape and the types of threats that exist 

The different types of email security protocols or how they protect organizations from attacks, such as SPF, DKIM, MTA-STS, and DMARC

What to look for in an email security provider

If you're an email security architect or an analyst looking for a more technical guide, visit our Technical Email Configuration Guide. This comprehensive handbook explores SPF, DKIM, DMARC, MTA-STS, and more, offering insights and practical tips for enhancing your email security posture. 

Red Sift's guide helps beginners and buyers with information on the email landscape, threat types, and how to stay protected.

Introduction to Red Sift's Email Security Guide

Introduction

The problem with email: It isn’t as secure as you thought 

Email security technologies come in many forms. But ultimately, all have a common set of goals: keeping the volume of spam emails down, detecting threats, and stopping them from reaching your inbox.  

More often than not, these technologies work by looking for the most common traits of a malicious email - like a blacklisted IP address or a suspicious domain - and then blocking it from reaching your inbox.  Exact domain impersonation is when an attacker uses your domain to send a fraudulent email.

All email security measures (apart from DMARC - more on that later!) are ineffective at spotting a malicious email when it appears to come from a legitimate domain.  

This is because of a flaw in Simple Mail Transfer Protocol (SMTP) - the internet standard for transmission of electronic messaging. In October 2008, the Network Working Group officially labeled it ‘inherently insecure’. They said that anyone could impersonate a domain and use it to send fraudulent emails pretending to be the domain owner. 

Anyone with a very basic knowledge of coding can learn the steps required to impersonate someone’s email identity. All it takes is a quick Google search. The result is an email that looks legitimate and doesn’t have the typical indicators of a phishing attack, such as a suspicious email address. A recipient email server will then allow this email into an individual’s inbox (if the right security measures are not in place). It’s then hard for them to see that the email is, in fact, a phishing attack using a spoofed domain. 

A spoofed domain is a deceptive website or email address created to resemble a legitimate domain. There are various types of spoofing techniques, such as:

Exact domain impersonation - when an attacker spoofs your exact domain only. For example, yourcompany.com

Lookalike domain - when an attacker registers a domain that is so similar to the original domain, it makes it difficult to spot. This is also referred to as typosquatting. For example,  yourc0mpany.com

Subdomain spoofing - when an attacker creates a legitimate-looking subdomain page where they might set up a malicious form that harvests credentials. For example, login.yourcompany.com 

Email phishing is when an attacker or ‘bad actor’ sends fraudulent emails pretending to be from a reputable organization, with the purpose of getting the recipient to reveal sensitive information like bank details or personal data. Sometimes, phishing emails are sent with the intention of deploying malicious software to the victim’s infrastructure. 

According to APWG’s Q4 2023 Phishing Activity Trends Report, 2023 was a record year for phishing attacks. In total, there were almost five million phishing attacks in 2023, the worst year for phishing on record and eclipsing the 4.7 million attacks seen in 2022.

A traditional phishing attack usually involves one fraudulent email being sent to multiple recipients. However, phishing attacks are becoming increasingly personalized thanks to the rise in social engineering, the practice of using psychological tactics to get victims to divulge sensitive information. There’s much more information readily available online, and attackers can use this to craft more specific and targeted attacks. 

While some phishing attacks focus on the consumer, bad actors know that there is much more to be gained by targeting an organization. Business Email Compromise (BEC) is an umbrella term that describes phishing attacks that target an organization by impersonating its domain. The attacker relies heavily on Social Engineering and crafts a phishing email designed to look like one from someone inside the business  (usually the CEO). The main aim of this type of attack is to steal money or sensitive data.

According to Verizon’s 2023 Data Breach Investigations Report, BEC attacks (a type of Social Engineering attack) remain remarkably efficient and lucrative for cybercriminals, as indicated by the nearly twofold increase in Verizon's incident 2023 dataset. Currently, BEC attacks constitute more than 50% of all Social Engineering incidents.

The types of attacks that come under the umbrella term Business Email Compromise include: 

Ransomware is malicious software that encrypts files or locks down computer systems, demanding payment (a ransom) for their release.

When the attacker poses as the CEO or another senior executive and targets employees. 

When the attacker tries to trick the recipient into paying an invoice or multiple invoices. 

An attack targeting those with access to Personally Identifiable Information (PII), such as HR managers.

Account compromise refers to unauthorized access to a user's account by a third party, often resulting in the theft of sensitive information or misuse of the account for malicious purposes.

Phishing attacks have varying levels of sophistication

It’s not surprising that many users are deceived by phishing emails. When done well, they can be almost impossible to spot. Organizations that experience phishing attacks haven’t necessarily done anything wrong, and the attacker doesn’t even need access to their systems to carry one out. But regardless, many governments and regulators consider organizations to have a responsibility to safeguard their customers against phishing attacks. So organizations that haven’t taken appropriate measures to safeguard their customers may be liable for a data breach - and penalties. 

In the last decade, a series of email protocols have been introduced by industry leaders to try and improve email security, but email impersonation bypasses many of these. 

Dive into the next chapter to gain a quick understanding of these protocols and what they protect against. 

In October 2008, email was officially labeled as ‘inherently insecure’. It was said that anyone could impersonate a domain and use it to send fraudulent emails pretending to be the domain owner. 

SPF was developed to help fight sender address forgery by comparing the sending server’s IP address to a list of authorized senders.

Your SPF record - outlining all senders (IP addresses) authorized to send emails on your behalf - is stored in your Domain Name System (DNS) as a TXT (text) record. When an email is sent using your domain, the receiving mail server/DNS checks this record to see if one of the IP addresses matches. If it does, then the receiving sender knows it’s from a legitimate source, and the email is authorized to land in the recipient's inbox.

An SPF lookup is when the DNS receiving your email has to ‘look up’ the IP addresses present in any of the include statements within your record, to check if they match with the IP sending your email. 

An SPF include is a feature within SPF records that allows domain owners to include the SPF records of other domains in their own SPF policy. This enables streamlined management and ensures that the included domains' email sending policies are considered when determining the legitimacy of emails sent from the including domain.

The SPF lookup limit is the number of times a recipient DNS can carry out a lookup for a domain with a maximum cap set at 10.

You can add unlimited singular IP addresses to your record without incurring additional DNS lookups, as they are directly visible in the record.

But this isn’t the case for include statements, and the number of IP addresses an include has equals the number of lookups the receiving DNS has to carry out. This contributes to your maximum total of 10. 

So for example, you might have 3 IP addresses listed in your SPF record as they are, an include statement for Google (which contains 4 IP addresses) and an include statement for Mimecast (which contains 6). The receiving DNS doesn’t need to carry out lookups for the visible IPs, but it does for the Google and Mimecast include statements. So in this case, you’ve reached your total of 10.

In reality, 10 lookups aren’t enough, because most businesses use a number of tools that send emails on their behalf. These will all have their own include statements, which will include IP addresses, and so will require lookups. If you go over the limit, then you’ll likely fail authentication and your deliverability will suffer.

One of the main reasons the SPF record might be failing for your email traffic is the “too many DNS lookups” error. The SPF specification limits the number of DNS lookups to 10. If your SPF record results in more than 10 DNS lookups then SPF will fail. The SPF mechanisms counted towards DNS lookups are: a, ptr, mx, include, redirect and exists. “ip4”, “ip6” and “all” do not count towards the lookup limit.

If that all sounds a bit too technical, think about it this way. G Suite alone takes up 4 DNS lookups, add in Hubspot for marketing which uses 7 lookups then you’ll already be over the 10 lookup limit! As soon as you go over 10 SPF lookups, your email traffic will begin to randomly fail validation.

What is DomainKeys Identified Mail (DKIM)?

DKIM stands for DomainKeys Identified Mail, which is an email authentication protocol designed to prevent message modification in transit, a method often used in phishing and email scams.

DKIM is a more recent standard and more complex than SPF. Its functionality is based on using asymmetric cryptography in the signature parts of the email. There is a private key stored on the server that sent the email, a place where it could never be read by the end-user, and a public key which is published in the DNS record of the sender’s domain and is used to decrypt email signatures.

In other words, when an email is composed, its headers and body are signed using the private key of the sender to create a digital signature, which is also sent as a header field along with the email. On the receiver’s side (if DKIM is enabled), the server retrieves the public key and verifies if the email was indeed signed by the sending domain. If the signature is successfully validated, that proves that the sending domain sent the message and also that the headers and body of the message have not been modified or tampered with during transmission.

Yes, DKIM is an essential security protocol that enhances your outbound email protection and is an essential part of the DMARC verification process. 

A DKIM signature is the private key attached to an email that confirms it’s come from you. 

In this chapter, we discuss Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) and explain how they protect you from email-based threats.

Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM)

SPF and DKIM

Mail Transfer Agent Strict Transport Security (MTA-STS) is a standard that enables the encryption of messages being sent between two mail servers. It specifies to sending servers that emails can only be sent over a Transport Layer Security (TLS) encrypted connection which prevents emails from being intercepted by cybercriminals.

The Simple Mail Transfer Protocol (SMTP) alone does not provide security, making it vulnerable to malicious attacks such as man-in-the-middle attacks. A man-in-the-middle attack is where communication between two servers is intercepted and possibly changed without detection by the recipient.

In addition, encryption is optional in SMTP, which means that emails can be sent in plaintext. If a plaintext email was intercepted in transit, it could easily be read and manipulated. Without MTA-STS, an attacker can intercept the communication and force the sending service to send the message in plain text. 

By enabling MTA-STS, a TLS connection is required which ensures encryption and keeps your emails private. The MTA-STS standard is so critical to improving the security of SMTP that it has widespread support among major mail service providers such as Google and Microsoft.

For more technical details, visit the MTA-STS and TLS chapter in our Technical Configuration Guide.

MTA-STS is a standard that ensures messages are encrypted during transfer between mail servers, protecting emails from interception by cybercriminals.

What is MTA-STS?

MTA-STS

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It’s an outbound email security protocol that allows domain owners to take back control of their email identity by telling receiving inboxes to reject spoof emails.

DMARC stops bad actors from pretending to be you and sending phishing emails to your employees, customers, and supply chain. This authentication of an email’s origin with DMARC also greatly improves deliverability. 

The more companies and institutions enforce a DMARC policy of p=reject for their outbound email, the safer the email ecosystem becomes overall. This is because attackers and bad actors will have fewer domains to ride on the back of to carry out attacks. So as a result, more sensitive information is protected, industry requirements are met, more money is saved and fewer attacks are successful.

What type of threats does DMARC protect against?

DMARC is an outbound security protocol, meaning it simultaneously protects recipients and your brand reputation from being exploited. It’s important to remember that bad actors who use your domain to trick people into opening emails aren’t doing so by chance, they’re piggybacking off the weight of your brand reputation and relying on it to encourage email opens. 

DMARC stops this exact domain impersonation, by telling recipient servers not to accept any emails which aren’t authenticated to have come from you. So, bad actors cannot use your domain to send phishing emails and carry out Business Email Compromise (BEC).

What are the business benefits of implementing DMARC?

Aside from providing a strong email security posture, DMARC can offer some real business benefits too. Below are some of the key advantages of implementing DMARC.

DMARC provides reports showing most, if not all, emails that come from your organization’s domain. This contrasts with traditional cybersecurity solutions which only pick up inbound phishing emails. Without DMARC, organizations are not getting a complete picture of the number and scale of attacks against them.  

Protect your reputation and shut down brand abuse

Phishing attacks that use exact impersonation can cause considerable reputational damage. Phishing scams attract negative press, with liability often attributed to the organization that has been impersonated. 

Paying fake invoices or completing wire transfers from emails impersonating a business’ CEO is common. 

Get your registered logo on your emails 

BIMI (Brand Indicators for Message Identification) is a standard that enables your registered logo to be visible in the avatar slot of any DMARC authenticated emails you send, by using Verified Mark Certificates. BIMI increases your brand impressions, and research has found it has a significant positive impact on consumer trust, interaction, and purchasing decisions. Being DMARC compliant means you’re eligible to take advantage of this brand-enhancing reward.  

When DMARC is set up correctly at a policy of p=reject, senders signal to ISPs that they are actively taking measures to authenticate their emails and improve their domain security. This builds trust with ISPs, reducing the likelihood of legitimate emails being mistakenly marked as spam or phishing attempts.

Organizations that fail to take the necessary precautions to prevent email spoofing are likely to be considered less trustworthy. Customers may not trust emails that supposedly come from these organizations and could be deterred from using email to communicate with them, which can impact on those organizations’ ability to communicate effectively with their customers. By implementing DMARC, you’re putting a robust measure that confirms your organization’s identity in place 

Shadow IT refers to legacy systems or technology set up by various departments in a business to plug a gap in existing infrastructure, and it’s not always easy to identify or remove. DMARC gives you the visibility necessary to identify and resolve any outlying software or systems, meaning nothing will accidentally be sent out by these legacy systems. Implementing DMARC uncovers all the email services sending emails from your domain, whether you officially know about them or not.

How DMARC supports compliance and regulation efforts

DMARC helps organizations comply with email security recommendations made by global government bodies such as NIST, NCSC, and the European Commission.

The EU's revised Directive on Security of Network and Information Systems (NIS2 Directive) has dramatically increased the regulatory pressure on organizations to take proactive action against phishing through a DMARC policy of "reject.”

The NIS2 Directive is an EU regulation that establishes a high common level of cybersecurity across the EU. For 'Essential and Important Entities,' compliance with this directive is mandatory.

Although the text of the NIS2 Directive does not explicitly mention DMARC or a "reject" policy, several of its requirements are related to the principles that DMARC upholds, and the absence of a DMARC policy of "reject" could be considered to weaken compliance with as many as five of direct NIS2 requirements or principles. 

Security by Design and by Default: The NIS2 Directive requires ‘providers of public electronic communications networks or of publicly available electronic communications services’ to implement security by design and by default. As a global and well-accepted internet standard for the prevention of email domain impersonation, a DMARC policy of “reject” forms an important part of a security by design and by default strategy. 

Risk Management Measures: The NIS2 Directive requires 'Essential and Important Entities' to take appropriate and proportionate technical and organizational measures to manage the risks posed to the security of network and information systems. A DMARC "reject" policy aligns with this requirement as it is a key measure to manage the risk of email phishing and spoofing attacks, which can lead to the risks outlined in this document.

Supply Chain Security: The NIS2 Directive requires entities to ensure the security of their network and information systems, including those of their supply chain. A DMARC "reject" policy can help by ensuring that only authorized third-party vendors can send emails on behalf of the entity, which can help prevent phishing attacks that originate from compromised vendors as well as protect the third-party vendors themselves from becoming victims of attacks that impersonate an organization.

Incident Reporting: Entities must report incidents having a significant impact on the continuity of essential services. While DMARC itself is not a reporting mechanism for security incidents, the detailed aggregate and forensics reports it generates can help organizations identify and respond to security incidents related to email spoofing.

Resilience: Entities are required to take measures to ensure the resilience of their systems and networks. A DMARC "reject" policy contributes to this by protecting the organization's email communication system, a critical part of its network, from being misused by unauthorized senders.

The Digital Operational Resilience Act (DORA) is a regulatory framework by the European Union aimed at ensuring the digital operational resilience of the financial sector. It seeks to establish a stringent, harmonized set of rules for digital operational resilience, including areas such as ICT risk management, incident reporting, digital operational resilience testing, and more. 

Even if an organization is not classified as a financial institution, DORA defines criticality thresholds for services provided to financial institutions. If an organization is a direct service provider to a financial institution and its services meet these thresholds, then the company is subject to DORA. Furthermore, it is likely that under DORA, these financial institutions push more stringent security controls onto their providers, including DMARC with a policy of “reject”.

While DORA does not go into specific technical detail, it does press three relevant aspects for DMARC at a policy of “reject”:

​​ICT Risk Management: One of DORA's key aspects is to ensure effective ICT risk management. Implementing a DMARC "reject" policy directly contributes to this by preventing phishing attacks, email spoofing, and other email-based threats. This enhances the security of the ICT ecosystem, aligning with DORA's objectives.

Third-Party Risk: One of DORA's key aspects is to ensure effective ICT risk management. Implementing a DMARC "reject" policy directly contributes to this by preventing phishing attacks, email spoofing, and other email-based threats. This enhances the security of the ICT ecosystem, aligning with DORA's objectives.

Operational Resilience: DORA places a strong emphasis on the operational resilience of financial services providers. A DMARC "reject" policy can help enhance operational resilience by ensuring the integrity and authenticity of email communications, reducing the risk of disruptive incidents caused by phishing or other email-based attacks.

General Data Protection Regulation (GDPR) came into force in May 2018, requiring you to have Data Processing Agreements (DPAs) with every cloud service provider that handles EU consumer data on your behalf. With DMARC, if a cloud service provider does send emails using your company’s domain name in the ‘From’ field, then DMARC will reveal them to you. While a DMARC "reject" policy is not explicitly required by GDPR.

DMARC has been widely adopted by most email receivers (including Google, Yahoo, and Microsoft), which means that most consumer inboxes are already protected. 

In addition, since February 2024, Google and Yahoo have introduced new email requirements for bulk senders (those who send more than 5,000 emails a day). These requirements stipulate that you:

Send from a domain with a DMARC policy of at least p=none 

Set up one-click unsubscribe for recipients of promotional mail

Those who fail to meet these requirements will see Google and Yahoo limiting sending rates or marking legitimate messages as spam. To find out more, visit our informational Google and Yahoo page.

DMARC works using the existing security protocols SPF and DKIM. Your SPF record is a whitelist of IP addresses you’ve authorized to send emails using your domain. DKIM acts like a digital signature, letting the recipient know you are who you say you are. When you first configure DMARC, you’ll spend some time classifying which senders you’ve authorized to send emails using your domain, and which you haven’t.

Both SPF and DKIM are essential to your email security setup, but neither prevents exact impersonation. While the protocols tell the recipient who the email is from, the recipient has no instruction to act on this knowledge, i.e. it doesn’t know what to do with your email. 

So, DMARC works by combining the results of SPF and DKIM to determine if your email is authentic and authorized. Then, the DMARC policy you have in place tells recipient servers what to do with it. 

Your DMARC policy is essentially the instruction you give to receiving servers, telling them what to do with emails that come from your domain. There are three policies to choose from:

p=none: this policy tells the recipient server to accept all emails from your domain, regardless of whether they pass authentication or not.

p=quarantine: this policy tells the recipient server to send any emails from your domain that fail authentication to spam.

p=reject: this policy tells the recipient server to reject any emails coming from your domain that fail authentication.

Typically, when you implement DMARC for the first time you will start with a policy of p=none. This policy means that you are in reporting-only mode and you don't want any policy to be applied to your emails if they fail DMARC. During this stage you are simply gaining visibility into how your domain is being used around the world and what services are sending emails on your behalf. At this stage you simply identify your legitimate sending services and configure each one with SPF and DKIM so that they send DMARC compliant emails.

Once you are confident that your sending services are fully configured you can change your DMARC policy from p=none; to p=quarantine. This means that from this point on any emails that fail DMARC will have this policy applied to them, which means that usually they will be sent to the spam folder of the recipient.

If you do not encounter any issues during the p=quarantine; stage and only spoofing emails are being quarantined you can change the policy once more from p=quarantine to p=reject. At p=reject, you are telling recipients to reject any emails that fail DMARC. This means that end recipients will never receive the emails as they will simply be rejected at the SMTP level. This is the strongest level of protection which means that no one will be able to spoof your domain. Any emails that do not originate from your legitimate sending services will be rejected as they will fail DMARC. 

To learn more about the technical ins and outs of DMARC, visit our dedicated DMARC chapter in our Technical Configuration Guide.

Learn more about DMARC, the email security protocol that lets domain owners take back control of their email identity by telling receiving inboxes to reject spoof emails.

What is Domain-based Message Authentication, Reporting, and Conformance (DMARC)? 

DMARC

Global mandates and guidance for DMARC in 2024

For cybersecurity, email security and IT teams, understanding and adhering to global DMARC (Domain-based Message Authentication, Reporting, and Conformance) requirements is imperative. 

At Red Sift, we have put together a tabulated overview of DMARC mandates and guidance enforced across different regions worldwide. Our aim is to provide a clear, unambiguous guide that consolidates the varying global requirements into one accessible format. 

Whether you are an IT security professional, email administrator, or a compliance officer, this table will serve as an essential tool to ensure your organization’s email security aligns with international best practices and requirements.

Global DMARC mandates and guidance

The landscape of email security and authentication is constantly evolving. 

At Red Sift, we understand the complexities involved in implementing and managing DMARC. Our award-winning Red Sift OnDMARC is designed to simplify the path to DMARC enforcement, offering you best-in-class technology and expertise.

We've created a table summarizing global DMARC mandates and guidance, offering a clear and unified overview of regional requirements.

Global mandates and guidance for DMARC

Brand Indicators for Message Identification (BIMI) is an email standard introduced in 2021 that enables businesses to show their brand logo in the avatar slot of the Domain-based Message Authentication, Reporting and Conformance (DMARC) authenticated emails they send. This means businesses can proactively protect recipients of their email from bad actors. If you're a technical administrator, marketer, or business leader, implementing BIMI will mean you reap the benefits of better deliverability and higher open rates.

Email continues to be the most popular way for businesses globally to communicate, so it’s crucial organizations implement the best methods for ensuring both authenticity and brand experience.

BIMI inserts your logo next to your email address at participating providers. It doesn’t prevent business email compromise (BEC)—that’s DMARC’s job—however, if someone tried to spoof you when you have BIMI in place, your logo won’t appear, and depending on your DMARC policy, the email may not even arrive. 

Similar to SPF, DKIM, and DMARC records, your BIMI record lives in your DNS as a text (TXT) file. When an email you send arrives in the recipient inbox, the recipient server looks this record up to check that it’s coming from a verified sender (using DMARC). Once authenticated, the BIMI TXT file informs the recipient server of the logo’s location, and any relevant BIMI certificates, and it is then made visible in the recipient inbox.

Implementing BIMI can significantly increase your brand recognition and email engagement, which are crucial factors for marketing success. With BIMI, your company's logo is displayed directly in the recipient’s inbox next to your email, helping your messages stand out among the clutter. This enhanced brand visibility establishes trust and credibility with your audience, leading to higher open rates and click-through rates. 

A recognizable logo can immediately evoke trust and familiarity, which is a key advantage in increasing email engagement metrics. By adopting BIMI, you create a consistent visual identity across your email communications, helping your brand gain a competitive edge.

From an email security perspective, DMARC—the protocol that powers BIMI—plays a vital role in reducing phishing attacks and email spoofing, providing better protection for your brand and recipients. Beyond its importance to email security, BIMI offers a host of other benefits for businesses, including improved brand visibility, increased trust in email legitimacy, and better brand recall. It’s even been shown to have an impact on consumer buying behavior.

When implemented using a Mark Certificate, BIMI has many benefits for businesses of all shapes and sizes. Showing a verified logo in email using a VMC, GMC or CMC can help businesses enjoy:

After exposure, brands that had applied a logo increased their recall by up to 44%. The stronger the brand, the higher the recall increase, up to 120%.

Open rates see up to a 39% increase in both transactional and promotional emails.

Improved average purchase increase by 32%

The email open uplift carried over to purchasing decisions with an average buying increase of up to 32%.

90% increase in confidence in an email's legitimacy

Using BIMI increased consumer confidence in the legitimacy of an email by as much as 90%.

Check to see if your domain is ready for BIMI in less than 10 seconds: Try the BIMI Checker now

BIMI is not just designed to boost brand awareness and enhance security, but also offers an advantage for today’s marketers looking to stand out against the noise. With the average consumer receiving around 120 emails every day, making an impression in the inbox is hard. However, by putting the email fundamentals in place, you’ll put your brand in a prime position to reap the revered reward that is ROI. 

Find out more in our blog: 8 Reasons to Include BIMI in Your 2025 Marketing Budget

In partnership with Entrust, Red Sift commissioned research into the impact of a visible logo in an email’s avatar location on open rates, brand recall, and buying behavior.

The research focused on organizations based in the UK and US. Results showed a 9% increase in transactional open rates for a leading US investment firm, compared to a 10% decrease for a competitor that didn’t make use of BIMI. Further data showed an increase in market share by 38% for a UK energy provider, up from 6% while a similar competitor without BIMI experienced an 11% drop.

For businesses trying to sell products and services, promotional email open rates are crucial. In such a crowded market it is hard to break through against leading brands. However, when comparing a competitor’s promotional emails with BIMI implemented versus a leading brand without BIMI, US, and UK leading businesses lost 15% and 18% share of opens, while the competitors saw uplifts of 14% and 39% respectively. 

In addition, Red Sift and Entrust found that overall, when a brand’s emails had a logo but a competitor’s did not, opens increased by 21% in the US and 39% in the UK. What’s perhaps most interesting is that these findings appear to be irrespective of market share or brand size.

In both the US and UK, we compared how logo visibility impacted purchasing decisions on emails from a selection of leading and competitor food delivery service brands. In the US, businesses without a logo within their email communications experienced a 24% loss, compared with a 34% gain for competitors who did have a logo enabled.

In the UK, a leading brand lost 39% of sales share due to the lack of a visible logo, whereas a competitor with a visible logo gained an impressive 32% sales increase.

To implement BIMI, you need to have a DMARC record in place and your organization’s sending and apex domains must be DMARC compliant (in a policy of quarantine or reject). 

Organizations are required to use a Mark Certificate (MC) from an authorized Certificate Authority (CA), which works alongside an organization’s DMARC policy that is required at enforcement (either quarantine or reject) and a BIMI record. 

A MC can either be a Verified Mark Certificate (VMC) with a registered trademark, a Government Mark Certificate (GMC) for government agencies, or now, the newly introduced Common Mark Certificate (CMC) for established brands.

Read our detailed guide on the key considerations before implementing BIMI.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a security protocol that protects businesses from exact domain impersonation and its harmful effects. 

When correctly configured, it works using existing security protocols SPF and DKIM to tell any receiving servers that an email coming from your domain is legitimate, and stops unauthenticated and unauthorized email. This stops hackers using your domain for phishing attempts against your customers, employees and suppliers and has also been shown to improve email deliverability and placement.

Read our definitive  guide to implementing DMARC for your business

What is a Verified Mark Certificate (VMC)? 

A Verified Mark Certificate (VMC) is a digital certificate issued by an authorized certification authority that enables organizations to display their registered logo next to their email messages in supported email clients. It is part of the broader Brand Indicators for Message Identification (BIMI) standard, which aims to provide visual confirmation of the email sender’s identity, thereby building trust and increasing email security.

What is a Government Mark Certificate (GMC)? 

A Government Mark Certificate (GMC) is a digital certificate designed specifically for government agencies and entities to authenticate their email communications. Similar to Verified Mark Certificates (VMCs) used by commercial organizations, GMCs help government bodies establish trust and provide visual identity assurance when sending emails to the public and other stakeholders.

Verified brand logo in inbox: VMC and GMC enables the display of a verified brand logo in email inboxes through BIMI, making emails easily identifiable to recipients.

Strengthened brand trust: When used with BIMI, VMC and GCMC reassures customers that the email is authentic and from a trusted source, reducing the risk of phishing.

Higher email open rates: Displaying the verified brand logo increases the likelihood of recipients opening the email, as BIMI logos are highly visible and convey trust.

Enhanced security: VMC or a GMC with BIMI requires DMARC enforcement, improving email security and reducing the risk of spoofing.

What is a Common Mark Certificate (CMC)? 

Common Mark Certificates (CMC) are the newest MC, enabling organizations to utilize BIMI in Gmail without requiring a registered trademark like VMC or GMC. This means businesses who have established use of a known logo but haven’t gone through the registered trademark process can utilize best practices in email communications by incorporating their brand into the inbox.

Global recognition and accessibility: Common Mark Certificates can be recognized across Gmail’s global domains, making the BIMI mark understandable and trustworthy for a broad audience.

Simplicity in cross-border compliance: Common Mark Certificates simplify compliance with BIMI's requirements, especially for multinational brands looking to present a consistent image in various jurisdictions.

Improved brand perception: Displaying a logo via a CMC through BIMI promotes the brand as a standard bearer of quality, which appeals to recipients seeking consistency and reliability. Customers are more likely to interact with emails, increasing engagement and click-through rates.

Eases international email delivery compliance: A Common Mark Certificate aids brands in meeting DMARC and BIMI requirements for international email platforms, enhancing deliverability and visibility.

Read more in our Gmail's Support for Verified Mark Certificates (VMC) in BIMI Adoption blog

What if I want to use BIMI for more than one domain/subdomain?

By default, a VMC on the organizational domain will cascade to all subdomains. However, if you’d like to use a different trademarked logo on a subdomain, you can do so. Keep in mind this will require a separate VMC chargeable at the current rate as each VMC is tied to a specific logo.

DMARC Policy: Your domains must be DMARC-compliant, with an enforced policy (quarantine or reject).

Trademarked Logo: The logo you wish to display must be a registered trademark.

Certified Authority (CA): The VMC must be issued by an authorized CA, such as Entrust or DigiCert.

BIMI TXT Record: You need to publish a BIMI TXT record in your DNS, which includes the URL to your SVG logo file.

Approved jurisdictions

Employee verification: The CA will verify your employment with the Higher Authority and/or your HR team

Video ID verification: Video call with a specialist that will verify your identity with a government ID

Domain validation: Verify you own domain by entering a TXT record in your DNS zone

What are the roles within EV verification?

Authorization contact: Provides the CA with authorization to issue VMC certificates for their organization. They will need to grant consent by email. 

Contract signer: They will accept the subscriber agreement on behalf of their organization. The agreement is online and is accepted as a click-through. This person can be the same as the Authorization Contact to simplify the process.

Higher authority: Also known as “Independent Confirmation” – they confirm that the Authorization Contact and Contract Signer are employed with the organization and authorized to act in these roles.

A VMC or CMC is a key requirement for BIMI implementation, particularly if you aim to use BIMI with email providers like Google. Without a mark certificate, your logo cannot be displayed, even if you have DMARC in place. A VMC or CMC confirms the ownership of your logo, acting as a visual confirmation that the email is from a trusted sender, enhancing your email branding efforts and boosting email marketing ROI.

Implementing a Verified Mark Certificate also leads to tangible benefits, such as increased open rates, higher email engagement, and improved brand visibility within the inbox.

The time it takes to deploy BIMI can vary from business to business. One of the most important steps is ensuring your domain is DMARC compliant. At Red Sift, we streamline this process through Red Sift OnDMARC, where the average time taken to get to p=reject is 6-8 weeks. 

It’s worth noting that exact time will depend on the number of sources that need configuring and the speed at which you can implement the needed changes.  

Additional factors include your organization’s size, the complexity of your infrastructure, and whether you are opting for a VMC or GMC. It can take anywhere from 3-6 months to get a registered logo trademark, depending on the country you’re in, versus a CMC where adoption time is expected to be shorter.

If you meet all the requirements, the actual verification process takes on average 7-10 business days.

Currently, the list of mailbox providers that support BIMI includes Google, Apple, Yahoo, and Fastmail, Zoho, web.de, among others. Check the full list here.

Learn more about the only integrated BIMI and VMC application available on the market today, Red Sift OnDMARC's BIMI feature.

Understanding how your logo with BIMI implemented will appear on both desktop and mobile is an important step to ensuring your brand’s impact with cross-platform users.

See the image below for our guide on how a logo display is likely to appear. On a mobile-enabled platform, like the Gmail app, the logo will appear in the inbox preview, while on desktop, it will appear in the message preview.

Note: Both mobile and desktop view in Gmail only shows the verification mark enabled through a VMC in the message preview.

Apple has announced changes to its Business Connect function, including how a brand name or brand logo will be displayed in iPhone apps related to phone, email, and payments. 

It’s true that Apple’s update resembles some similarities to BIMI, but there remain significant differences. These include the setup process, logo requirements, and cost. While Apple’s option is essentially free, the logo display is limited only to iCloud Mail.

Red Sift OnDMARC’s BIMI feature is the only integrated BIMI with VMC or CMC solution available on the market. It helps users take care of their MC application end to end, including obtaining a VMC/CMC without having to go directly to the Certificate Authority (CA).

Red Sift OnDMARC offers seamless integration with Entrust, enabling users to easily transfer application data between the two platforms via API. This streamlined process eliminates the need for managing multiple platforms, allowing customers to achieve the necessary DMARC policy and BIMI readiness in one place. By centralizing these tasks, users benefit from a simplified experience with full guidance from industry experts, making it easier to implement both DMARC enforcement and VMC or CMC acquisition through a single interface.


Beyond BIMI implementation, Red Sift OnDMARC offers a wide variety of additional benefits including:

Learn more about BIMI, the email standard that enables businesses to show their brand logo in the avatar slot of the DMARC-authenticated emails they send.