When mailbox providers receive an email and authenticate the message with DMARC, the provider also queries the DNS for the domain’s designated BIMI record. If verified, brands with valid BIMI records will then have their verified logo appear beside their emails in recipients’ inboxes.
In order for an organization to use BIMI, it must already have SPF or DKIM set up, as well as DMARC. While these specifications help protect a domain from unauthorized spoofing, they do not provide a visual clue to the recipient that the email sender has been authenticated. BIMI-compliant domains will demonstrate this authenticity with a cryptographically protected logo, enabling the average end-user to easily discern legitimate senders.