Gmail is adding a blue checkmark to better verify senders
9to5google.com
9to5google.com
I'll post my comment from the other thread here as wel:
For BIMI to work, you need a Verified Mark Certificate (VMC). This is a x.509 certificate, but with additional extensions enabled. Most notably the 'pe-logotype' (OID 1.3.6.1.5.5.7.1.12) extension, which embeds an SVG file of your 'mark' (most likely your logo) into the certificate. The VMC proofs that your domain (the part after the '@' in the sender email address) is in fact the legal owner of the mark (the logo) that you are using. Otherwise any sender could use the logo of a bank.
A VMC is like an EV certificate on steroids, because there are a lot of things the CA must verify before issuing the certificate. The CA must verify that you own the 'mark' (the logo), and in order to do that the mark must be registered at your local trademark office. The CA must then contact your local trademark office to verify you own the mark, and contact your company (by phone) to verify you actually ordered the VMC. Needless to say: VMCs are not cheap (currently ~800 USD). Also needless to say: you can't get a VMC at Let's Encrypt or other free CAs.
Once you obtained a VMC you must host this VMC and the mark (as SVG) on a dedicated HTTP server, supporting TLS. I say dedicated, because most customer (browser) facing web services simply won't do. You must ensure that the files are served without cookie banners, CAPTCHAs, redirects, etc. The served mark (SVG) must be binary equivalent to the mark in the VMC, or else it will be rejected. This means hosting your BIMI assets using Windows machines may actually prevent it from working, as it may rewrite the line endings.
VMCs are certificates, so they will expire. You must renew your VMC annually. If you forget, you may harm your brand reputation.
Finally, BIMI mandates that you have DMARC enabled with 100% quarantine, or reject policy enabled. Which, on itself, can be quite a long process to adopt for large organizations.
My company has helped dozens of organizations with obtaining a VMC, we also host the BIMI assets for them. We see it is quite a big hurdle to adopt BIMI for most customers. It is definitely not as straight forward as becoming verified on Twitter et al.
We already have some measures like MTA-STS, SPF, and DMARC that should ensure you can’t impersonate a domain.
Honestly I am amazed that they can even do this for the price they ask. It will have cost the CA a lot to get this certified, and judging from the number of BIMI VMCs we see in the wild, I'd doubt that they are making money.
You should already be able to verify that the mail is from the registered domain and provide a checkmark with freely available tools.
IMHO certificate authorities are a technology looking for validation in their necessity and truthfully the whole business model around CAs is bunk. I can use DNSSEC to provide a verified chain of trust all the way up to the root (.) signed zone. Regardless of “who signed it” anything I put into the DNS zone should be trusted to have been added there by someone who has control of the domain and access to the private key that can sign the zone.
This whole song and dance of “pay us thousands of dollars each year for us to verify that you’re allowed to use your own trademarked images” is already a solved problem in the copyright system. See someone using your copyrighted images where they aren’t permitted to? You can sue the violating domain owners for copyright infringement. No “trusted third party” CA handwaving required.
Trust me, even the most ambitious of scammers aren’t going to risk that copyright infringement suit when it can potentially result in domain seizure just to spoof BofA’s BIMI image.
I understand people like having this third party system that someone else has done all the work verifying Ts are crossed and Is are dotted but the current system in place (third party CAs) are hardly trustworthy themselves and there are numerous examples of CAs that have “gone rogue” and provided certificates for sites that they should not that you can find out on the web if you go looking which is why I’m a strong advocate for pushing DNSSEC in the first place. The domain itself becomes its own source of truth. If I tell you X subdomain should have Y certificate signed by Z authority and that information is securely verified through DNSSEC I can trust that it came from someone with access to the signing key inside that domain.
Startup founders, if you listen to this: create a cheaper alternative.
(Let's not even get into the viability of business models based on convincing Google, Microsoft, and Thunderbird to implement a feature so that you can sell it)
I use to be able to access gmail via mitt, but the forced a change that was too much for me so I bailed.
DMARC does not reduce spam in any meaningful way, but it does prevent impersonation.
Spammers can't sign your domain. It will, however, help his legitimate sent emails get through to trusted parties or as his domain reputation improves.