Build Trust at a Glance: Visual Protection Against Phishing
BIMI (Brand Indicators for Message Identification) is a standard for displaying brand logos in company emails. By seeing the logo, recipients can instantly confirm that the email is from a legitimate company. This reduces the risk of threats like phishing and spoofing and helps enhance brand trust. Displaying the logo requires a Verified Mark Certificate (VMC) issued by a Certificate Authority.
Reports of phishing incidents have increased dramatically since 2019. The number of cases skyrocketed from approximately 20,000 in 2018 to nearly 1.2 million in 2023—a staggering 60-fold increase in just six years.
One key factor behind this surge is the COVID-19 pandemic. As economic activities and daily communication moved online, criminal activities like spoofing and phishing also proliferated in the digital world.
The pandemic also brought new demographics online, such as seniors and young students, who previously had limited internet experience. Due to lower digital literacy, these groups have become particularly vulnerable, leading to a sharp rise in the number of victims.
Phishing reports to the Anti‑Phishing Council are rapidly increasing!
A sharp increase in fraudulent transfers via internet banking (approx. 8.7 billion JPY in 2023).
In today's complex world of cybersecurity, BIMI and VMC offer a refreshingly simple advantage: security you can see. Displaying a trusted logo directly in the inbox gives users instant confidence that a message is legitimate.
This visual verification is a game-changer for businesses. It helps boost email open rates—a key marketing metric—and strengthens brand trust. In an era where email is the key to countless online services, allowing customers to identify your messages at a glance is a powerful advantage.
When combined with DMARC (an anti-spoofing email protocol), it helps prevent fraudulent emails and reduces the risk of phishing attacks.
When recipients see the official logo, they can instantly trust the sender and confidently open the message.
With your logo visible in the inbox, recipients instantly recognize your brand. This consistent visibility reinforces brand identity with every email.
DMARC is an essential protocol that protects your domain from being used in phishing and spoofing attacks.
While many domains now have a DMARC policy of p=none to meet Google's guidelines, BIMI requires a stricter enforcement level. To display your logo, you must set your policy to either p=quarantine or p=reject.
IMPORTANT: Before you enforce a quarantine or reject policy, you must analyze your DMARC reports. This analysis is vital to ensure your valid emails don't get blocked and to avoid disrupting your email delivery.
The brand logo displayed in emails must be a registered trademark.
Your trademark needs to be registered with the intellectual property office of a country or region that is a member of the World Intellectual Property Organization (WIPO). The specific trademark class or the designated goods and services do not affect eligibility.
To complete your application for a Verified Mark Certificate (VMC), you will need:
Your Domain: The email domain you wish to certify.
Trademark Details: Information about your registered trademark. If you are a licensee, a letter of authorization from the trademark holder is required.
SVG Logo File: A logo file in the specific SVG Tiny 1.2 format. (Refer to the specifications here: https://support.google.com/a/answer/10911027?hl=en)
Proof of Organization: Official documents to prove your organization's legal status, such as articles of incorporation or a business license. The main types of documents are listed below.
→ FAQ content is available in Japanese only. Please contact us for English support.
Check if your company logo is ready for BIMI.
Free : up to 10 checks per day
Version 1.0.0 – English Edition in Development
Drag and drop your SVG logo file here, or click to select a file.
APIでチェック中...
ここにロゴのSVGファイルをドラッグ＆ドロップするか、ファイルを選択してください。
The VMC vetting process is comprehensive, combining the strict checks of an EV SSL certificate with dedicated trademark validation.
1. Domain validation
Confirms you are the legitimate user of the domain.
Performed either by approving a verification email sent to a public contact address for the domain, or by adding a specific token string provided by the CA to the domain’s DNS.
2. Existence/operational validation of the organization
Verifies that the organization and its authorized representatives actually exist and that the service is operated in reality.
Uses objective documents (e.g., company registration) and may include phone calls or in-person interviews to confirm operational substance and authority.
3. Trademark validation
Confirms the brand logo (SVG file) and the trademark registration status.
The trademark must be registered in a country/region that is a member of WIPO. Trademark class or designated goods/services do not matter, but the registered mark must match the brand logo.
If the logo differs from the registered mark (for example, if only a word mark is registered), a trademark application covering the logo may be required.
The Certificate Authority (CA) will issue the Verified Mark Certificate (VMC) in PEM file format.
A PEM (Privacy Enhanced Mail) file is a standard format used to store cryptographic items such as digital certificates and private keys, primarily for encryption and authentication purposes.
The final configuration for BIMI involves the following two steps:
Upload the PEM File and SVG Logo
Create the BIMI DNS Record
1. Upload the PEM File and SVG Logo Upload your PEM file and your brand logo (in SVG format) to a publicly accessible location on your web server. It is required that these files are available at static URLs.
Example:
https://www.your-domain.com/bimi/vmc/certificate.pem
https://www.your-domain.com/bimi/logo/brand_logo.svg
2. Create the BIMI record in your DNS as follows.
| Field | Value | Description |
|---|---|---|
| Type | TXT | DNS record type |
| Host | default._bimi.[your_domain] | Enter your authentication domain after "default._bimi." |
| Value | v=BIMI1; l=[URL_to_SVG_file]; a=[URL_to_PEM_file]; | Your BIMI record |
| TTL | 3600 | Set to 3600 seconds (1 hour). |
→ FAQ content is available in Japanese only. Please contact us for English support.
With two decades of experience, GMO Brand Security possesses deep expertise in trademarks. You can confidently entrust us with the critical trademark verification required for VMC issuance, ensuring a seamless process.
With our group company, GlobalSign—a trusted global Certificate Authority—serving as the Root CA, we deliver a seamless BIMI experience. This direct collaboration guarantees stable and consistent logo display across various email clients, providing you with peace of mind.
We also offer solutions to address brand infringement and cybersecurity risks. Our services include:
Brand Abuse Monitoring
Site Takedown Services
Vulnerability Assessments
Our experienced staff design solutions tailored to each company’s challenges. We serve around 2,000 clients, primarily large enterprises, and excel at providing customized problem‑solving.
Here are the answers to your questions about getting a VMC, from preparing your trademark and logo file to gathering the required documents (Japanese only).
The GMO Anti‑Spoofing Seal is a powerful tool to protect customers from phishing and spoofing sites and an essential element of brand protection.
