SPF, DKIM, and DMARC stop someone else sending email that looks like it came from your domain. BIMI puts your verified logo next to that email once DMARC is properly enforced. Together, they are the difference between a domain that’s easy to spoof and one that isn’t, and most UK businesses still have at least one of the four missing or misconfigured.
None of this is new technology. What has changed is urgency: Google and Yahoo’s bulk sender rules, live since February 2024 and enforced more strictly through 2025 and 2026, have pushed authentication from a good idea into something a growing number of businesses actively need to get right.
SPF, DKIM, and DMARC each stop a different kind of email spoofing
Each of these three records does a specific job, and understanding which one covers which problem is where most confusion starts.
SPF authorises which servers can send email for your domain
Sender Policy Framework lists, in a DNS record, exactly which mail servers are allowed to send emails claiming to be from your domain. A receiving mail server checks the sending server against that list. If it isn’t there, the message fails SPF. The most common misconfiguration is forgetting to add a third-party service, a CRM, a marketing platform, a helpdesk tool, to the SPF record when it starts sending mail on the business’s behalf.
DKIM adds a digital signature that proves the message wasn’t altered
DomainKeys Identified Mail signs outgoing email with a private key, and the receiving server checks that signature against a public key published in DNS. This confirms both that the message genuinely came from an authorised sender and that its content wasn’t changed in transit. A mismatched or expired DKIM key is the most common failure, usually after a mail platform change that nobody updated the DNS record for.
DMARC tells receiving servers what to do when SPF or DKIM fails
Domain-based Message Authentication, Reporting, and Conformance ties SPF and DKIM together and instructs receiving servers what to do with a message that fails either check: monitor it, quarantine it, or reject it outright. This year saw DMARC formally elevated under the IETF’s DMARCbis update, published in May 2026, replacing the original 2015 standard, though this doesn’t change what a business setting DMARC up for the first time actually needs to do.
BIMI puts your verified logo in the inbox once DMARC is enforced
BIMI, Brand Indicators for Message Identification, displays your logo next to authenticated emails in supporting inboxes. It sits on top of the other three records rather than replacing any of them, and it will not work at all until DMARC is set to enforce, not just monitor.
DMARC has to be enforcing, not just watching, before BIMI does anything
A DMARC policy of monitor only, written as p=none in the DNS record, tells receiving servers to report on failures without acting on them. BIMI requires enforcement, p=quarantine or p=reject, applied to all or nearly all outbound mail. Publishing a BIMI record before reaching that stage simply won’t display a logo anywhere.
A certificate is required to actually show the logo in most inboxes
Gmail requires a certificate, either a Verified Mark Certificate tied to a registered trademark, or a Common Mark Certificate, a lower-barrier alternative Gmail began accepting more recently for businesses without a registered mark. Yahoo is more permissive and can sometimes display a logo without a certificate at all, provided DMARC is enforced and sender reputation is solid. Apple Mail requires a Verified Mark Certificate specifically. Microsoft Outlook and Exchange Online do not support BIMI at all, so a business whose clients are heavily on Outlook won’t see the same payoff there that it will in Gmail or Apple Mail.
| Record | What it does | What it stops | Where it lives |
|---|---|---|---|
| SPF | Authorises sending servers for your domain | Servers not on the list sending as you | DNS TXT record |
| DKIM | Signs outgoing mail with a verifiable key | Message tampering and unauthorised signing | DNS TXT record |
| DMARC | Tells servers what to do when SPF or DKIM fail | Spoofed mail reaching the inbox unchallenged | DNS TXT record |
| BIMI | Displays your verified logo in supporting inboxes | Nothing on its own; depends on DMARC enforcement | DNS TXT record plus certificate |
Most 70 to 150 person agencies fall well under Google and Yahoo’s 5,000-emails-a-day bulk sender threshold, so the strict enforcement rules technically don’t apply. Authentication is still worth setting up properly regardless of volume, because an unauthenticated domain is simply easier to spoof, and inbox providers increasingly favour authenticated senders even outside the bulk sender rules.
If email deliverability or brand spoofing is a live concern for your business, our IT Strategy team can help you plan the rollout properly rather than rushing straight to BIMI.
Set these up in order: SPF and DKIM first, then DMARC, then BIMI
Sequencing matters here more than almost anywhere else in email security. Doing this in the wrong order causes real mail to bounce.
- Publish SPF for every service that sends mail on your domain’s behalf
- Enable DKIM signing and confirm the public key resolves correctly in DNS
- Publish DMARC at p=none first, and review the reports for at least two to four weeks before changing anything
- Move DMARC to p=quarantine, then p=reject, once the reports show no legitimate mail failing
- Apply for a BIMI certificate and publish the BIMI record only once DMARC is fully enforcing
Skipping straight to enforcement without the monitoring period is the most common way businesses accidentally block their own legitimate email. IT should own the technical sequencing above, while marketing should own the logo asset and brand certificate application once DMARC reaches enforcement, since that’s where BIMI genuinely becomes a marketing concern rather than a technical one.
What this means for your business
SPF, DKIM, and DMARC are the foundation, and they matter regardless of whether your business sends bulk email or not. BIMI is the payoff once that foundation is solid, not a shortcut to skip ahead to. Get the sequencing right, and each stage builds cleanly on the one before it, rather than causing a scramble when legitimate mail starts bouncing.
Related articles
- The MFA and email security shortlist for Microsoft 365 and Google Workspace: What actually works in a mixed environment
- What good IT support actually looks like: A no-nonsense guide for UK businesses choosing or reviewing an MSP
FAQs
Do we have to set up DMARC if we don't send bulk email?
Not under Google and Yahoo’s strict enforcement rules, which apply above 5,000 emails a day. It’s still worth doing regardless of volume, since an unauthenticated domain is easier to spoof and inbox providers increasingly favour authenticated senders across the board.
What is the difference between SPF, DKIM, and DMARC?
SPF authorises which servers can send email for your domain. DKIM adds a digital signature proving the message wasn’t altered in transit. DMARC ties both together and tells receiving servers what to do when either check fails, from monitoring only through to rejecting the message outright.
Why isn't our logo showing up next to our emails in Gmail?
Gmail requires DMARC set to enforce, either quarantine or reject, applied to all or nearly all outbound mail, plus a Verified Mark Certificate or Common Mark Certificate. If DMARC is still in monitor-only mode, or no certificate has been issued, the logo won’t display regardless of the BIMI record.
Does BIMI work in Microsoft Outlook?
No. Outlook and Exchange Online do not support BIMI at all, regardless of how well authentication is set up. Gmail, Apple Mail, and Yahoo support it, so the benefit depends heavily on where your recipients’ email actually lives.
