The Little Logo Is Not a Character Reference: Auditing BIMI in 2026

There is a quiet psychological trick happening in your inbox. A small, familiar logo appears beside a message and your shoulders drop half an inch. The brand looks right, the colours are right, and some part of your brain files the message under 'probably fine' before you have read the subject line.

That reflex is exactly what BIMI was built to reward — and exactly what makes it worth auditing. As more UK brands publish Brand Indicators for Message Identification records in 2026, the inbox logo is turning into a visual shorthand for legitimacy. The trouble is that shorthand is narrower than it looks.

What BIMI actually certifies

BIMI lets a domain say: here is my logo, please display it next to my mail. To get that logo shown in Gmail and Apple Mail, a sender generally needs DMARC at enforcement and a Verified Mark Certificate, or VMC, from an authorised certificate authority. The VMC ties the logo to a registered trademark and to the domain that publishes the BIMI record.

That is a meaningful statement about branding and domain policy. It is not a background check on the person pressing send. Think of it as a name badge, not a bouncer. A name badge confirms that someone printed a badge with your company name on it after checking some paperwork. It does not stop a stranger from wearing a similar lanyard.

The three-legged stool

A working BIMI setup usually rests on three pieces:

• DMARC enforcement. The domain should publish a policy at p=reject or p=quarantine, ideally with pct=100 and proper alignment. A relaxed DMARC record with a low percentage is not the same thing.
• The BIMI record itself. Look at default._bimi.example.co.uk. A typical record contains v=BIMI1, an l= URL for the logo, and an a= URL for the VMC.
• A valid VMC. The certificate should be current, issued for the domain in question, and tied to the logo you are actually displaying. If the certificate has expired or the logo hash does not match, the trust signal is weaker than it appears.

Some clients will display a self-asserted SVG logo without a VMC. That is useful for experimentation, but it is also where confusion creeps in. A logo can appear in one inbox and not another, or appear because of a contact photo rather than BIMI. The display is not a universal seal.

Where the trust stops

The important limit is this: BIMI says something about the domain that published the record. It does not say the message is safe, the invoice is real, or the sender is who the display name claims.

Lookalike domains cannot borrow your VMC on a different domain unless they obtain their own certificate, but they can still use a similar logo as a profile image in clients that do not require BIMI. They can use display names, hyphenated domains, extra words, and unfamiliar top-level domains. They can rely on the fact that many people check the logo and not the address.

Forwarded mail, mailing lists, and some mobile clients also blur the picture. The logo is rendered by the receiving client based on the domain, not carried around inside the message like a wax seal.

Auditing your own setup before someone else does

If you run a UK brand, the audit starts at home. These checks are dull, quick, and worth doing before a lookalike domain makes your logo look like a warning sign.

1. Check your DMARC record. Run dig TXT _dmarc.example.co.uk and confirm you are at enforcement, not just monitoring. Look at p=, sp=, pct=, and alignment.
2. Check the BIMI record. Run dig TXT default._bimi.example.co.uk. Confirm the l= and a= URLs resolve over HTTPS and point to the right assets.
3. Validate the VMC. Open the a= URL, inspect the certificate chain, check the subject and SANs, confirm expiry, and verify that the logo hash matches the file you publish. openssl is your friend here.
4. Check the logo asset. Use SVG Tiny PS, keep it square, remove scripts and external references, and host it on a stable HTTPS URL. Do not swap the file behind the same URL without updating the certificate.
5. Read your DMARC aggregate reports. Unauthorised senders show up there before they show up in complaints. If a third-party platform is sending on your behalf, get it aligned rather than ignored.
6. Watch the doppelgangers. Monitor .uk and .co.uk variants of your domain, plus common typos and hyphenated forms. Registrar alerts and certificate transparency logs are cheap early warnings.
7. Keep the trademark paperwork warm. A VMC depends on a registered trademark. If your UK IPO registration is pending or limited to one class, check that the certificate still covers what you think it covers.

Spotting a borrowed logo in the wild

For the rest of us, the practical checks are simpler. Expand the sender details and read the actual domain, not the display name. On mobile, tap the sender name to reveal the address. Look for small mismatches: a hyphen, an extra word, a different TLD, or a string of characters that does not look like English. If a familiar logo appears beside an unfamiliar domain, treat that as a reason to slow down, not a reason to relax.

It also helps to remember that a logo in a client without BIMI may simply be a contact photo or a favicon. Do not read more into it than the client is actually promising.

Suspicious UK phishing can go to the NCSC's Suspicious Email Reporting Service at [email protected]. Forward the message, then delete it.

The quiet arms race

As BIMI adoption grows, the inbox logo will become more meaningful and more tempting to imitate. The answer is not to ignore logos. It is to treat them as one signal among many. Audit your records, keep your certificate current, watch for doppelgangers, and remember that a tick is a starting point, not a verdict.