AVP adds sender identity control to BIMI inbox branding

At a glance

What this is: Valimail's article explains how the BIMI AVP tag lets domain owners signal whether inboxes should show a brand logo or an individual sender avatar.

Why it matters: This matters because email identity cues affect impersonation resistance, brand trust, and governance over how authenticated messages are represented across mailbox providers.

Context

BIMI is a mailbox presentation control layered on top of authenticated email, not a substitute for DMARC, SPF, or DKIM. The operational gap appears when organisations assume a logo in the inbox is the whole control, while mailbox providers may also expose a sender avatar preference that changes what recipients see.

The AVP tag exists to let the domain owner express that visual preference in the BIMI DNS record. That makes it relevant to identity governance because the record is now carrying both authentication intent and presentation intent, especially for organisations that care about brand consistency or sender recognition.

Key questions

Q: How should teams decide between brand and personal sender identity in BIMI?

A: Decide based on the trust model you want recipients to see. Brand identity fits consumer-facing, high-volume, or regulated communications where recognisable domain ownership matters. Personal identity fits relationship-led communications where the sender's individual role is the trust anchor. Make the choice explicit in policy so mailbox behaviour does not drift by default.

Q: What breaks when organisations try to use BIMI before their sending domains are ready for DMARC enforcement?

A: The main failure is trust mismatch. If a domain has not reached quarantine or reject, BIMI cannot provide the intended anti-spoofing assurance, and mailbox providers may refuse to display the logo. Teams also risk confusing users by presenting brand imagery without a reliable authentication baseline. The result is weak adoption, poor deliverability confidence, and a security control that looks complete but is not.

Q: Why do mailbox providers matter so much for BIMI AVP?

A: Because AVP is a preference signal, not a universal display command. If a provider does not support the tag, your DNS record still documents intent but may not change what recipients see. Governance therefore needs visibility into provider support, not just record syntax.

Q: What should identity teams govern after publishing a BIMI record?

A: They should govern who owns the record, which sender classes use brand or personal presentation, how often the preference is reviewed, and whether authentication prerequisites remain enforced. That prevents BIMI from becoming a one-time configuration that ages out of sync with the mail programme.

Technical breakdown

How the AVP tag changes BIMI presentation

AVP, or Avatar Preference, is an optional BIMI record tag that tells a supporting mailbox provider whether to prefer the organisation's brand logo or an individual sender avatar. The record does not force display on every platform, because support is mailbox-provider specific. In practice, AVP sits alongside the BIMI logo reference and any certificate reference, so the domain owner is asserting a preference about presentation, not creating a new authentication layer. The control boundary matters: AVP only influences how a provider chooses between two already-authenticated visual identities. See the Email Authentication for Developers Guide.

Practical implication: Treat AVP as a presentation policy embedded in DNS, not as an email security control that replaces authentication.

Why BIMI still depends on DMARC, SPF, and DKIM

BIMI only works once a domain is already authenticating mail at enforcement. That means DMARC must be set to quarantine or reject, with aligned SPF and or DKIM in place, before mailbox providers can trust the BIMI signal. The AVP tag does not change that prerequisite. It simply adds a preference for what visual identity should appear after authentication succeeds. The governance lesson is straightforward: identity display is downstream of message authentication, so organisations that focus on logos while ignoring alignment and enforcement are managing the symptom, not the control plane. See the Email Identity and BEC Guide.

Practical implication: Verify DMARC enforcement and aligned authentication before you spend time on BIMI presentation choices.

Brand versus personal avatar is an identity governance decision

Choosing avp=brand or avp=personal is not just a branding preference. It is a decision about which identity should be foregrounded in the inbox when the message is valid and the provider supports the tag. Consumer-facing organisations usually want the domain brand to dominate, while advisory, education, and relationship-led businesses may prefer the human sender to remain visible. That choice affects user recognition, attribution, and the consistency of email trust signals across the programme. The stronger the reliance on human relationships, the more important it becomes to align presentation rules with sender governance. See the Workforce Identity Security Guide.

Practical implication: Define which emails should present a brand identity and which should present a human identity before publishing BIMI records.

NHI Mgmt Group analysis

AVP turns BIMI from a logo-only topic into an identity presentation policy. Once domain owners can signal brand or personal preference in DNS, inbox branding becomes part of the identity governance stack rather than a cosmetic add-on. The practical issue is consistency: different mailbox providers may honour the same record differently, so the organisation must define what identity should be shown when a message is authenticated. Practitioners should treat this as a policy decision, not a design flourish.

The real control boundary is still message authentication, not visual choice. AVP only has meaning after DMARC, SPF, and DKIM have already established that the message is legitimate. That means teams that publish BIMI without enforcing authentication are solving for appearance before trust. The programme implication is that visual identity settings should be governed only after the mail authentication baseline is stable.

Brand and personal identity can coexist, but they serve different trust models. A brand logo optimises recognisability at scale, while a personal avatar supports relationship-based communication. Those are different governance objectives, and the same organisation may need both depending on the sender role and audience. The key is to decide intentionally which trust signal should lead, rather than allowing mailbox defaults to define your identity presentation.

BIMI operational maturity now includes preference management, not just record publication. Publishing AVP early gives the domain owner a durable preference as support expands across mailbox providers. That is a small technical change with a larger governance effect: the organisation has encoded how it wants to be represented before ecosystem behaviour becomes more variable. Practitioners should update BIMI governance to include presentation intent, lifecycle review, and provider support tracking.

Read next: Machine Identity, PKI and Certificate Lifecycle Guide

What this signals

Presentation governance is becoming part of email identity governance. As mailbox providers expand support for BIMI preferences, organisations will need a documented rule for when brand identity should override individual sender identity and when it should not. That decision belongs with the mail and identity teams together, because the inbox is now an identity surface as well as a delivery surface.

AVP is a low-friction change with high policy value. A DNS-only preference can be published before provider support becomes universal, which means mature teams should encode their intent now rather than wait for ecosystem convergence. The practical signal is that email identity controls are shifting from static configuration to governed representation policy.

Inbox trust will increasingly depend on whether presentation matches the sender relationship. For some programmes, the brand is the trust anchor; for others, the named person is. The organisations that get this right will define presentation rules alongside authentication rules, rather than treating visual identity as an afterthought.

For practitioners

• Define a BIMI presentation policy Specify when the inbox should show a brand logo and when it should show a personal avatar, based on sender role, audience, and communication purpose.
• Enforce DMARC before relying on AVP Confirm p=quarantine or p=reject is in place, with aligned SPF and DKIM, before publishing AVP in any BIMI record. See the Email Identity and BEC Guide.
• Inventory mailbox-provider support Track which providers honour BIMI and AVP so your DNS record reflects a preference that can actually be consumed by recipients. See the Email Authentication for Developers Guide.
• Review sender identity ownership Check which business units own branded mail, which rely on named senders, and where the same domain mixes both identity styles.

Key takeaways

• BIMI AVP gives organisations a way to govern whether authenticated mail should present a brand identity or a personal sender identity in the inbox.
• The tag does not replace DMARC, SPF, or DKIM, so visual identity settings only make sense after message authentication is already enforced.
• Teams should treat mailbox presentation as a policy choice, because brand consistency, sender recognition, and provider support all shape what recipients actually see.

Related NHI Mgmt Group resources: Email Identity and BEC Guide · Workforce Identity Security Guide · Machine Identity, PKI and Certificate Lifecycle Guide

Key terms

• BIMI: Brand Indicators for Message Identification is a mailbox trust mechanism that displays a verified brand logo next to authenticated email. It depends on strong mail authentication and domain policy, so the visual signal is only as reliable as the sender controls behind it.
• Avatar Preference: Avatar Preference, or AVP, is an optional BIMI tag that tells a mailbox provider whether to prefer a brand logo or an individual sender avatar. It is a presentation preference, not an authentication control, and support depends on the receiving provider's implementation.
• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• Sender Identity: Sender identity is the verified proof that an email domain or sending service was authorised to send a message. It replaces the old assumption that a visible From address is enough. In practice, it depends on authentication records, signing, and policy enforcement rather than user judgment alone.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security operations.