BIMI and DMARC enforcement: what email teams need to fix

TL;DR: BIMI depends on DMARC enforcement, yet Red Sift says only about 7% of organizations have DMARC fully locked down at quarantine or reject, leaving roughly 93% of domains open to spoofing through misaligned or incomplete authentication. The governance gap is not logo design but control alignment: sender authentication, policy enforcement, and lifecycle management must precede branding.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Webinar recap: Building up to BIMI with Mailgun and Red Sift”.

By the numbers:

• Only about 7% of organizations have DMARC fully locked down at quarantine or reject.
• Roughly 93% of domains remain open to anyone who wants to send email pretending to be them.
• Red Sift's research found up to a 44% increase in brand recall with a visible logo.

Key questions

Q: How should security teams move DMARC from monitoring to enforcement without breaking legitimate mail?

A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one.

Q: Why does visible branding in email depend on authentication rather than design?

A: Mailbox providers and recipients trust the domain history behind the message, not the logo alone.

Q: What are the signs that email identity controls are not ready for BIMI?

A: The main warning signs are inconsistent sending domains, unmanaged third-party mail streams, weak DMARC enforcement, and uncertain logo ownership.

Practitioner guidance

• Enforce DMARC at quarantine or reject Move high-value domains from p=none to p=quarantine and then p=reject after validating all legitimate sending sources, including subdomains and third-party mail services.
• Inventory every authorised sender Build and maintain a complete list of systems, vendors and departments that send mail on behalf of the domain, then remove stale SPF entries and unknown senders.
• Align DKIM with your own domain Make sure each sender signs with the organisation's domain rather than a provider domain, and rotate keys on a schedule if the platform does not automate rotation.

Bottom line: BIMI is only available once email authentication has moved from observation to enforcement, which makes DMARC policy the real gate.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →