Dear all, Do anyone from our community have worked around with BIMI? I tried to implement it for one of our client in healthcare industry (as they needed more secure and branded mail) I have created and implemented BIMI without VMC certificate. (Because of Hight Costs Associated with VMC certific…

[image] ampliads: VMC certificate. This sounds like another iteration of the EV certificate, whose value has long been debunked. The funny thing is that it's the browser vendors--including Google and Apple--that have greatly devalued EV certs for websites (i.e., you don't get the company nam…

[image] ampliads: they needed more secure and branded mail Those are two things. Email security can be maintained using DANE/DNSSEC/DKIM/DMARC/SPF. Why? are they being required? IMHO, "email branding" is a waste of time - typical users will never see the EHLO/HELO names used nor rely …

I imagine a "simple hack" that, once anyone has a working BIMI enabled domain, they can then change the image file to whatever they want. All subsequent emails will show that new image. Who validates the current image is directly related to the sending domain? What a joke!

[image] rg305: Who validates the current image is directly related to the sending domain? It kind of looks like the image itself is somehow referenced in the cert: dan@Dan-MBP-2019  ~  step certificate inspect eharmony.pem Certificate: Data: Version: 3 (0x2) Serial Numb…

OK, so... the image is manually validated by the CA?

Why not? Again, it looks like EV certs warmed over. But I admit I'm only guessing at the purpose of the 1.3.6.1.5.5.7.1.12 field in this cert.

[image] danb35: image/svg+xml Hacking Hacker Noon: Cross-Site Scripting attacks via crafted SVG images | by Ax Sharma | AxDB | Medium Aside from that, the XML can be a link to a picture contained some other file. So, the cert doesn't have to change to change the picture - LOL

[image] rg305: So, the cert doesn't have to change to change the picture - LOL It does, because the logo itself is embedded in the cert. The contents of the 1.3.6.1.5.5.7.1.12 field include a base64-encoded, gzip'd .svg file. The contents of that file are: <?xml version="1.0" encoding="utf…

I still stand on: Why use XML at all? Why insist on an SVG file? Why insist on GZIP? Each of which leaves room for error/exploit. That's too much risk for me - I rather like to sleep at night, I'm out!

Brand Indicators for Message Identification (BIMI) and VMC Implementation

Feature Requests

mcpherrinm October 21, 2023, 7:44pm 3

Because of the manual verification required for VMC, Let’s Encrypt cannot implement it. I suspect there will never be a free or low cost option.

Topic		Replies	Views
CMC and VMC Certificates? Feature Requests	9	880	February 10, 2026
Verified Mark Certificates Feature Requests	9	24984	May 31, 2022
Brand Indicates for Message Identification, CMC support Feature Requests	5	488	August 18, 2025
BIMI - Brand Indicators for Message and VMC Feature Requests	8	2456	March 30, 2024
Requested s/Mime support Feature Requests	54	18562	September 22, 2022

Brand Indicators for Message Identification (BIMI) and VMC Implementation

Related topics