SPF vs BIMI: What’s the Difference?

SPF and BIMI address different parts of the email trust story. SPF is a technical authentication policy that declares which hosts may send mail for a domain, while BIMI is a branding standard that allows your logo to be displayed in compatible inboxes when authentication and DMARC enforcement are in place.

SPF Overview

• Purpose: Authorize sending hosts and reduce spoofing.
• Mechanism: TXT record listing includes and IPs. Receivers check the envelope sender (return-path) and HELO domain.
• Limitations: Breaks on forwarding; alignment required for DMARC.

BIMI Overview

• Purpose: Display verified brand logos, improving user trust and recognition.
• Prerequisites: DMARC policy enforced (p=quarantine or p=reject), aligned authentication, and a BIMI record pointing to an SVG logo.
• Optional: Some receivers require a Verified Mark Certificate (VMC) to validate logo ownership.

How They Work Together

SPF (and DKIM) provide the authentication needed for DMARC alignment. Once DMARC is enforced, BIMI can be enabled to show your logo. Without DMARC enforcement, BIMI generally won’t display.

Example Records

example.com. IN TXT "v=spf1 include:spf.protection.outlook.com -all"
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

Best Practices

• Implement SPF and DKIM, then roll out DMARC from p=none to enforcement.
• Use a clean, valid SVG for BIMI and host it over HTTPS.
• Maintain consistent sender identity and avoid sudden domain changes.

Common Issues

• BIMI logo not showing: DMARC may not be enforced or the receiver requires VMC.
• SPF permerror: Too many DNS lookups; reduce includes or flatten.
• Forwarding path failures: Rely on DKIM for alignment and consider ARC in complex flows.

Think of SPF as foundational authentication and BIMI as a visual trust signal layered on top of DMARC enforcement.