Entrust launches Verified Mark Certificates to support BIMI email authentication standard

Identity and payments provider Entrust is backing stronger email authentication with the launch of new Verified Mark Certificates (VMCs) designed to make it easier for organisations to authenticate their emails and fight back against phishing or spoofing.

The Brand Indicators for Message Identification (BIMI) authentication standard has been swiftly adopted across industries and supported by the likes of Google.

BIMI standardises the transmission and use of brand logos in emails, enabling wider email authentication adoption and providing a stronger customer experience.

BIMI aims to curb the proliferation of business email compromise and phishing scams, which use spoofed email addresses that look like they are from an official organisation. These scams can lead to identity and data theft from those who are tricked by the scams.

According to Entrust, BIMI enables organisations to fully authenticate their emails with help from participating email providers such as Gmail. These providers can 'see' registered brand logos from BIMI users in their emails.

BIMI also provides Domain-based Message Authentication, Reporting - Conformance (DMARC), which enables a more immersive customer experience via email, Entrust states.

"By encouraging the deployment of DMARC and promoting its adoption, BIMI benefits the whole email ecosystem to promote strong sender authentication.

BIMI also requires a Verified Mark Certificate from an authorised Mark Verifying Authority. Verified Mark Certificates are digital certificates that enable companies to display a verified logo alongside their outgoing emails. Certificates are valid for one year.

Organisations must:

1. Submit their registered trademark logo for verification. The logo must be registered with an approved trademark office so Entrust can validate ownership before issuing a VMC. So far, there are approved trademark offices in Australia, Japan, Spain, Germany, the United Kingdom, European Union, Canada, and the United States.

2. Prove that their sending domain enforces Domain Message and Conformance Reporting (DMARC) standards. To qualify for a VMC, a DMARC record with "p=quarantine" or "p=reject" is required.

3. High assurance validation.

Entrust vice president of strategy and business development, Chris Bailey, says that Entrust is proud to support BIMI as the new standard for strong email authentication, and it's great that Gmail has come on board.

"We have been collaborating with the BIMI working group for over four years, and are committed to delivering verified brand indicators in email as an important benefit to brands and their customers.

"We expect other email providers to add their support for VMCs in the coming months."