CYBERSECURITY

Securing your email—by understanding DMARC andBIMI
These two email protocols help authenticate legitimate communications andprevent delivery of potentially malicious messages.
Due to the prevalence of business email compromise (BEC), phishing and spoofing, email
remains one of the primary vectors for cyber crime. Many criminals are adept at creating
messages that appear to come from legitimate email domains, which can trick recipients
into thinking that they’re opening an email from someone they know.
Domain-based Message Authentication, Reporting and Conformance, or DMARC, is a
protocol designed to give email administrators greater visibility into who is using their email domains while
simultaneously preventing potentially malicious emails from reaching the recipient’s inbox.
Brand Indicators for Messaging Identification—BIMI—builds on the foundation of DMARC and enables an
independently verified logo—which represents the domain owner’s company or brand to be displayed in theconsumer’s inbox. BIMI can help protect senders’ domains by making legitimate emails easier to recognize,
while also promoting a brand.
Below are essential details about how DMARC and BIMI work, and how they may create more transparency
in email systems while mitigating cyber crime.

How DMARC works
DMARC controls can improve the effectiveness of email
filters by providing a clear path for determining an email’slegitimacy.
DMARC relies on two underlying email authentication methods:
DKIM (Domain Keys Identified Email) and SPF (Sender PolicyFramework). Email authentication systems should
implement DKIM and SPF for DMARC to work efficiently.
An email system will check SPF and DKIM on every piece ofemail that appears to originate from an organization’s domain. Amessage that fails SPF and DKIM can be quarantined orrejected based on the domain’s DMARC policy.

A DMARC record is published in the Domain Name
System (DNS). Domain owners can then receive
automated reports on messages attempting toleverage the domain. This provides visibility
into exactly who is sending emails—possiblyincluding legitimate senders whose emails may
have been rejected by DMARC due to improper
configuration. It also can help detect illegitimateemails.
Starting in February 2024, it is reported that major
Email Service Providers1 will begin requiring
DMARC compliance for all bulk email senders.

Pa g e 1

CYBERSECURITY - DMARC AND BIMIDMARC benefits and challenges
Benefits
DMARC can help reduce the number of spoofingand phishing emails that avoid detection, thereby
reducing the direct and indirect losses related to cybercrime.
Email recipients are in a better position to trust
emails that come from an organization that applies
DMARC, DKIM and SPF authentication.
DMARC can help organizations detect legitimate
emails that are misconfigured or experiencing
authentication issues, as well as emails thatillegitimately use their domains.
The protocol helps establish a consistent policy
for legitimizing email and can enhance thetrustworthiness of communication between
partner organizations.

Challenges

A domain’s DMARC policy does not protect against spoofing orphishing emails that do not directly replicate a domain name.
If an email’s address varies by a single character- but still looks
very much like a known sender’s address - DMARC policy has
no means to flag it. For example:•DMARC reporting will register every email sent from thedomain xycorporation.org.

•DMARC reporting will NOT register email sent fromxyZcorporation.org (unless you also own that domainand apply DMARC).

While DMARC can instruct recipients to quarantine orreject email that from a domain that is not authenticated,
implementing and monitoring DMARC requires sometechnical knowledge. Some organizations may need outside
expertise to adopt DMARC or properly scale the policies
that prevent delivery of illegitimate emails. Resources forunderstanding DMARC’s details and implementation process
are available from the National Institute of Standards andTechnology (NIST) and DMARC.org.

What BIMI does
BIMI generates a company-defined, verified andauthenticated logo for every email that is validated by
the DMARC protocol.

BIMI provides an additional layer of email authenticationthat helps build users’ trust in the communications
they receive.

The logo appears next to the email in the recipient’s inboxof participating email providers.

By controlling the use of a distinctive logo, BIMI also
helps increase brand recognition and marketing
effectiveness.

How BIMI works
To use BIMI, email owners must enable DMARC.
The domain owner must set their DMARC policy to“quarantine” or “reject.” With either protocol, anyemail associated with the domain that fails DMARC
authentication will be sent to spam or sent
back as nondelivered mail.
Organizations or brands create and trademark
a logo image that will appear on every legitimate
email associated with their domain.

An independent certification authority
reviews the logo and issues a Verified Mark
Certificate, which acts as evidence that the logo belongs toa specific domain or organization.
When a recipient’s email server receives a message,
it is authenticated by the sender’s DMARC system.
The DNS name server of a DMARC authenticated message
is then inspected for a BIMI record and, if one is found, thesender’s logo will display in the recipient’s inbox.
Pa g e 2

CYBERSECURITY - DMARC AND BIMI

BIMI’s value to cyber
While email domains are often spoofed by cyber criminals, the combinationof DMARC and BIMI makes any legitimate mail from a domain mucheasier to identify and trust.
Since BIMI only operates within strict DMARC policies, it has the added
value of encouraging full DMARC adoption among organizations
that deploy it. Currently, most DMARC users set DMARC at a lower
threshold that does not instruct recipients to quarantine or reject
nonauthenticated messages. This threshold, known as monitor mode, isgood for identifying mail leveraging a domain, but does not prevent ordisrupt the delivery of unauthenticated messages.

While BIMI is often described in terms of its
value to brand recognition and marketing
objectives, many organizations haverecognized its potential contribution
to a higher standard of email security
based on trust logos that are easy to viewand be verified by the company.

To learn more
Information about BIMI implementation, logo verification requirements and issuers, how to generate reports, DMARC andother aspects of this emerging protocol can be found on the website of the BIMI working group: bimigroup.org

https://blog.google/products/gmail/gmail-security-authentication-spam-protection/

1

IMPORTANT INFORMATION
Neither Bank of America nor its affiliates provide information security or information technology (IT) consulting services. This material is provided“as is,“ with no guarantee of completeness, accuracy, timeliness or of the results obtained from the use of this material, and without warrantyof any kind, express or implied, including, but not limited to warranties of performance, quality and fitness for a particular purpose. This material
should be regarded as general information on information security and IT considerations and is not intended to provide specific information
security or IT advice nor is it any substitute for your own independent investigations. If you have questions regarding your particular IT system
or information security concerns, please contact your IT or information security advisor.
“Bank of America” and “BofA Securities” are the marketing names used by the Global Banking and Global Markets divisions of Bank of America
Corporation. Lending, other commercial banking activities, and trading in certain financial instruments are performed globally by banking affiliates
of Bank of America Corporation, including Bank of America, N.A., Member FDIC. Trading in securities and financial instruments, and strategic
advisory, and other investment banking activities, are performed globally by investment banking affiliates of Bank of America Corporation(“Investment Banking Affiliates”), including, in the United States, BofA Securities, Inc. and Merrill Lynch Professional Clearing Corp., both of which
are registered broker-dealers and Members of SIPC, and, in other jurisdictions, by locally registered entities. BofA Securities, Inc. and Merrill Lynch
Professional Clearing Corp. are registered as futures commission merchants with the CFTC are members of the NFA.
Investment products offered by Investment Banking Affiliates:
Are Not FDIC Insured

Are Not Bank Guaranteed

May Lose Value© 2024 Bank of America Corporation. All right reserved. 6318057

Pa g e 3