Future of Email Authentication
November 2022
Hackim Farrell, Dir Product Management© 2020 Proofpoint. All rights reserved

Email Authentication Standards
SPF

Authorizes specific servers that can send email on your behalf

DKIM

Allows the recipient to verify that the email was indeed sent by the domain owner

DMARC

ARC

BIMI

Defends against attackers attempting to impersonate email from your domain

Preserve email authentication results and verify the identity or email intermediaries

Enables the use of brand logos within supporting clients© 2020 Proofpoint. All rights reserved2ARC© 2020 Proofpoint. All rights reserved

What is ARC?
Authenticated Received Chaining (ARC) is a specification designed to address theproblem of DMARC verification being broken by an email intermediary sender.

Problem: Intermediaries can break DMARC verification whenhandling the message and re-sending it
What are intermediaries?
• Systems that receive an email, process it, then re-send it to final recipients as if it came directly from the originalsender.
• Example: Email from O365 to Proofpoint(scan for malicious content) delivers to recipient

Solution: Intermediaries can can assert their authentication
results when received for evaluation by subsequent
receivers© 2020 Proofpoint. All rights reserved4

ARC: How It Works
The SPF and/or DKIM check fails and also results in the DMARC validation fail

The ARC signing preserves the previous successful SPF and DKIM checks, resulting in delivery© 2020 Proofpoint. All rights reserved5ARC: Who Should be Interested• To protect your domain against spam and phishing you set DMARC with asecurity policy of “reject”• To improve the legitimacy and compliance of your emails• The domain uses intermediaries to scan and protect your incoming email
from malicious content and they perform things such as URL-rewriting© 2020 Proofpoint. All rights reserved6ARC: ARC Seal mailflow
Published
SPF, DKIM,DMARCDNS
ARC seal by
3rd Party

Admin Accepts 3rdparty ARC seal

From: achme.com
To: mebank.com

DNS Check

DKIM ARC

IP 102.23.55.50
On Prem

Sender
IP 102.23.55.50

Content Modified i.e. URLrewriting

IP 255.10.255.01
3rd Party

SPF Fail for 255.10.255.01
DKIM Fail – Content
modified at 3rd party
ARC Pass and Accepted
DMARC FailSpoof PassInbox

BIMI© 2020 Proofpoint. All rights reserved

What is BIMI?
Brand Indicators for Message Identification or BIMI (pronounced: Bih-mee) is an emerging email specification that enables the use of brandcontrolled logos within supporting email clients. BIMI leverages the work an organization has put into deploying DMARC protection, bybringing brand logos to the customer’s inbox. For the brand’s logo to be displayed, the email must pass DMARC authentication checks,
ensuring that the organization’s domain has not been impersonated.
Standard Mode Examples:Dark Mode Examples:

Author Controlled Area
Controlled by Gmail
Logo Sourced from BIMI

© 2020 Proofpoint. All rights reserved* These examples use a transparent background.

9

BIMI: Current + Planned Adoption
Currently Supporting BIMI

© 2020 Proofpoint. All rights reserved

Planning to Support BIMI

10

BIMI: What Mailbox Providers Support It?
Dependent upon Reputation"Self-Asserted" BIMI

"Verified" BIMI

© 2021 Proofpoint. All rights reserved

BIMI: Who Should be Interested• All domains that have a consumer-recognizable logo should be interested indeploying BIMI.
• Mailbox providers focused on serving end consumers. As such, early adoptionof BIMI is likely limited to domains that send large volumes of email toconsumers.

• Enterprise domains that focus primarily on sending business-to-business email
are unlikely to be interested in early adoption of BIMI.
• Customers that have already published DMARC “quarantine” or “reject”
policies, or intend to.

© 2020 Proofpoint. All rights reserved12

BIMI: Terminology• Brand Indicators for Message Identification (BIMI) – Specifications and processes that define
how authorized images can be associated with a domain, verified as legitimate by mailbox receivers, anddisplayed by mail user agents.

• Certificate Authority (CA) – The only organizations currently recognized to act as an MVA and issue
VMCs. Currently limited to Digicert and Entrust• Mark Verifying Authority (MVA) – The entity that is recognized to issue VMCs. While only select CAs
are currently authorized to issue VMCs, the BIMI specification itself doesn’t require that an MVA be a CA(e.g. Proofpoint may be authorized to act as an MVA for our customers).

• Verified Mark Certificate (VMC) – The document issued by the MVA indicating that the profferedimage is authorized for use with BIMI. The VMC is currently defined as a profile of a typical Extended
Validation (EV) X.509 Cert stored in Privacy Enhanced Mail (PEM) format.

• Scalable Vector Graphic (SVG) – A graphic format represented by vectors and stored as an XMLdocument.

• X.509 Certificate (Cert) – A standard format for presenting public key certificates that are used in manyInternet protocols (e.g. TLS, HTTPS). When issued by a recognized CA, they act as a trust anchor. In
most cases they are invisible to the end user, but in some cases they provide visual trust indicators (e.g.
EV Certs).
© 2020 Proofpoint. All rights reserved

13

BIMI: Operational Flow
HTTPS Server

VMC
2aMCAReceiving
MUA

2b
10

BIMI
Record12BrandCompany

BIMI Logo

DKIM
PublicKey

97Cached
BIMI
Logo

SPF
Record8DMARC
Policy35Receiving
6MTA

Brand
DNS
4Sending
MTA© 2020 Proofpoint. All rights reserved

1. Brand Company applies for a VMC from the MCA.
2. Brand Company places a BIMI Record in theBrand DNS, pointing to thea. VMC andb. BIMI Logo published to an HTTPS server.
3. Brand Company triggers email to be sent by its own
Sending MTA, or via a vendor sending on theirbehalf.
4. Sending MTA authenticates and sends the email onbehalf of the Brand Company (optionally identifying
the specific BIMI Logo to be used).
5. Receiving MTA checks the Brand DNS for the SPF
Record, DKIM Public Key, DMARC Policy andBIMI Record.
6. Receiving MTA verifies the authenticity of the emailusing SPF, DKIM, DMARC.
7. If the email is verified, Receiving MTA retrieves andverifies the VMC and retrieves the BIMI Logo.
8. Receiving MTA stores the BIMI Logo in a local
cache to be served to the Receiving MUA.
9. Receiving MTA passes the message along to theReceiving MUA, indicating that the message
authenticated and can display the referenced BIMILogo.
10. Receiving MUA retrieves and displays the Cached
BIMI Logo.
14

BIMI: VMC Requirements• VMCs are offered by two MVAs: Digicert & Entrust– Accepted Jurisdictions: US, Canada, EU, UK, Germany, Japan, Australia, and Spain• The logo must be a registered “Design Mark” (not a “Word Mark”).

• The logo must be saved in a specific SVG Portable/Secure format.
• The SVG logo and VMC must be served from a secure web server via HTTPS.
• The customer must publish a BIMI TXT record at their sending domain thatpoint to the SVG logo and VMC document.
• The FQDN sending the email, the organizational domain, and all subdomains
must be covered by a DMARC “reject” (or 100% "quarantine) policy.

© 2020 Proofpoint. All rights reserved

15

BIMI: Misconceptions• Myth: BIMI is a security technology.
• Truth: BIMI is a marketing tool designed to– provide the brand control over the logo
being displayed with email sent by their
domains,– improve brand engagement within themailbox, and– drive stronger email authentication.

© 2020 Proofpoint. All rights reserved

16BIMI: Misconceptions• Myth: Users make decisions whether to trust
an email based on visual indicators.
• Truth: Users do not change their behavior
based on visual trust indicators.

© 2020 Proofpoint. All rights reserved

17BIMI: Misconceptions• Myth: BIMI logo once published willautomatically be displayed.
• Truth: BIMI logo will only be displayed if– the mail client supports BIMI, and– the sender has sufficient positive
reputation for the client to decide todisplay the logo.

© 2020 Proofpoint. All rights reserved

18Inbound BIMI Validation (Cloudmark Support Example)
Brand Indicators for Message Identification (BIMI)• Benefits• Enables brands to control the logos to be

displayed in association with authenticated email.
• Provides opportunity for brand engagement within theinbox.
• Helps brands drive adoption of secure authentication
protocols.

© 2021 Proofpoint. All rights reserved | Proofpoint, Inc. - Confidential and Proprietary

ReleasedInbound BIMI Validation (Cloudmark Support Example)

Released

Brand Indicators for Message Identification (BIMI)• How it Works• Leverages SPF, DKIM, and DMARC for sender validation as part of the MTA workflow• If DMARC passes, BIMI records are validated• If BIMI validation passes, authentication headers updated• The mailbox provider or email client can determine if the sender has high enough reputation todisplay logo.

© 2021 Proofpoint. All rights reserved | Proofpoint, Inc. - Confidential and Proprietary© 2020 Proofpoint. All rights reserved