FOLD Documentation
Early access
Sender authenticity

Brand logos (BIMI)

When FOLD shows a sender's brand logo, where the logo comes from, and which network request it causes.

Some senders publish a brand logo through BIMI and back it with a mark certificate. FOLD shows such a logo only when every check below succeeds. If any step fails, you see no logo and no warning.

Conditions

  1. Clean authentication. DMARC passed for the sender’s domain, aligned with the From address, and no other check raised a warning. This relies on your server’s results as described under DKIM, SPF and DMARC.
  2. Enforcing policy. FOLD reads the sender’s published DMARC record itself. The policy must be p=quarantine or p=reject; p=none never qualifies.
  3. BIMI record. The domain publishes a BIMI record in DNS with a certificate address (a=) over HTTPS. A BIMI-Selector header in the message may choose a different record.
  4. Mark certificate. The certificate chain must lead to one of the BIMI root authorities bundled with FOLD: DigiCert Verified Mark Root CA, Entrust Verified Mark Root VMCR1, Sectigo Public Email Protection Root E46 or R46. The certificates your system trusts for websites are not accepted. FOLD accepts Verified Mark Certificates and Common Mark Certificates.
  5. Logo. FOLD takes the logo from the certificate, checks it against the hash in the certificate and cleans the SVG. A separate logo address in the BIMI record is not used.

Where the logo appears

  • Next to the sender in the reader, as a chip with the brand name.
  • In the message list, in place of the sender’s initials.
  • In the security inspector as Brand, followed by the authority that issued the certificate.

The SVG is turned into an image once, in a view without scripts and without network access, and kept on your device.

Limits

FOLD does not check whether a mark certificate has been revoked (no OCSP or CRL). A certificate stays accepted until it expires or fails the other checks.

There is no setting to turn brand logos off yet.

Privacy

Fetching the certificate is a network request to the server named in the sender’s BIMI record, usually run by the sender or its certificate provider. That server learns your IP address and the time of the request. It happens once per message, when FOLD first downloads the full message: when you open it, or when FOLD loads the next message in advance. FOLD only makes this request after the DMARC conditions above are met.

The request uses HTTPS only, follows no redirects, stops after 10 seconds or 64 KB, and sends no cookies. The DNS lookups for the DMARC and BIMI records go to your device’s resolver.