iOS 16 and macOS Ventura Combat Email Spoofing With Support for Verified Brand Logos in Mail App

iOS 16 and macOS Ventura add support for the Brand Indicators for Message Identification (BIMI) standard in the Mail app, helping users to easily verify authenticated emails sent by brands by displaying the brand's logo alongside the email's header.

iOS 16 Digitally Certified Mail
In the Mail app, emails sent by brands with a BIMI record are marked with a "Digitally Certified" label, which is visible after tapping to expand the email's header. Next to the label, a "Learn More" link leads to the following message: "This email was verified as coming from the owner of the logo shown and the domain [example.com.]"

For a brand's logo to be displayed, the sender's domain must pass DMARC authentication checks, according to the BIMI Group website. If the email passes authentication, the Mail app queries the DNS for a corresponding BIMI record.

Based on a tweet shared by software engineer Charlie Fish, it appears that Chase Bank is an example of a brand that has implemented BIMI, with the Chase logo appearing next to an email sent by the bank in the Mail app on iOS 16. BIMI is also supported by Gmail, Yahoo Mail, and Fastmail, according to BIMI Group.


This is just one of several new features added to the Mail app on iOS 16 and macOS Ventura, with others including the ability to unsend an email up to 10 seconds after sending it, scheduled emails, notifications if you forget to include an attachment on an email, support for rich links in emails, improved search functionality, and more.

Related Forum: iOS 16

Popular Stories

iPhone 17 Pro and Air Feature

Two iPhone 17 Pro and iPhone Air Colors Appear to Scratch More Easily

Friday September 19, 2025 10:02 am PDT by
As reported by Bloomberg today, some of the new iPhone 17 Pro and iPhone Air models on display at Apple Stores today are already scratched and scuffed. French blog Consomac also reported on this topic. The scratches appear to be most prominent on models with darker finishes, including the iPhone 17 Pro and Pro Max in Deep Blue, and the iPhone Air in Space Black. Images Credit: Consoma ...
iOS 26

Everything New in iOS 26.1 Beta 1

Monday September 22, 2025 12:44 pm PDT by
Apple released the first beta of iOS 26.1 today, just a week after launching iOS 26. iOS 26.1 mainly adds new languages to Apple Intelligence, but there are a few other features that are worth knowing about. New Apple Intelligence Languages Apple Intelligence is now available in Danish, Dutch, Norwegian, Portuguese (Portugal), Swedish, Turkish, Chinese (Traditional), and Vietnamese. AirPo...
Apple Foldable Thumb

Foldable iPhone Like 'Two Titanium iPhone Airs' Joined at the Hinge

Monday September 22, 2025 2:16 am PDT by
Next year's rumored foldable iPhone will showcase an ultra-thin design resembling "two titanium iPhone Airs side-by-side," according to Bloomberg's Mark Gurman. Writing in the Q&A section of his latest Power On newsletter, Gurman says Apple's first foldable device will be "super thin and a design achievement," combining Apple's thinnest iPhone form factor with cutting-edge folding...
Apple Intelligence General Feature 2

iOS 26.1 Adds New Apple Intelligence Languages and Expands AirPods Live Translation

Monday September 22, 2025 11:15 am PDT by
With iOS 26.1, Apple Intelligence is gaining support for additional languages, including Danish, Dutch, Norwegian, Portuguese (Portugal), Swedish, Turkish, Chinese (Traditional), and Vietnamese. Apple announced plans to expand the languages that can be used with Apple Intelligence last year, and now the added language support is here. Apple Intelligence is now available in the following...
iPhone 17 Pro and Air N1 Feature

Some iPhone 17, iPhone 17 Pro, and iPhone Air Users Experiencing Intermittent Wi-Fi Issue

Monday September 22, 2025 8:44 am PDT by
Apple's latest iPhone models launched on Friday, and some early adopters of the devices are experiencing intermittent Wi-Fi issues. Affected customers say Wi-Fi connectivity periodically cuts out on the iPhone 17, iPhone 17 Pro, iPhone 17 Pro Max, and iPhone Air, with hundreds of comments about the issue posted across the MacRumors Forums, Reddit, and the Apple Support Community over the...
iOS 26

iOS 26.0.1 Coming Soon, Likely With iPhone Air and iPhone 17 Pro Fix

Thursday September 18, 2025 9:17 am PDT by
Apple is preparing to release iOS 26.0.1, according to a private account on X with a proven track record of sharing information about future iOS versions. The update will have a build number of 23A350, or similar, the account said. It is likely that iOS 26.0.1 will fix a camera-related bug on the new iPhone Air and iPhone 17 Pro models. In his iPhone Air review, CNN Underscored's Henry T. ...

Top Rated Comments

mikethemartian Avatar
43 months ago

While I always welcome features that increase security or privacy, I don't think this will make much of a difference because inattentive or ignorant users are easily fooled by logo graphics attached by scammers to messages. Plus from a behavioral perspective, scammers rely on fear and greed emotions. The human fight-or-flight reflex means that red flags such as obviously bogus URLs, awful grammar, bizarre word choice, or a government agency asking for gift cards are all too often ignored or discounted.
Reminds me of the scene in Catch Me If You Can when Abagnale takes the Pan-Am logos off of model planes and placed them on forged checks.
Score: 8 Votes (Like | Disagree)
Corsig Avatar
43 months ago
Waiting for someone to say this isn’t fair for the spoofers
Score: 4 Votes (Like | Disagree)
surfzen21 Avatar
43 months ago
Even if its not perfect, its definitely a step in the right direction. Knowing is on Apple's radar is a good thing.

I get a lot of these fake emails and had to do a double check on at least a few. Domain spoofers make it even more difficult.
Score: 4 Votes (Like | Disagree)
citysnaps Avatar
43 months ago
Excellent move!
Score: 4 Votes (Like | Disagree)
[AUT] Thomas Avatar
43 months ago
Not a fan of BIMI because it's once again not a solution, but just another overly complex workaround to fixing a broken system.

If all mail-servers required and enfored an organization validated server certificate for inbound connections from other servers the amount of spoofed mails and junk would be reduced by 99+%. Unfortunately, no mail provider can do that alone...

If that was about to be required by law, there would be an instant adoption and the problem essentially solved.
Score: 3 Votes (Like | Disagree)
boing Avatar
43 months ago

Apple (or the IETF) needs to replace IMAP. It was written for another age, and it's way long in the tooth.

Basically, security needs to be baked in instead of security as an afterthought. Verified senders needs to be a part of the infrastructure. It's ok to have unverified senders, but they should be marked as-such.

These days, certs are free and processing power is cheap, so issuing everyone a cert and using them for validation shouldn't be as much of a burden as it was back in the day.
No we don't want Apple (or any other big company) to replace IMAP or SMTP or HTTP. Those are the last three major open protocols left that are widely supported, even by the monopolies in email (Microsoft and Google). We should be encouraging their use to keep the Internet open, rather then siloed. Do you want what happened to chat to happen to email? In the past there were open chat standards like XMPP, well just a few days ago Google shutdown Google Talk which supported XMPP, the last widely used chat service to support XMPP. Now you have to decide to use Facebook Chat, Google Chat, Skype, WhatsApps, LINE, etc etc.. all which are siloed and don't communicate with each other or can be run on-premise in your own datacenter. You know how annoying it is for me as a Android phone user when someone uses iMessage to send me something that is not supported in my normal SMS app. I wish Apple would support RCS.

You need to understand email is comparable to phone service (calls and SMS) in the sense it is a widely supported standard, due to it being long in the tooth. These standards are open where anyone can contact you. To deal with spam email or calls, the easy thing to do is only accept them from people on your whitelist you trust. This is how most chat networks work, only people that know you (such as have your phone number in their contacts) can see to add you, which is why you notice less spam.

SMTP already supports sender verification as already described in the forum using SPF and DKIM. The mail server just needs to enforce using it. I don't think they should be blocking email completely just because the SPF or DKIM fails (since many people misconfigure it), but it should cause the mail system to score the email so high it ends up in the spam folder. When it comes to phone calls, they are trying to implement STIR/SHAKEN to combat the same thing with phone calls when it comes to verification to combat spoofing.

Even with email verification it won't completely fix the spam issue since a lot of spam is verified. A lot of email is being sent from hacked email accounts, which will look like they are verified. This means that the root of the issue with this is login authentication. Things are already occurring to improve login authentication, but using a unique hard to guess password for your email account is a major first step. A major second step being MFA. In most instances users pick easy to guess passwords, and even worst reuse that password at other places. Once one of these other places gets hacked, they have your email password. Your email password should be treated like one of you most important passwords, since every service you sign up requires your email for communication, including for security purposes. Simple security practices can go a long way to resolving a lot of issues. If your system gets hacked by way of a virus, then you are completely compromised and nothing will really protect you at that point other then a virus program that can detect and block malicious activity occurring on your system due to the virus infection.

So no we don't want to replace those, we just want to improve them as what have been occurring over the years, such as with HTTP/1.1 moving to HTTP/2, and now HTTP/3, all of which still work in a web browser. Having alternatives is not a problem, but replacing what is already open and supported will just make things more siloed since most of the companies (Google, Microsoft, and Apple) making the decisions do it for their own interests.
Score: 2 Votes (Like | Disagree)