Mandaris

I’ve been curious about how images and logos show up in my mail client even when I do not have them in my address book. I thought I would look into this as a small side project before I rewrite the author information on the site¹.

So, the question is, “How do I do this?”

Answer, I can’t.

Well, not officially.

The images that you see next to your email are called BIMI, Brand Indicators for Message Identification. To more reliably use this, I would need to make my icon a registered trademark for more service providers. But, I noticed that Fastmail allows it, and I use that service for my email. So, I’m going to do all the other steps associated with the process.

Step 1: Get/Set the DMARC Record

I currently use Hover as my domain registrar, and they have an interface that allows me to set a DMARC record. I used the wizard from DMARC.com, but it’s essentially a text string that you can just add.

For me, I used specific email under my domain so that I could filter things related to this process.

v=DMARC1; p=quarantine; rua=mailto:dmarc@mandarismoore.com;

The p=quarantine is key to making sure that the record is handled correctly for this particular iteration.

Step 1.5: Reconfigure the SPF

When I configured FastMail as my email host, it had specified an option in DNS for SPF, Sender Policy Framework.

FastMail has SPF configuration documentation to use the ?all directive for configuration.

v=spf1 include:spf.messagingengine.com include:spf.example.com ?all

From what I can see, it seems like there is a problem if an email that I send is forwarded to another server. I’ve decided to use the ~all for now.

I don’t send out that many emails, and I’m growing more and more… cautious on where my email might be going.

Step 2: Configure the Image Correctly

I think this is the step where I got the most value out of this process, because it had me re-evaluate the SVG that I’ve been using for my website. When I used Real Favicon Generator to create the .ico file and manifest for the site, I used the svg that was also created. It looks the same, but the internal structure is different from the original. The site claims that the one it generates is future proof.

I switched back to the original for the SVG and used the SVG Conversion Tools to create a version of what this is expecting. As a bonus, I add the same title and desc fields to the SVG that I serve.

I then added the BIMI to the site and made sure that the file address is reachable.

I added the TXT record for the BIMI and let it propagate.

Step 3: Register your Trademark

This is a step that I didn’t look into in depth. To register my trademark would cost me $75 dollars in the state where I live, and I don’t know if that would be honored internationally.

I cannot justify the expense of having my icon show up in the emails of people who may never read or care.

I mean, I care, but that brings up another point.

Gravitar should work

Gravitar is a free² service that acts as a way to validate and host information about who someone is. Other services can query gravitar to look up information about that user. For example, if I sign up for a new discourse forum, it will take my email and use the profile picture that gravitar has on file and use that until I tell the forum to use another picture.

It’s very convenient, and I’ve enjoyed seeing the same people in different communities that I go to.

The only problem that I’ve come across is that it caches the picture that you have when you first sign up to the service.

Conclusion

I set this up, but I do not truly know if it works. I’ve tested with DMARC Domain Checker and ValiMail Domain Checker, and it looks like everything is working with the current ~all and p=quarantine options.

DMACian also has a DMARC Report Analyzer that can give you an idea of what issues you might have when you configure this.

I’ll make the switch to the more secure settings after this is published. You can email me if you want to get an email to check if it’s working.