[ BIMI & brand ]

Apple Branded Mail and BIMI are different routes

Compare Apple’s business-verification route with the receiving-provider checks behind BIMI in Apple Mail before choosing a logo-display project.

By the EmailAuth research team · 6 min read

[ Key points ]

  • Apple Business Branded Mail registration and a BIMI DNS assertion are different administrative paths.
  • Apple Mail’s BIMI display depends on receiving-provider participation, checks and headers.
  • A Gmail certificate or checkmark rule cannot be transferred to Apple or every client.
On this page

A logo beside an email in Apple Mail does not tell a project team which identity system supplied it. Apple Branded Mail and BIMI support in Apple Mail are distinct routes with different authorities and dependencies. A request to “turn on the Apple logo” should therefore become a documented choice about the brand, sending identity, destination mailbox and client surface before anyone orders a certificate or changes DNS.

Apple's current Branded Mail one-page guide describes a business registering with Apple Business, or delegating management to a third party, and adding a name and logo to messages. Earlier materials use the Apple Business Connect name. The guide identifies Mail and iCloud Mail as display surfaces and says Apple checks DNS records for DMARC. That is an Apple business-verification route, not proof that a BIMI assertion has been published. Apple Branded Mail overview.

Keep the two chains of authority separate

For Branded Mail, identify the business account owner, the party authorized to represent the brand and the administrator controlling the registered email scope. Retain the actual account status and approval messages when available. A marketing agency may prepare artwork without being authorized to manage the organization's identity. Likewise, control of a DNS zone does not establish ownership of a logo.

For BIMI, the domain owner publishes an assertion and makes the required logo and evidence available. The receiving provider applies its authentication, evidence and display policies. The sender does not obtain universal display authority merely by adding a TXT record. BIMI Group explicitly says participating mailbox providers set their own display criteria. BIMI implementation guide.

Apple Mail adds a receiving-side dependency. Apple documents BIMI support on macOS Ventura 13, iOS 16 and iPadOS 16 or later. Its provider conditions include Apple verification, checking message and domain compliance, verifying an evidence document and adding the required headers. A provider that has not performed those actions does not produce the documented Apple Mail BIMI display path. Apple's BIMI server guidance.

Use a route map with explicit unknowns

The comparison accompanying this article separates administrative authority, domain evidence, logo evidence, receiving dependency and observed result. It is a documentary route map, not an account audit. For the Branded Mail column, the unresolved fields are the organization's approved business identity, permitted sender scope and applicable current Apple review requirements. For the BIMI column, they are the published assertion, accepted evidence, authenticated message and receiving provider's participation.

Do not fill the observed-result row using a screenshot from a provider's marketing page. That image demonstrates a promoted interface, not this organization's configuration. A screenshot from a controlled test must identify the actual mailbox provider, client, operating-system version, date and sending identity. The same client application can display mail from different providers, so “tested in Apple Mail” is incomplete evidence.

A source limitation also remains: the current introductory Branded Mail guide could not be fully retrieved. The separate Apple overview, available verification excerpt and BIMI developer guidance support the bounded comparison here, but do not establish every current console setting or regional display condition. Confirm those details in the authorized account before implementation.

Reconcile authentication without merging the programs

DMARC checks alignment between the Author Domain and an authenticated SPF or DKIM identifier. That protocol result is distinct from business verification and from acceptance of a brand asset. A DMARC pass is not a certificate of commercial identity, and an approved business profile cannot replace message authentication. RFC 9989, sections 4.3–4.4.

Apple's available domain-verification guidance lists quarantine or reject, with a parent subdomain-policy alternative in its stated case, and still mentions pct=100. Treat that as Apple's documented compatibility language, not a definition of modern DMARC. RFC 9989 removed the pct tag. Have the mail administrator resolve applicable receiver requirements without treating percentage tags as a reliable staged-enforcement control. Apple domain-verification guidance; RFC 9989, Appendix A.6.

Keep the sender inventory and authentication remediation ahead of a cosmetic launch date. If legitimate transactional mail is not ready for enforcement, the brand team should not force a domain-wide policy change merely to satisfy a logo project.

Do not transfer certificate or badge promises between receivers

Gmail's current setup guidance accepts a Verified Mark Certificate or Common Mark Certificate for its BIMI route and describes its checkmark for VMC-verified senders. Those are Gmail statements. They do not establish that the same CMC produces an Apple Mail display, that Apple Branded Mail requires the same certificate, or that a Gmail badge appears in another application's interface. Google's BIMI setup guidance.

Apple's BIMI page discusses VMCs and other evidence documents trusted by the receiving provider. Record the particular provider's accepted evidence rather than converting that language into blanket CMC support. For Apple Branded Mail, obtain the requirements of that separate business workflow instead of purchasing a mark certificate solely because both routes can display a logo.

Test a defined route and preserve the result

Consider a fictional brand using offers@example.com. The proposed plan has one Branded Mail registration row and a separate BIMI row for the same sender. Neither row is marked complete. The team would verify account and domain status for the first, then DNS, assets, certificate applicability and trusted receiver authentication for the second. It would record each actual display observation against the relevant provider and client.

No account, DNS record, certificate or display was tested for this article. Its exact catalogue evidence requirement remains open: “Produce a side-by-side route map with Apple-owned sources and supported display observations.” The documentary map is supplied; supported original display observations and current account applicability are still missing. No logo, checkmark, inbox placement or release date is guaranteed.

[ Takeaway ]

Identify which route supplied the evidence, and test a named mailbox-provider and client combination rather than promising an Apple-wide logo.

[ By role ]

What this means for you

Choose your role for practical next steps.

Brand owner

Choose the intended identity route

The same logo may appear through different programs with different approval chains.

Next steps

  1. Identify the approved brand and authorized Apple account manager.
  2. Keep a separate decision for any BIMI certificate and DNS project.

Email administrator

Keep authentication evidence independent

A registered business identity does not prove that a particular message passes aligned authentication.

Next steps

  1. Retain actual sender identities and trusted receiver results.
  2. Resolve current receiver requirements without forcing unsafe domain-wide changes.

Support analyst

Identify the receiving context

Apple Mail is a client surface that can connect to different mailbox providers.

Next steps

  1. Record the provider, OS, client version and date for each observation.
  2. Do not attribute a logo or badge to BIMI without evidence of the route.

[ FAQs ]

Frequently asked questions

Does registering for Apple Branded Mail publish a BIMI record?

Do not treat registration as evidence of a BIMI assertion. The Apple business-verification route and the DNS-based BIMI route need separate configuration and evidence.

Why does the article use both Apple Business and Business Connect?

Earlier materials name Business Connect. The current Apple-owned Branded Mail overview uses Apple Business. Verify the current authorized account workflow rather than relying on an old menu name.

Can Apple Mail show BIMI for every mailbox account connected to it?

No such blanket claim is supported. Apple requires the receiving mail provider to meet its participation, validation and header requirements. The mailbox provider is part of the test context.

Does Apple’s BIMI guidance establish universal CMC acceptance?

No. It discusses VMCs and other evidence documents trusted by the receiving provider. Confirm the particular provider’s accepted evidence instead of assuming all CMCs qualify.

Will a Gmail VMC checkmark appear in Apple Mail?

Google’s statement concerns Gmail’s VMC-verified senders. It does not establish the same badge in another application or program.

Can a marketing agency approve the brand by controlling DNS?

DNS control alone does not establish brand rights or authority to manage the Apple business identity. Record the brand owner’s authorization and the account delegation separately.

How should I handle Apple guidance that still mentions pct=100?

Preserve it as provider compatibility language. RFC 9989 removed pct; have the email administrator reconcile the applicable requirements instead of using percentage settings as an enforcement rollout promise.

What remains missing from the side-by-side route map?

Original supported display observations and the actual organization’s account, domain and evidence status. The supplied map is documentary, and current Apple console applicability remains unverified.

[ Sources ]

Sources

  1. Apple: Prepare your email server for BIMI support in Apple Mail
  2. Apple Branded Mail overview
  3. Apple: Verify your email domain for Branded Mail
  4. BIMI Internet-Draft 15 (31 October 2026; work in progress)
  5. Google Workspace: Set up BIMI
  6. BIMI Group implementation guide
  7. RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance

[ Glossary ]

Glossary

Apple Branded Mail
Apple’s business-tooling route for associating a registered business brand name and logo with email.
Apple Mail BIMI path
The client display path that depends on a receiving provider performing Apple’s documented BIMI checks and supplying required headers.
Business verification
A program-specific assessment of the business identity, separate from a message’s domain-authentication result.
BIMI evidence document
Evidence used by a receiving provider to assess an indicator’s relationship to a domain, under that provider’s trust requirements.
Display observation
A dated record of what a named receiving service and client showed for a specific controlled message.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base