Police now using BIMI to make genuine mail easier to recognise

"It's very important for society that communicating with the police is safe, reliable and visible."

Police logo on the facade of a police station

Brand Indicators for Message Identification, or BIMI for short, is an e-mail specification that enables the display of logos stored on supporting e-mail clients. Displaying such logos isn't just about making mail look good. It's also a way of letting people see at a glance that the mail comes from a trusted source who is using the DMARC open e-mail standard properly. With the Dutch national police having adopted BIMI in May of this year, Peter Gelhard has been talking to us about the background. Peter is Delivery Manager for the force's IP & Domain Office Product Line.

Your force is one of the first public bodies to implement BIMI. What made you decide to take the lead on this?

"A few years ago, we began working with the security partner we had at the time to implement open mail standards, such as DMARC and DANE. Back then, our mail domain politie.nl didn't score particularly well on the Internet.nl test portal. No more than 50 per cent. And we weren't compliant with several of the standards on the use-or-explain list published by the Forum for Standardisation either. The police see it as very important for society that communicating with us is safe, reliable and visible." As an organisation, we should also be doing all we can to keep it that way."

How did you go about it?

"We decided to implement DMARC for the politie.nl domain immediately. A little later, we added IPv6 support to the politie.nl website and our mail servers. That was quite an undertaking. The nice thing about it was that we became an example for other public bodies and suppliers to follow. Once you've got your own house in order, you're much better placed to press others to do the right thing. For example, we had a US supplier that didn't support DANE. We started pushing for DANE, and they implemented it within 6 months. We were then able to work with them on a DANE pilot scheme. Initiatives like that enable you to profile yourself as a trend-setting organisation."

Technically speaking, BIMI is fairly easy to implement if you're already using the other open standards. However, it does depend on having a European registered trademark, which many organisations don't have. How did you deal with that?

"Fortunately, we had already registered our trademark both at the Benelux level (https://boip.int) and at the European level (https://www.euipo.europa.eu/en). That meant that we were able to start using our logos and our name right away. Consequently, implementation was fairly straightforward. Besides, we'd already been through similar processes with the other mail standards. People shouldn't be put off by the annual certification costs, either. Especially not when you consider those costs in relation to the potential social cost of a scammer spoofing your mail. However, we're still ahead of the pack on this. As far as I'm aware, the Tax Service is the only other Dutch public body to implement BIMI so far."

What will constitute success for you where BIMI is concerned?

"We take a largely qualitative view of success. We want to show everyone that we're taking this very seriously. We also hope to give a boost to the wider adoption of BIMI, both by public bodies and by mail service providers. For example, it's a great shame that, although Google has enabled BIMI for Gmail, Microsoft hasn't yet added BIMI support to Hotmail, Outlook and so on."

Want to know more about BIMI?

Check out our article 'Add a verified logo to your business mail' on sidn.nl. For a list of mail clients with BIMI support, visit the BIMI Group website.