Google switches to DKIM for Email Authentication

Q: Does Google still accept SPF for BIMI?

No. Since the 2023 change, a domain must pass DKIM (with DMARC at enforcement) to qualify for BIMI and Gmail's blue checkmark. An aligned SPF pass alone is no longer sufficient for the badge, even though SPF remains a useful authentication signal in general.

Introduction

In 2023, Google tightened the email authentication requirements behind Gmail's blue verified checkmark after a researcher showed the badge could be faked. This article covers what the flaw was, how Google responded by requiring DKIM, and — as of this 2026 update — where the change stands today.

The flaw in Google's BIMI implementation

Brand Indicators for Message Identification (BIMI) lets verified senders display their logo in supporting mailboxes, and Gmail layered a blue verified checkmark on top of it to signal that a brand's identity had been confirmed. It's worth being precise about the timeline, because it's often reported wrong: BIMI logo avatars became generally available in Gmail in July 2021, but the blue checkmark specifically launched in May 2023.

Within weeks of that launch, security researcher Chris Plummer publicly demonstrated a spoofed message that appeared to come from a verified UPS sender — complete with the logistics giant's logo and Google's blue checkmark — that was actually a scam.

The root cause was how BIMI leaned on the Sender Policy Framework (SPF). DMARC passes if either an aligned SPF check or an aligned DKIM check succeeds. Because UPS authorized a shared third-party mail platform in its SPF record, an attacker who routed a message through that same platform could earn an aligned SPF pass — which satisfied DMARC, which in turn qualified the message for BIMI and the blue checkmark. This is sometimes called an SPF upgrade attack: a message that should have looked untrusted was "upgraded" to trusted.

Google's response and changes to BIMI

Google announced it was tightening BIMI verification. Instead of accepting either SPF or DKIM to qualify a sender for BIMI, Google moved to require DKIM specifically.

A Google spokesperson stated: "This issue stems from a third-party security vulnerability allowing bad actors to appear more trustworthy than they are. To keep users safe, we are requiring senders to use the more robust DomainKeys Identified Mail (DKIM) authentication standard to qualify for Brand Indicators for Message Identification (blue checkmark) status."

The logic is that DKIM is harder to abuse this way. A DKIM signature is a cryptographic hash tied to the message and signed with the domain's private key, so a sender can't inherit trust simply by relaying mail through infrastructure that a target listed in its SPF record.

Example DKIM and BIMI DNS records — BIMI now requires an aligned DKIM pass to qualify for Gmail's blue checkmark.

What this means for email security

The episode is a reminder that email authentication is a layered system, and each layer addresses a different weakness:

SPF authorizes which servers may send for a domain, but it authorizes by IP path, which shared platforms and forwarding can undermine.
DKIM cryptographically signs the message itself, so the signature travels with the mail regardless of the path it takes.
DMARC ties SPF and DKIM to the visible From address and tells receivers what to do on failure — see reject vs. quarantine.

BIMI sits on top of all three, which is why a weakness in one layer could surface as a very convincing fake badge.

Where this stands now (2026 update)

The DKIM requirement is settled: to display a BIMI logo and Gmail's blue checkmark today, a domain needs DMARC at enforcement (p=quarantine or p=reject) plus a valid DKIM setup, and typically a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) for the logo. The broader industry moved the same direction — the Google and Yahoo bulk sender requirements that took effect in February 2024 pushed SPF, DKIM, and enforced DMARC from "recommended" to "required" for high-volume senders.

The practical takeaway for any brand chasing the blue checkmark is unchanged: get DKIM signing right on every sending service before anything else. You can confirm your setup with our free DKIM checker, DMARC checker, and overall Email Security Score.

Frequently asked questions

Does Google still accept SPF for BIMI?

No. Since the 2023 change, a domain must pass DKIM (with DMARC at enforcement) to qualify for BIMI and Gmail's blue checkmark. An aligned SPF pass alone is no longer sufficient for the badge, even though SPF remains a useful authentication signal in general.

What was the "SPF upgrade attack"?

It was a technique where an attacker sent mail through a third-party platform that a target brand had authorized in its SPF record. That produced an aligned SPF pass, which satisfied DMARC and let the spoofed message inherit the brand's BIMI logo and checkmark. Requiring DKIM closes this path.

Do I need a VMC to get the blue checkmark?

For most brands, yes — Gmail's verified checkmark expects a Verified Mark Certificate (or a Common Mark Certificate for logos without a registered trademark), on top of enforced DMARC and DKIM. Setting up BIMI without meeting the authentication prerequisites won't display the badge.

Is SPF now pointless?

No. SPF still authorizes sending servers and contributes to deliverability and DMARC. The change was specifically about what qualifies a sender for BIMI — it raised the bar to DKIM rather than removing SPF from the stack.