Master Guide: Obtaining your blue verified Gmail checkmark

‍

In today's fast-paced digital world, authenticity and credibility are paramount. It's no surprise, then, that since its introduction by Gmail in May 2023, the blue verified checkmark has become a critical asset for brands seeking to build trust. This symbol, tied to BIMI (Brand Indicators for Message Identification), showcases your brand’s legitimacy in email inboxes. Acquiring it, however, involves a detailed process requiring patience and precision.

As business owners ourselves, we know how vital securing and optimizing email deliverability is for success. We've crafted this comprehensive guide to help companies of all technical skill levels navigate the pathway to the checkmark. We'll lead you through these crucial steps:

The process spans email authentication, a compatible brand logo, and the certificate requirements that apply to your logo type. Palisade's AI-first DMARC agent can help with the authentication work. Trademark and certificate work remains with the relevant legal and certificate providers.

‍

Step 1→ Configuring your DNS and Preparing to set up your BIMI record – laying the necessary groundwork.

In this initial stage, we'll lay the groundwork for your verified checkmark by preparing your BIMI (Brand Indicators for Message Identification) records—a technically intensive but essential step. BIMI is an ever-evolving email standard and may change over time. To prepare, you’ll need:

SPF, DKIM, DMARC, and BIMI are interlinked protocols enhancing email communication security and authenticity. SPF and DKIM verify email origins, DMARC builds on these checks, dictating actions when checks fail, while BIMI, relying on DMARC, visually validates your emails with your logo. These protocols not only secure but also visually enhance your emails, building trust with recipients.

DNS Records: What They Are, Why They Matter, and How to Set Them Up

Simply put, DNS (Domain Name System) records are a crucial part of how the internet functions; they serve as the internet’s address book. They help connect your website’s domain name to the appropriate server IP address, making your website accessible to users. For protocols like BIMI, you need to add these DNS records to your domain provider’s management console. These records, particularly TXT records, carry vital information about your domain for external servers. Understanding DNS records and their roles, such as connecting your domain name to its IP address for accurate email routing, is a key part of setting up email authentication protocols like BIMI.

Why Set Up SPF, DKIM, and DMARC for Your Domain?

Setting up SPF, DKIM, and DMARC records for your domain is crucial for improving email deliverability and trustworthiness. These protocols authenticate your email messages, ensuring they come from a legitimate source. This authentication helps prevent your emails from being flagged as spam or rejected by email servers. By implementing SPF, DKIM, and DMARC, you increase the likelihood of your emails reaching the intended recipients’ inboxes. ‍

Understanding Propagation

When adding a new DNS record, bear in mind that it can take up to 48 hours for it to fully propagate across all DNS servers globally. If you're encountering verification hiccups during this period, it's likely due to this propagation period. However, remember, propagation isn't the sole source of potential issues.

If you're curious about your DNS propagation status, use a tool like the one linked below. Keep in mind, though, that propagation times can vary, and delays don't necessarily signal a problem with your record itself.

https://www.whatsmydns.net/

*Don’t forget to select “DNS” in the drop-down next to domain name

Gathering Your DNS Manager Credentials

To set up your DNS records, you will need to access your DNS Manager. There are two common methods depending on your domain host: signing in directly to the domain host's sign-in portal or logging in via your third-party DNS Manager. These steps ensure smooth access to the necessary settings for managing your domain's DNS configuration.

If you have a website developer or an IT person on your team, they might be the ones managing your domain. Don't hesitate to ask them for this information.

Here are some of the most popular domain hosts:

• GoDaddy
• Google Domain
• Bluehost
• NameCheap
• DreamHost

Most popular DNS Managers:

• Cloudflare
• Google Cloud DNS
• Amazon Route 53

Domain Host DNS Manager

Once you’ve signed in, your domain host provider's dashboard look should similar to this: You can also use your domain hosting provider’s internal Domain Manager to check out your DNS. Many of them have an interface that looks similar to this: Third-Party DNS Manager

If you are using a free third-party DNS Manager like Cloudflare, which we highly recommend, your DNS interface would look like this.

Setting up your SPF Record

An SPF record is a line of text that specifies which domains or IP addresses are allowed to send emails on behalf of your domain.

Setting up an SPF (Sender Policy Framework) record for your company's domain is like putting a seal of authenticity on your outgoing emails. It helps prevent others from sending emails pretending to be from your domain. Here are the steps it will take to set it up:

1. Identify the Third Party Services your Company is Using

Make a list of all the mail servers that send emails on behalf of your domain. These could include your company's internal mail servers and any external email marketing services.

You may include either the domain name or the IP address of the third party service in the SPF record. Depending on the specific circumstances. Here's how:

2. Domain name: If a third-party provider is sending mail on your behalf and they have an SPF record published for their own domain, you could use the include mechanism followed by their domain name. This will include their SPF record in your own.

An example of this would be v=spf1 include:thirdpartydomain.com -all, where thirdpartydomain.com is the domain of the third-party mail service.‍

3. IP Address: If you know the specific IP address or range of IP addresses that the third-party provider uses to send mail, you can specify these directly in your SPF record using the ip4 or ip6 mechanisms.

An example of this would be v=spf1 ip4:192.0.2.0/24 -all, where 192.0.2.0/24 is the IP range used by the third-party provider.

4. Create Your SPF Record

Replace the sample IP addresses in the example with your actual ones. Here's an example SPF record for a domain using

Google Workspace for email (Gmail) example:

v=spf1 include:_spf.google.com ~all

Setting Up Your SPF Record

An SPF record is a line of text that specifies which domains or IP addresses are allowed to send emails on behalf of your domain. Setting up an SPF (Sender Policy Framework) record for your company’s domain is like putting a seal of authenticity on your outgoing emails. It helps prevent others from sending emails pretending to be from your domain, protecting against spoofing. Here are the steps it will take to set it up:

1. Identify the Third-Party Services Your Company is Using Make a list of all the mail servers that send emails on behalf of your domain. These could include your company’s internal mail servers and any external email marketing services. ‍

2. Domain Name If a third-party provider is sending mail on your behalf and they have an SPF record published for their own domain, you could use the include mechanism followed by their domain name. This will include their SPF record in your own. An example of this would be v=spf1 include:thirdpartydomain.com -all, where thirdpartydomain.com is the domain of the third-party mail service. ‍

3. IP Address If you know the specific IP address or range of IP addresses that the third-party provider uses to send mail, you can specify these directly in your SPF record using the ip4 or ip6 mechanisms. An example of this would be v=spf1 ip4:192.0.2.0/24 -all, where 192.0.2.0/24 is the IP range used by the third-party provider. ‍

4. Create Your SPF Record Replace the sample IP addresses in the example with your actual ones.

Here’s an example SPF record for a domain using Google Workspace for email (Gmail): v=spf1 include:_spf.google.com ~all

Add include:_spf.domain.com for every third-party tool using your domain for sending emails. ‍

5. Add the SPF Record to Your DNS‍ Log in to your DNS management interface and add TXT records for your domain like discussed previously. Don’t forget to add @ for the root domain and set the TTL to Auto or, alternatively, use 8 hours if you don’t intend on updating your SPF record often.

**6. Test Your SPF Record **After the new record propagates (which may take up to 48 hours), use an online SPF record checker to verify if it’s set up correctly. You can use Palisade's SPF Checker. ‍

Setting up your DKIM DNS record

DKIM (DomainKeys Identified Mail) is a method to verify that the emails you send are genuine and haven't been changed along the way. It works by adding a special digital signature to your email.

Here’s how to set it up:

1. Generate a DKIM Key

You need to create a special key pair. If you use services like Google Workspace for using Gmail with your work email for example, they will provide you with a part of the key called the public key. They will keep the other part, called the private key, secure to sign your outgoing emails.

Example using the Google Workspace Authentication Generator: 2. Add the DKIM record to your DNS

The host for the DKIM record will usually look something like selector._domainkey, where selector is a name you choose (it could be anything like "mail", "google", etc.). The value will be the DKIM value provided by the third party.

Adding a new TXT record to your DNS settings. Use the following example for each value:

The DNS Record creator should look similar to this Cloudflare example: Test your DKIM

After the DKIM record propagates, you can use an Palisade' DKIM record checker to verify that it's set up correctly. Just enter your domain and the selector you used, and it should return your DKIM record. ‍ Your DKIM setup depends on the sending provider. Palisade's AI-first DMARC agent can identify failing sources and help work through alignment, but you must use the selector and DNS value generated for your own provider account.

Setup DMARC for your Domain

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email protocol that uses SPF and DKIM to check if an email is legitimately from the domain it says it’s from.

Specifically: It tells the receiving email server what to do if the checks fail (like sending a report, quarantining the email, or rejecting the email), and can stop fraudulent emails before they even get to the recipient, protecting against spoofing.

Typically, each service will provide you with a single DMARC record to input into your DNS Manager. Let’s say you use Mailjet for marketing emails, Google Apps (Gmail) for user emails, and Hubspot CRM for transactional emails. In this case, each of these services requires its own DMARC TXT record in your DNS manager. This ensures that the DMARC policies are correctly applied and enforced for each specific email service you utilize.

Note that you’ll first need SPF and/or DKIM deployed for a minimum of 48 hours (Propagation!) before you can set up DMARC.

‍

‍Special Requirements for your DMARC policy settings for BIMI

To enable BIMI, your DMARC policy must meet certain requirements.

• The policy option (p) must be set to either quarantine or reject. BIMI does not support DMARC policies with the p option set to none.
• Additionally, the percent option (pct) must be set to 100 to apply the DMARC policy to all outgoing mail from your domain.

Finally, Here are the steps to set up DMARC for a single service:

1. Create a DMARC policy

Your DMARC policy is a DNS record that tells receiving mail servers how to handle emails from your domain if they fail SPF or DKIM checks. Here's a simple example of a DMARC policy:

In this case, v=DMARC1 specifies the version of DMARC. The p=quarantine tells the mail server to moves suspicious emails into a different folder, like your recipient’s spam folder, instead of the inbox.

rua=mailto:postmaster@example.com specifies that aggregate reports should be emailed to postmaster@example.com.

If you would like to reject suspicious emails outright, you would change p=quarantine to p=reject. However, we recommend using caution when using p=reject as you would need to be absolutely sure to whitelist all of your email sending services.

To be compliant for BIMI, your DMARC record cannot use the p=none policy.

2. Add the DMARC record to your DNS

Add a new TXT record to your DNS settings. The host for the DMARC record will be _dmarc. The value will be the DMARC policy you just created. So, your DNS entry might look like this:

Type: TXTHost: _dmarcValue: v=DMARC1; p=quarantine; rua=mailto:postmaster@getverified.emaiTTL: 3600 (or your provider's default)

Hit save, then your DMARC record should show up in your DNS record. This can take up to 24 hours to update.

3. Test your DMARC record

After the DMARC record propagates, you can use Palisade's DMARC checker to verify that it's set up correctly. Just enter your domain and it should return your DMARC record.

Remember to monitor your DMARC reports regularly, as they will provide valuable insight into whether any malicious entities are attempting to send emails on behalf of your domain.

Checking for an existing BIMI record

You can check if your domain has an existing BIMI record by using Palisade's BIMI checker. This tool checks for the BIMI record and the BIMI image SVG file associated with your domain and will generate a report with the results of the checks. If authentication is the blocker, Palisade's AI-first DMARC agent can help you work through SPF, DKIM, and DMARC before you return to the BIMI requirements.

Step 2 → Logo - SVG & Trademark

The second step for obtaining your verified blue Gmail checkmark will consist of you uploading your company logo in a specific SVG format on your public server and securing a trademark for your logo.

The process of creating a BIMI-compliant SVG logo includes multiple technical and design steps that might require the assistance of a specialist.

Obtaining a trademark includes researching existing trademarks to ensure that your logo is unique, filing a trademark application with the appropriate government agency, and waiting for the trademark to be approved.

Latest news: The BIMI standard currently requires a registered trademark for your logo to be eligible for a Verified Mark Certificate (VMC). However, the standard is being expanded to include logos that are not trademarked.

Here’s a breakdown of the different steps:

Step 1 - Obtaining & Configuring Your Company's Logo SVG

• Understand what an SVG is
• Determining if your company logo is already in SVG format
• Converting your logo to an SVG format
• Creating a BIMI-compliant SVG logo

Step 2 - Trademarking Your Logo

• Understanding what a logo trademark is
• Applying for a logo trademark
• Understanding the timeline for trademark registration
• Work with a reputable company to get your logo trademarked

Obtaining & Configuring Your Company's Logo SVG

Understanding what an SVG is

SVG stands for Scalable Vector Graphics. Imagine a picture you can zoom in on indefinitely without it ever getting blurry, and that's essentially what an SVG is.

This means no matter how much you increase the size of an SVG, it will always look sharp and clear because it stores the image via mathematical formulas and does not stretch pixels.

‍

Here are some of the most popular software programs for creating SVG graphics:

• Adobe Illustrator
• Figma
• Sketch
• Inkscape

Example of increasing the size of an SVG logo that scales perfectly:

Determining if your company logo is already in SVG format

To find out if your company logo is already in SVG format, start by checking where your digital assets are stored. This could be on your company server, a cloud storage platform, or even an email thread from when the logo was first created. The SVG file will end with the extension ".svg" in the filename.

If you're unsure, you can also ask your design team, the design agency or freelancer who originally created your logo, or the person responsible for your company's branding. Any of these sources may still have the original design files and can provide you with the SVG if it was created. It's important to maintain an SVG version of your logo, as it provides flexibility and scalability for different digital applications.

BIMI SVG file requirements and recommendations

To ensure that your logo is verified and can be displayed properly at various resolutions, it must meet BIMI's brand logo requirements. This ensures that your logo passes security checks and can be displayed accurately.

In order to be properly displayed in the recipient's inbox, your SVG file must adhere to certain specifications.

• It must be in SVG Tiny Portable/Secure (SVG Tiny PS) format- baseProfile attribute of tiny-ps- version attribute of 1.2
• The