Interview with our DMARC Consultant, Sébastien Fischer, with the CSA

A healthy mail environment doesn’t just happen on its own. It takes companies and people who are actively committed to keeping email an open, secure, and trustworthy communication channel. The Certified Senders Alliance (CSA) recognizes this commitment with its “Supporter Spotlight” series, and we are delighted to be part of it.

The Certified Senders Alliance (CSA) has been the European certification body for email senders since 2004 and, as a joint initiative of eco and DDV, acts as an intermediary between email service providers and senders. As a sponsor, together with our partner Merox, we’re contributing our DMARC expertise to the fight against phishing and identity theft.

We’re continuing this commitment beyond our sponsorship partnership: In December, we’re hosting a webinar on the topic of phishing.

Our conversation with the CSA shows just how important this topic is in practice: Sébastien Fischer, a DMARC consultant at Nameshield who has been an expert in email deliverability for 18 years, talks about his early days at Emailvision all the way to his current work with us in the field of domain security.

Here is the full interview.

CSA: What still fascinates you about email today?

To start off, let’s take a look back at his career: We wanted to know what has fascinated him about this field over the years.

SF: I took my first steps in email marketing—and specifically in the field of email deliverability—18 years ago at Emailvision. There, I discovered an incredible communication channel that is constantly evolving, which is what makes it so fascinating on so many levels:

  • Changes in marketing practices: Mass emails—which are still sent by some advertisers—have given way to more targeted emails with personalized content.
  • Changes in spam techniques: Spammers can be very skilled marketers and quickly adapt to new technologies to bypass anti-spam filters and deceive end users.
  • Advances in filtering techniques: Anti-spam filters use complex reputation systems based on various indicators, including technical configuration, authentication, historical reputation data for domains and IP addresses, content analysis, detection of suspicious behavior, and analysis of users’ email behavior.
  • Evolving standards: Over the past 20 years, numerous RFCs have been published, and some have evolved or will continue to evolve—I’m thinking in particular of DMARC and version 2 of DKIM.
  • Legal developments: The introduction of the GDPR a few years ago changed the rules of the game. All advertisers must adapt quickly to these changes if they want to continue reaching their users’ inboxes.

CSA: What is the challenge that Nameshield is particularly committed to addressing?

A key challenge for Nameshield is protecting brands from domain spoofing and phishing—through the targeted use of authentication protocols such as SPF, DKIM, and DMARC to secure companies’ digital identities.

SF: Nameshield is a global leader in domain management. It is important to us to be a one-stop shop for our customers when it comes to deploying state-of-the-art technologies to secure incoming and outgoing email traffic, while also serving as an advocate for these technologies to ensure a smooth transition for all our customers—so that this important communication channel remains as secure and reliable as possible.

CSA: What does it take to ensure that email remains a reliable channel?

SF: Email is a fantastic communication channel, but there are certain areas where it could still be significantly improved:

  • Greater security: The adoption of DMARC with a restrictive security policy remains too low—a godsend for any attacker who likes to use unprotected domains for their phishing emails.
  • More BIMI: The use of a VMC brand certificate with BIMI—to display the logo and a distinctive checkmark in the inboxes of certain providers—increases a brand’s visibility, much to the delight of marketing teams. It also lends greater legitimacy to emails sent to recipients’ inboxes, thereby helping to prevent confusion.
  • Greater cyber awareness among businesses and individuals: Recognizing phishing emails and helping to protect passwords to prevent account and data theft.

More members of the CSA (Certified Senders Alliance) and its certification program: To deliver the right message to the right person in their inbox at the right time.

CSA: Why is the CSA’s collaboration with Nameshield important to you?

SF: The CSA is a key European organization in the field of email deliverability and trust, particularly thanks to its email certification program. The CSA is not only a trusted third party for numerous local and international providers but also serves as a legal and technological authority—which gives it strong legitimacy and considerable prestige within the industry. The organization offers invaluable support to anyone looking to improve the quality of their email marketing—which is precisely why we are committed to supporting it.


Our conversation with Sébastien Fischer demonstrates once again that a secure and trustworthy email ecosystem is a collective effort. At Nameshield, we work every day—together with partners like the CSA—to further advance domain security and email deliverability.


Many thanks to the CSA for the insightful questions and the great collaboration!


Learn more about DMARC or contact us here.

BIMI and VMC: display your logo with emails

BIMI and VMC: display your logo with emails

BIMI (Brand Indicators for Message Identification) allows you to authenticate your emails and reinforce the trust of your customers by displaying your logo in their inbox. VMC (Verified Mark Certificate) is a certificate associated with BIMI, which ensures the authenticity of the logo displayed.

BIMI - Nameshield

What is BIMI?

BIMI is an industry initiative aimed at standardizing the use and display of brand logos in email clients. By placing a brand or company logo next to an email, it is more easily identifiable by customers and users, builds a sense of legitimacy and trust, significantly impacts open rates, and increases consumer protection against fraudulent emails.

Technically speaking, BIMI is an emerging security technology that works alongside DKIM, SPF and DMARC protocols to protect your domain name from being used by malicious actors to send fraudulent emails.

Before BIMI, the steps to get your logo next to an email were specific to each email service your message was sent to. Sometimes the process was entirely manual or relied on other applications to aggregate your brand information and share it across participating platforms.

The AuthIndicators group, which includes email service providers such as Google, Verizon Media, IONOS by 1&1 and Fastmail, is working to implement BIMI in the most common email clients. Many players have already adopted BIMI, others are in the process, Microsoft’s and Apple’s positions are expected to drive final adoption of the standard.

Why is BIMI important?

To complete the arsenal of a brand’s protection on the Internet, more specifically against hijacking attempts through fraudulent spoofing emails whose goal is to deceive the user and lead them to phishing sites.

306 billion emails circulated worldwide in 2020, with an ever-increasing proportion of fraudulent emails hijacking brands.

To increase the desirability of emails, particularly in marketing campaigns. The implementation of BIMI and more widely of security protocols and certificates on the domain name associated with a brand is essential today and has a major impact on online reputation.

Because it is becoming a market standard, easy to implement unlike the number of existing anti-fraud email solutions that are often difficult to test and implement.

How does BIMI work?

BIMI uses a process of several steps to validate emails by ensuring that they are actually associated with the sender’s domain name. Senders must add a TXT DNS record dedicated to BIMI.

For BIMI to work, domain names must also have several other fraud protections, including:

  • SPF (Sender Policy Framework): authenticates emails by identifying mail servers authorized to send from specific domain names ;
  • DKIM (DomainKeys Identified Mail): adds a digital signature to each email to verify that it was sent from an authorized domain name;
  • DMARC (Domain-Based Message Authentication, Reporting, and Conformance): confirms SPF and DKIM records and specifies how non-compliant emails should be handled.

When emails are sent using BIMI, the receiving mail server will first do the standard DMARC/DKIM authentication and SPF validation. If the email passes these checks, the mail server will verify that it has a valid BIMI record and display the brand logo.

How does BIMI interact with DMARC, DKIM and SPF?

The first step towards using BIMI to display a logo is to implement DMARC. This is stored as a DNS record of TXT type on the domain name. For DMARC to work with BIMI, the reject policy in this record must be p=quarantine or p=reject for all emails sent from your domain.

BIMI requires DMARC… and DMARC requires your domain name to have DKIM records to work. While DMARC only requires SPF or DKIM to work, it is best to include SPF records for more security when using BIMI. These 2 security tools are also stored as TXT DNS records in the domain name zone.

VMC, the final link in the chain

A Verified Mark Certificate is a digital certificate that authenticates the ownership of a logo, and completes the use of BIMI in email clients such as Gmail.

The VMC certificate guarantees the authenticity of the logo displayed, which is necessarily owned by the domain name holder sending the email. It is the last link in the chain to guarantee the authenticity of the email received.

When you send an email to a contact, the receiving mail server that manages their inbox will take the URL of the tag that indicates where the logo should be displayed. It will then check the VMC certificate to ensure that the correct logo is used. Once the logo is verified by the VMC, BIMI will display it next to the email in the inbox.

To obtain a VMC certificate, the implementation of DMARC on the domain name is a prerequisite. Then follows a reinforced authentication process with a Certification Authority that will validate the identity of the Organization, the registration of the logo with a certified body and will issue the certificate after a one to one meeting with a notary.

Depending on the country, the intellectual property offices for logos registrations may vary as well as the rules of acceptance to issue the certificate. The notions to keep in mind, the authorized trademarks can be:

  • Design trademarks: consist exclusively of a design;
  • Verbal trademarks: contain words, letters and/or numbers, without any particular font, size, color or style;
  • Combination trademarks: include a combination of words with a design, stylized letters or numbers.

While this is not a requirement for implementing BIMI on your domain name at this time, VMC should be part of the standard in the future.

Entrust Datacard and DigiCert are the first 2 companies to issue VMC certificates for the BIMI standard. Nameshield is a partner of both companies and will assist you in obtaining VMC certificates. You can contact directly our certificates department for any question on the subject.

BIMI + VMC = Guarantee of authenticity

BIMI, VMC… and Nameshield

Nameshield now assists its customers in all aspects of the implementation of DMARC, SPF, DKIM, but also BIMI protocols and the obtaining of associated VMC certificates. The domain name is at the core of the implementation of these different protocols. Our historical business as a registrar and DNS zones manager allows us today to assist our customers on these major subjects of the fight against online fraud and the increase of emails desirability.