Now consider getting same visual indicators for ALL legit emails not just big companies. Which case would have a bigger recall value?
For a malicious actor spoofing a combo of SPF + DKIM + DMARC + BIMI won’t be a trivial job.
For a malicious actor spoofing a combo of SPF + DKIM + DMARC + BIMI won’t be a trivial job.
This is what I feel us tech people have missed about what the old school lock icon used to at least sort of (inaccurately) express when HTTPS was rare and what EV intended to express (although the qualification criteria needs work there).
Not everyone should be eligible for an EV cert, not everyone should be eligible for BIMI/VMC. Some sort of scale and legitimacy and manual approval (think the old school Verified checkmark before Elon bought Twitter) that not everyone qualifies for.