Reference

Glossary

Every term we use, explained clearly, with the technical detail for those who want it.

Underlined terms open a definition in a side panel when you click them. Here are all the terms in one place.

Alignment

Matching the authenticated SPF or DKIM domain to the 'From' address people see.

Passing SPF or DKIM is only half the check: the domain that passed the check must also match the domain shown in the visible 'From:' address. That match is called alignment. It stops an attacker from passing SPF or DKIM with their own domain while putting your company's domain in the 'From:' line.

Technical detail

SPF alignment (`aspf`): Compares the Return-Path (RFC5321.MailFrom) domain to the From: (RFC5322.From) domain.
DKIM alignment (`adkim`): Compares the DKIM-Signature d= domain to the From: (RFC5322.From) domain.
Modes: Relaxed (r, default) allows any subdomain of the same organizational domain; strict (s) requires an exact character-for-character domain match.

Related:DMARC SPF DKIM

API key

A secret token for software and AI agents to use your account.

A secret credential that lets your scripts, backend servers, or AI assistant work with your organization's domains. Each key is bound to either live or test mode and carries specific permissions (scopes).

Technical detail

Header: Authorization: Bearer vi_live_… (live) or Authorization: Bearer vi_test_… (test).
Scopes: applications:read, applications:write, billing:write, certificates:write, support:write.

Related:MCP Test mode (sandbox)

Authoritative nameserver

The primary server that holds the official copy of your domain's DNS records.

The server that stores the original, source-of-truth copy of your domain settings. VerifiedInbox checks your authoritative nameservers directly, so we see your DNS changes within seconds instead of waiting hours for cached copies around the internet to refresh.

Technical detail

Discovery: Resolved from the NS records of your domain's zone.
Verification: Queried directly with recursion disabled (RD=0) and zero caching, with automatic fallback to DNS-over-HTTPS (DoH).

Related:DNS TTL

BIMI

The open standard that lets inboxes display your official company logo.

BIMI (Brand Indicators for Message Identification) is a public setting on your domain that tells Gmail, Apple Mail, Yahoo Mail, Fastmail, and other supporting inboxes where to find your official logo and mark certificate. Inboxes only display your logo on emails that pass DMARC authentication.

Technical detail

DNS host: default._bimi.<domain> (or <selector>._bimi.<domain> when paired with a BIMI-Selector header).
Record syntax: See BIMI record tags.
Prerequisite: DMARC at enforcement (p=quarantine with pct=100, or p=reject) and no sp=none on the organizational domain.

Blue checkmark

The verified badge Gmail shows next to a sender's name.

When your company verifies its domain and registered trademark logo with a VMC, Gmail shows your logo and a blue checkmark next to your sender name. Hovering or tapping the checkmark tells recipients that the email genuinely comes from your organization.

Technical detail

Trigger: Displayed by Gmail when an incoming message passes DMARC at enforcement (p=quarantine or p=reject at pct=100).
Certificate: Requires a default._bimi.<domain> TXT record whose a= tag points to a valid Verified Mark Certificate (VMC) PEM chain.

Business verification

Confirming your company is legally registered and you are authorized to represent it.

We verify that your company is an active registered legal entity and that the applicant is authorized to act on its behalf, before submitting your order to the certificate issuer.

Technical detail

Checks: Official company registry lookup (OpenCorporates) plus applicant authority verification, followed by the issuer's organization and verified-contact validation.

Related:Certificate issuer

Certificate issuer

The accredited authority that verifies your company and issues your mark certificate.

An independent Mark Verifying Authority (we partner with DigiCert) that verifies your legal business, your authority to apply, and your logo before issuing your VMC or CMC. Their annual fee is passed through without markup.

Technical detail

Role: Certificate Authority (CA) / Mark Verifying Authority (MVA) accredited under the AuthIndicators Working Group Mark Certificate Requirements.

CMC (Common Mark Certificate)

A mark certificate that displays your logo without requiring a trademark.

A digital certificate for companies whose logo is not a registered trademark yet, provided the logo has been used publicly on your website for at least 12 months. Gmail and Apple Mail display your logo beside your emails, without the blue checkmark.

Technical detail

Validation: Validated on prior use (at least 12 months of public display, verified via web archive captures) rather than trademark registration.
Requirements: Uses the exact same default._bimi DNS record, SVG Tiny P/S profile, and DMARC enforcement rules as a VMC.
Validity: Up to 398 days.

DKIM

A tamper-proof digital signature that proves an email came from your domain and wasn't altered.

DKIM (DomainKeys Identified Mail) stamps an invisible cryptographic signature onto every email you send. Inboxes verify that signature using a public key in your domain's DNS to confirm the email really came from you and that neither the headers nor the body were changed in transit. Unlike SPF, a DKIM signature survives when a recipient forwards your email.

Technical detail

DNS host: <selector>._domainkey.<domain> (TXT record, or CNAME to a provider-managed TXT record; RFC 6376).
DNS value: See DKIM TXT record tags (2048-bit RSA recommended; an empty p= revokes the key).
Message header: DKIM-Signature with d= (signing domain), s= (selector), a= (rsa-sha256), h= (signed headers), bh= (body hash), and b= (signature).

Related:DKIM selector DMARC Alignment

DKIM selector

The short label that identifies a specific DKIM key on your domain.

Because your domain can use several email services at the same time, each service publishes its DKIM public key under its own short name called a selector (for example “google”, “s1”, or “selector1”). The selector tells receiving inboxes which key record to look up in your DNS.

Technical detail

Header tag: s=<selector> inside the DKIM-Signature header.
DNS lookup path: <selector>._domainkey.<domain>
Discovery: DNS zones cannot be enumerated automatically; inspect DKIM-Signature via Show original in a test email or check your provider's settings.

Related:DKIM

DMARC

Your domain's rule for blocking fake emails and receiving daily sender reports.

DMARC tells inboxes what to do when an email claims to come from your domain but fails SPF and DKIM checks: monitor it (none), send it to spam (quarantine), or block it outright (reject). It also emails you daily reports showing every service sending as your domain. Inboxes only show your logo when DMARC is set to quarantine or reject.

Technical detail

DNS host: _dmarc.<domain> (TXT record, RFC 7489).
Record syntax: See DMARC tags and example records.
Evaluation: Passes when at least one of SPF or DKIM passes and aligns with the visible From: domain.
BIMI rule: Requires p=quarantine (at pct=100) or p=reject, and forbids sp=none on the organizational domain.

DMARC policy (watch, filter, block)

What inboxes do with emails that fail the checks: watch them, send them to spam, or refuse them.

Your DMARC record sets one of three policies. Watch mode (none) changes nothing and only sends you reports. Filter (quarantine) sends failing emails to spam. Block (reject) refuses them outright. Filtering all of your email or blocking is called enforcement, and inboxes only show your logo at enforcement.

Technical detail

Watch: p=none (monitoring, no effect on delivery).
Filter: p=quarantine; pct below 100 filters only part of the failing mail and doesn't count for BIMI.
Block: p=reject (strongest).
Subdomains: sp= sets the policy for subdomains; BIMI forbids sp=none.
Details: See what quarantine does.

DMARC reports

Daily summaries from inboxes showing every service that sends email as your domain.

Gmail, Yahoo, Outlook and other inboxes email a daily summary to the report address in your DMARC record. Each one lists the servers that sent email as your domain and whether they passed SPF and DKIM, so you can spot a tool you forgot to set up before you filter or block anything. The address must be a mailbox that exists: use a dedicated one (like dmarc@yourcompany.com) or a DMARC reporting service, because busy domains receive many reports.

Technical detail

Tag: rua=mailto:dmarc@<domain>; separate several addresses with commas, each with its own mailto:.
Format: Aggregate XML reports, usually zipped, about once a day (ri=86400).
Other domains: An address on another domain needs an authorization TXT record on that domain.
Reading them: See reading DMARC reports.

DNS

The internet's public address book for your domain.

DNS (Domain Name System) is where your domain's public settings live: where your website is hosted, which service receives your email, and the security settings needed for your inbox logo. You manage DNS where your domain is hosted (such as Cloudflare, GoDaddy, Namecheap, or Route 53).

Technical detail

Resolution: Records are published on your zone's authoritative nameservers (NS) and cached by recursive resolvers up to each record's TTL.

DNS record

One setting in your domain's public address book.

A single entry in your domain's DNS settings, consisting of a type (such as TXT, CNAME, or MX), a host name, and a value. We show you the exact values to copy and paste.

Technical detail

Fields: Owner name (Host), record type (TXT, CNAME, MX, A, AAAA), data (Value / RDATA), and TTL.

Related:DNS TXT record

Domain

Your company's internet name, like yourcompany.com.

The name after the @ in your email address. To show your company logo in the inbox, you need a domain you own and control; shared email domains like gmail.com or outlook.com belong to the provider.

Related:Subdomain Organizational domain

Domain ownership check

Proving you control the domain by adding a one-time verification code.

You add a unique TXT record we give you to your domain's DNS settings. It proves you control the domain so nobody else can order, reissue, or revoke a certificate for it.

Technical detail

DNS host: _verifiedinbox.<domain> (TXT record).
Value: Your unique verification code, see domain ownership record.

Related:DNS record

Issuer fee

The certificate issuer's own yearly validation and issuance charge.

The certificate issuer charges its own yearly fee for verifying your business and issuing the certificate. We collect it at checkout without markup and show it as a separate line item. If issuance is rejected, you receive a full refund.

Related:Certificate issuer

Logo & certificate hosting

We keep your SVG logo and PEM certificate chain online for inboxes to fetch.

Supporting inboxes download your logo and certificate from the internet over HTTPS. We host both on fast, reliable servers and swap in your renewed certificate automatically each year, so you never have to manage files or update your DNS.

Technical detail

Logo URL (`l=`): logo.svg at your hosted address, served as image/svg+xml.
Certificate URL (`a=`): certificate.pem at your hosted address, served as application/x-pem-file.

Related:BIMI PEM file

Looks identical

How we confirm the inbox-ready logo looks the same as your original.

We draw your original file and the inbox-ready copy at the same size on a white background and compare them pixel by pixel. If less than half a percent of the logo changed visibly, they look identical. Up to 3% counts as small differences; more than that is flagged so you can check carefully.

Technical detail

Method: Both SVGs are rasterized at 256×256 px on a white canvas; a pixel counts as changed when any color channel differs by more than 32/255.
Thresholds: identical < 0.5%, minor < 3%, otherwise significant.

Related:SVG Tiny P/S

Mailbox provider

The service that hosts your company's email inboxes.

The service where your team reads and sends daily email, such as Google Workspace, Microsoft 365, Fastmail, Zoho Mail, or Proton Mail.

Related:MX record

Matches your logo

How we decide a registered trademark shows your logo.

For each registered mark we find, we download its image from the US trademark office and compare it with your logo. An AI image check does the comparison, with a visual fingerprint as a backup. A score of 80% or more counts as a match; lower scores are shown as similar so you or our team can confirm.

Technical detail

Method: Compares the USPTO mark image against a 256 px rendering of your logo using Claude vision (with perceptual-hash similarity as a fallback).
Thresholds: similarity >= 0.80 -> match_found; 0.60–0.80 -> similar (manual review).

Related:Registered trademark USPTO

MCP

The standard that lets AI assistants use VerifiedInbox tools for you.

MCP (Model Context Protocol) lets AI assistants like Claude, ChatGPT, or Cursor check your domain, inspect your email security, prepare your logo, and move your verification forward step by step.

Technical detail

Endpoint: See MCP server endpoint (Streamable HTTP, JSON-RPC 2.0).
Auth: Works anonymously with a guest_token, or with WorkOS OAuth / an API key for account tools.

Related:API key

MX record

Tells the internet which mail servers receive incoming email for your domain.

An MX (Mail Exchanger) record directs incoming email for your domain to your mailbox provider, such as Google Workspace, Microsoft 365, or Fastmail. It controls receiving email, while SPF and DKIM control sending email.

Technical detail

Format: <priority> <mail-server-hostname> (for example 1 smtp.google.com).
Priority: Lower numbers are tried first, with higher numbers acting as fallback servers.

Related:DNS record Mailbox provider

Organizational domain

Your main registered root domain, without any subdomain prefixes.

Your primary registered domain (such as yourcompany.com, as opposed to mail.yourcompany.com). DMARC and BIMI settings published on your organizational domain automatically cover your subdomains unless a subdomain publishes its own record.

Technical detail

Definition: The registrable domain computed from the Public Suffix List (public suffix + one label).
Fallback: DMARC and BIMI evaluators query the subdomain first and fall back to the organizational domain if no subdomain record exists.

Related:Domain Subdomain

PEM file

The standard certificate chain file hosted for your BIMI record.

A text file containing your issued mark certificate (with your SVG logo embedded inside it) plus the issuer's intermediate and root certificates. We assemble and host the complete PEM chain for you.

Technical detail

Format: Base64-encoded DER certificates between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers.
Chain order: Leaf entity certificate (containing the embedded SVG logotype), followed by intermediate CA certificate(s) and root CA certificate.

Related:Logo & certificate hosting BIMI

Prior use (12 months)

Proof your logo has been displayed publicly for at least a year.

To qualify for a CMC (logo without a trademark), you need to show that your logo has been used publicly for at least 12 months, such as on your company website. We check public web archives automatically to find that evidence for you.

Technical detail

Evidence: Historical captures (such as Internet Archive Wayback Machine snapshots) showing the mark on the applicant's domain at least 12 months prior to validation.

Related:CMC (Common Mark Certificate)

Registered trademark

Legal registration of your logo with a government trademark office.

An official government registration proving your logo belongs to your company. Gmail's blue checkmark (a VMC) requires an active registered trademark for your logo. We search the US Patent and Trademark Office (USPTO) for you automatically.

Technical detail

Eligible marks: Active registered design marks or combined word-and-design marks in an intellectual property office recognized by the AuthIndicators Working Group (first release: USPTO).

Reissue

Replacing your active certificate after a logo or company name change.

Because your exact logo is embedded inside your certificate, changing your logo requires a fresh certificate. A reissue requests an updated certificate within your current paid year.

Related:Renewal Revocation

Renewal

Mark certificates last up to 398 days; we renew them automatically every year.

BIMI mark certificates are valid for about 13 months (398 days). We track the expiration date, send reminders ahead of time, renew your certificate automatically 45 days before expiry, and update the hosted PEM file in place so your logo never disappears.

Technical detail

Maximum validity: 398 days under the AuthIndicators Mark Certificate Requirements (unaffected by the 47-day Web PKI TLS schedule).
Schedule: Automated renewal starts 45 days before not_after, with reminders at 60, 30, 14, 7, and 1 days.

Revocation

Permanently cancelling an issued certificate.

Cancels a certificate permanently so inboxes stop trusting it and stop showing your logo. Only revoke a certificate if your domain is no longer used or the certificate details are no longer valid.

Related:Reissue

Safe DMARC rollout

Tightening email protection in stages so legitimate company emails are never blocked.

If your company sends email every day across several tools (newsletters, billing, CRM, support), turning on strict DMARC blocking all at once could send a misconfigured tool's emails to spam. A safe rollout starts in watch mode (p=none) so reports reveal every sender, then moves to partial quarantine (25%), full quarantine (100%, which unlocks your inbox logo), and finally reject. Brand-new domains can skip the rollout and go straight to reject.

Technical detail

Stage 1 (Watch): v=DMARC1; p=none; rua=mailto:... (suggested 14 days to inventory senders).
Stage 2 (Partial filter): See example record (~7 days).
Stage 3 (Full quarantine, BIMI-ready): See example record (pct=100 implied).
Stage 4 (Strict block, recommended): v=DMARC1; p=reject; rua=mailto:...

SPF

The public guest list of servers and services allowed to send email for your domain.

SPF (Sender Policy Framework) is a public list on your domain naming the mail servers and services (such as Google Workspace, Microsoft 365, or Postmark) authorized to send email on your behalf. Receiving servers check the sending server's IP address against your list.

Technical detail

DNS host: @ (domain apex) or sending subdomain (TXT record only, RFC 7208).
Example: v=spf1 include:_spf.google.com ~all
Identity checked: Evaluates the Return-Path (RFC5321.MailFrom) and HELO/EHLO domain against the connecting client IP.
Limits: At most 1 v=spf1 record per domain, 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect), and 2 void lookups (0 answers or NXDOMAIN). Exceeding any limit returns PermError.

Related:DMARC DKIM Alignment

Subdomain

A prefix name under your main domain, like news.yourcompany.com.

A name that lives under your main domain, such as news.yourcompany.com or send.yourcompany.com. Many companies use separate subdomains for newsletters or automated receipts so each stream has its own SPF and DKIM settings.

Technical detail

SPF: Each subdomain has its own independent 10-lookup SPF budget.
DMARC & BIMI: Subdomains inherit the organizational domain's _dmarc (sp=) and default._bimi records unless overridden on the subdomain.

Related:Domain Organizational domain

SVG Tiny P/S

The strict, secure vector logo format required by BIMI.

Inboxes require your logo in a specialized, locked-down vector format called SVG Tiny Portable/Secure, with a square canvas and a solid background. You don't have to build it by hand: give us your normal logo and we convert and validate it automatically.

Technical detail

Root attributes: version="1.2" and baseProfile="tiny-ps" on <svg>, with no x= or y= attributes.
Dimensions: Square viewBox with explicit pixel dimensions (width="96" height="96" or larger for Gmail; never 100%) and file size <= 32 KB.
Required elements: <title> with your organization name and a solid background path.
Disallowed: Scripts, animations, external references/fonts, and embedded raster images (<image>).

Related:BIMI Logo & certificate hosting

Test mode (sandbox)

A safe practice environment where nothing is charged or issued.

Test mode lets you rehearse every step, including checkout and certificate issuance, without paying or ordering a real certificate. Switch it on from your dashboard; test data is kept completely separate from live domains.

Technical detail

Environment: test (selected via dashboard toggle, vi_test_… API key, or VI-Environment: test header).
Integrations: Uses Stripe test mode, the simulated certificate issuer, and simulated DNS for example.com domains.

Related:API key

Trademark filing service

Help registering your logo as a trademark.

If your logo isn't registered yet, we can help you file it. Email trademark@verifiedinbox.ai. Registration usually takes several months; meanwhile you may qualify for a CMC.

TTL

How long other servers cache a domain setting before checking for updates.

Short for “time to live”. It tells servers across the internet how long (in seconds) to remember a DNS record before asking your domain's nameservers for a fresh copy.

Technical detail

Unit: Seconds (for example 3600 = 1 hour).
Effect: Controls how long recursive DNS resolvers cache a record before re-querying your authoritative nameservers.

Related:Authoritative nameserver

TXT record

A DNS record that holds structured text for verification and email security.

A type of domain setting that stores a line of text. SPF, DKIM, DMARC, BIMI, and domain ownership checks all use TXT records.

Technical detail

Type: DNS TXT resource record (RR type 16).
Length rule: Individual character-strings inside a TXT record are limited to 255 octets; longer values (such as 2048-bit DKIM keys) are split into multiple quoted strings and concatenated without spaces by DNS resolvers.

Related:DNS record SPF DKIM DMARC BIMI

USPTO

The United States Patent and Trademark Office.

The US government agency that registers trademarks. We look up your company's logo there automatically.

Related:Registered trademark

VMC (Verified Mark Certificate)

The mark certificate that unlocks your logo and Gmail's blue checkmark.

A digital certificate issued by an accredited authority (such as DigiCert) that proves your logo is a registered trademark owned by your company. In Gmail, a VMC unlocks both your inbox logo and the blue verified checkmark.

Technical detail

Format: X.509 certificate with the BIMI extended key usage and your SVG Tiny P/S logo embedded in the logotype extension (RFC 3709).
Validation: Requires an active registered design trademark with a recognized intellectual property office (such as the USPTO) plus organization and contact validation.
Validity: Up to 398 days.

Was it helpful?