> Also null BIMI records as well Could be useful, but a successful attack on BIMI would require: - Getting access to the DNS of the domain (in which case the n

> Also null BIMI records as well Could be useful, but a successful attack on BIMI would require: - Getting access to the DNS of the domain (in which case the null record will simply be replaced) - Obtaining a VMC for the domain, which should not be possible due to the extended validation requirement for a VMC (such as: phone validation) - Spending ~$800 on a VMC > especially if one is going to use soft-fail. As explained in the article, if DMARC is deployed then softfail is equal to (hard) fail. With DMARC anything that is not an SPF pass, is not aligned, thus a fail. The only exception here would be a very old legacy email system that doesn't support DMARC. But those will also not support BIMI anyway. > Or maybe a malware symbol. BIMI should always require a VMC. It should be impossible to obtain a VMC with a 'malware symbol'. Unless of course you are willing to pay a lot to get it registered as your company logo at your trademark office.