KoltrixWhere sender logos come from in Koltrix: BIMI, Gravatar and icons
Koltrix shows a picture beside each sender. How it picks one, why only some logos get a verified tick, what leaves your browser (nothing) and how to turn it off
On this page(10 sections)
Look at a Koltrix inbox and you will see a small picture beside each sender: a company logo, a person's photo or colored initials. They make a list faster to scan. They are also a trust question. A logo next to a message looks like a statement that the message really comes from that company, and a statement like that must be earned.
This post explains where each picture comes from, which ones carry a "verified" tick and why, what Koltrix does and does not send over the network, and how to change it. It describes how the feature works as of 14 October 2026.
The order Koltrix tries
For each sender, Koltrix uses the first of these that it has:
- A photo you chose for that contact.
- The sender's verified brand logo, from BIMI.
- The person's Gravatar photo, if they have one.
- The sender's website icon, for company addresses.
- Colored initials.
The initials are always underneath. A picture is only painted over them once it has loaded, so a missing or slow image never shows a broken tile and never moves the row.
Your own photo comes first
If you want a particular picture for someone, you can set it. Open a message, use the "Photo for …" control on the sender's tile, and upload a PNG, JPEG or WebP up to 512 KB. It is also available on the contact's card in the CRM. Koltrix crops it to a square, stores a 256-pixel version and uses it for that contact everywhere. Removing it brings back the automatic picture.
Your own photo beats everything because it is your decision, and nobody needs to verify it.
The verified logo: BIMI
BIMI (Brand Indicators for Message Identification) is a standard that lets a company publish its logo in DNS so that mail clients can show it next to messages. It is the only kind of picture in Koltrix that gets a small verified tick, because it is the only one a company has proved is theirs.
For a logo to appear, a lot has to be true:
- The message passed DMARC, and the sender's policy is enforcing, meaning
quarantineorreject. See SPF, DKIM and DMARC in plain English and moving DMARC from none to reject. - The domain publishes a BIMI record that points at an SVG logo.
- A certificate backs it. Koltrix checks the verified mark certificate (VMC or CMC) against pinned roots: it must be in date, cover the sender's domain, and match the logo. VMC vs CMC explains the two kinds.
- The logo file follows the rules for BIMI's SVG profile. BIMI SVG Tiny PS covers them.
Koltrix decides this once, when the message arrives, from the authentication result recorded by its own mail server, and stores the answer with that message. That matters for two reasons. A message that passed yesterday is not re-judged on today's DNS, and a spoofed message cannot borrow a logo because an address passed on another day.
Only a minority of senders have all of this, which is why most senders do not show a logo.
Photos and icons for everyone else
For senders with no verified logo, Koltrix can still show something useful, with a lower claim: no tick, and a tooltip that says what it is.
A Gravatar photo. Gravatar is a service where a person attaches a picture to their email address. Koltrix looks for one for the message's actual sender address. If there is none, nothing is shown.
A website icon. For a company address, Koltrix looks at the sender domain's website for its touch icon or favicon. It does not do this for free-mail and shared-infrastructure domains such as Gmail, Outlook, Yahoo or iCloud, or for mail-sending services, because the icon would belong to the provider, not to the sender.
Both are shown only when the message passed DMARC. That is the safeguard. Without it, anyone could send a message with a forged From address and get a well-known company's icon next to it. The pass is tied to the specific From address that authenticated, so one authenticated participant in a thread cannot lend its pass to another.
Mail that arrived before the feature went live was not checked this way and keeps its initials.
What leaves your browser: nothing
A common worry with sender pictures is that loading an image from a third party tells that party you are reading the message. Koltrix does not do that.
- Your browser only talks to Koltrix. Pictures are requested from Koltrix's own address. The server fetches Gravatar photos and website icons on your behalf.
- Fetches are careful. The server only requests secure addresses on the public internet, will not follow a redirect to a private address, limits size and time, and sends no cookies, no referrer and a fixed identifier.
- Everything is re-encoded. Whatever comes back is decoded and saved as a small 128-pixel PNG with no metadata. Koltrix never passes through the original file, and it never accepts SVG for these tiers.
- Results are cached. A found picture is kept for about a week and a "nothing there" answer for about a day, so a page full of unknown senders does not turn into a flood of lookups.
- Not found looks like nothing. Unknown senders get an empty answer, and your list shows initials.
The sender, Gravatar and the website therefore do not learn who is reading, or when.
Turning it off
Go to Settings → Reading and switch off "Show sender photos and logos from the web". With it off, Koltrix stops asking for Gravatar photos and website icons. Your own photos and verified BIMI logos still appear, because those involve no outside lookup beyond the sender's own published logo. The setting is stored per browser and applies across your open tabs.
Spotting a lookalike
Logos help, and they can mislead too. A pleasant picture is not a reason to trust a message. Check the address and the domain, not only the tile, and remember that a tick only says the sender's domain proved its own logo and passed authentication. It does not prove the person is who they claim to be. Display name spoofing and lookalike domain phishing show how convincing a forged message can be.
What is not done yet
- Search results still show initials. The search index does not hold the sender's address or the authentication result, so there is nothing to base a picture on.
- Contact photos you upload are not deleted from storage when a contact is deleted.
Your own logo going out
This post is about pictures you see. The other direction, showing your own logo in other people's inboxes, depends on the same BIMI setup, and Koltrix has a helper for it. That is the subject of the next post in this series, and a good first step is the BIMI readiness checklist.
Key takeaways
- Koltrix picks a picture in this order: your photo, verified BIMI logo, Gravatar, website icon, initials.
- Only the BIMI logo gets a verified tick, and it requires DMARC enforcement and a valid certificate.
- Gravatar photos and website icons appear only for messages that passed DMARC, never for free-mail domains, and without a tick.
- Your browser never contacts a third party. The server fetches, resizes and caches each picture.
- You can turn off outside lookups in Settings → Reading, and upload your own photo for any contact.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
