A BIMI setup lets supporting mailbox providers show your verified brand logo beside your messages. It takes four ingredients: DMARC at enforcement, a correctly prepared SVG logo, usually a certificate that proves you own the mark, and one DNS record. This guide covers each in order and how to test the result.
Provider support changes. Which providers show a logo, and whether they ask for a certificate, has changed over time. Check the current documentation for each provider you care about before you commit budget.
What BIMI gives you
| Benefit | Details |
|---|---|
| Brand recognition | Your logo appears next to the sender name in supporting inboxes |
| Trust signal | The logo appears only on authenticated mail, so it is harder to fake |
| A reason to finish DMARC | Enforcement becomes a visible business goal, not just a technical one |
| Not a delivery boost | It does not by itself move mail from spam to inbox |
Requirement 1: DMARC at enforcement
Receivers show a BIMI logo only for mail that passes DMARC from a domain with a policy of quarantine or reject at full coverage. If you are not there yet, get there safely first. Our guide to DMARC reports shows how to find legitimate senders before you enforce.
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"| DMARC policy | Qualifies for BIMI? |
|---|---|
| p=none | No |
| p=quarantine at full percentage | Yes |
| p=reject at full percentage | Yes |
| p=quarantine with pct below 100 | No, partial enforcement does not qualify |
Requirement 2: The logo file
- Format: SVG in the Tiny PS profile, not a standard SVG export.
- Shape: square, because providers crop it into a circle or square.
- Background: a solid colour, not transparent, so that the logo reads in light and dark themes.
- Content: no scripts, no external images or fonts and no animation.
- Hosting: an HTTPS URL on a server you control, reachable without login.
- Size: keep the file small, a few kilobytes, so it loads fast.
Requirement 3: A certificate (VMC or CMC)
| Type | What it proves | Typical need | Gmail display |
|---|---|---|---|
| VMC (Verified Mark Certificate) | You own the logo, usually through a registered trademark | Registered trademark for the exact logo | Logo and verified checkmark |
| CMC (Common Mark Certificate) | You have used the logo, without a registered trademark | Evidence of prior use | Logo, without the checkmark |
| No certificate | Nothing beyond DMARC | Only accepted by some providers | Often no logo in Gmail |
Certificates are issued by approved certificate authorities after identity checks. The process can take days to weeks and has a cost, so start it early. You receive a PEM file that you host on HTTPS and reference in the record.
Requirement 4: Publish the BIMI record
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem"| Tag | Meaning | Required |
|---|---|---|
| v=BIMI1 | Version of the record | Yes |
| l= | HTTPS URL of the SVG logo | Yes |
| a= | HTTPS URL of the certificate (VMC or CMC) | Needed by providers that require a certificate |
Test it
- Validate the record. Use a BIMI checker to confirm syntax, DMARC status, the logo profile and the certificate.
- Send test mail. Send authenticated messages to test accounts at the providers you target.
- Wait. Display can take time to appear and depends on provider caches and on your sending history.
- Check headers. Look for DMARC pass, and for BIMI-related headers where a provider adds them.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Validator reports no DMARC enforcement | Policy is none or pct is below 100 | Move to quarantine or reject at 100 percent |
| Logo fails validation | Not SVG Tiny PS, has scripts or a transparent background | Convert and re-test with the BIMI tools |
| Certificate error | Logo does not match the certificate or the certificate expired | Reissue with the exact logo file |
| Record not found | Wrong host name, such as missing default._bimi | Publish at default._bimi.yourdomain |
| Everything validates, no logo yet | Provider caching or low reputation or volume | Keep sending authenticated mail and recheck later |
Preparing for BIMI? Tell us your domain and current DMARC policy and we will help you plan the path to enforcement.
Further reading and sources
Frequently asked questions
What is BIMI?
BIMI stands for Brand Indicators for Message Identification. It is a standard that lets a sender publish a logo in DNS so that supporting mailbox providers can display it next to messages that pass authentication. It does not improve delivery by itself, but it makes your mail more recognisable.
Does BIMI improve deliverability?
Not directly. BIMI is a display feature that depends on strong authentication. The work you do to qualify, such as DMARC enforcement, usually does help your standing, and a visible logo can raise recognition and trust.
What are the DMARC requirements for BIMI?
Your domain needs a DMARC policy of quarantine or reject, applied to all mail, for the organisational domain and for subdomains. A policy of none does not qualify. Move to enforcement gradually, using DMARC reports to find legitimate senders first.
What is a VMC?
A Verified Mark Certificate is a digital certificate that ties your logo to your organisation, issued by an approved certificate authority after it checks your identity and, in the usual case, your registered trademark. Gmail can show a verified checkmark with a VMC.
What is a CMC?
A Common Mark Certificate is a related certificate for brands that do not have a registered trademark but can show that they have used the logo. Providers that accept it can display the logo, but the verified checkmark in Gmail is tied to a VMC.
What format must the logo have?
The logo must be an SVG file in the Tiny PS profile defined for BIMI. It should be square, simple, free of scripts and external references, and have a solid background. Normal SVG exports from design tools often need to be converted and checked before they are accepted.
Which mailbox providers support BIMI?
Support has covered large providers such as Gmail, Yahoo and Apple Mail, with differences in what each requires and displays. Support changes over time, and some providers, such as Outlook.com, have not shown logos from BIMI. Check current provider documentation before you plan around a specific provider.
Where do I publish the BIMI record?
Publish a TXT record at default._bimi followed by your domain, for example default._bimi.example.com. The value contains v=BIMI1, the l tag with the HTTPS URL of the logo and the a tag with the HTTPS URL of the certificate file, if you have one.
Why is my logo not showing even though the record is correct?
The usual causes are DMARC not at enforcement, a logo that fails the SVG profile, a certificate that is missing or does not match the logo, low sending reputation or volume at that provider, and caching delays. Test the record with a validator, then wait, because providers do not show logos instantly.
Do I need BIMI for every subdomain?
You can publish a record for each sending subdomain, or rely on the organisational domain, depending on how the receiver looks up records. Test the subdomains that you use in the From address, and make sure each has enforcement.