BIMI (Brand Indicators for Message Identification) lets a sender's logo appear next to their messages in supporting mailboxes. It is a brand and trust feature, not a deliverability fix: it does not get mail into the inbox, but it makes authenticated mail more recognizable once it is there. BIMI is also gated by prerequisites that tell you something about your email setup, because you cannot have it without strong DMARC.
The requirements chain
BIMI is a stack. Each layer must work before the next one matters.
- Working SPF and DKIM on the sending domain.
- DMARC at enforcement. Your policy must be
p=quarantineorp=reject, andpct=100if you use that tag. Ap=nonepolicy does not qualify. If your subdomain policy is weaker (sp=none), mail from subdomains may not qualify either. See the DMARC rollout guide. - A logo in the right format, hosted at a public HTTPS URL.
- A mark certificate (VMC or CMC) for providers that require one, referenced in the BIMI record.
- A BIMI DNS record at
default._bimi.<domain>.
Skipping to step 5 is the common beginner mistake. If DMARC is not enforced, the rest is ignored.
Step 1 and 2: DMARC enforcement
A record that qualifies:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"If you have not reached enforcement, that is your project. Most of the effort in BIMI is the DMARC rollout: finding all your senders and aligning them. Use the Email DNS Checker to confirm what policy is live.
Step 3: The logo file
BIMI uses a specific SVG profile called SVG Tiny Portable/Secure (SVG Tiny PS). Typical rules:
- The root element declares
version="1.2"andbaseProfile="tiny-ps". - A
<title>element is included, and commonly carries the brand name. - The image should be square, with a solid background (circular crop is applied by some clients, so keep key artwork away from the corners).
- No scripts, no external references, no embedded raster images, no animation.
- Keep the file small; guidance often cites a limit of about 32 KB.
Regular SVGs exported from design tools rarely comply. They tend to include editor metadata, gradients or filters the profile forbids, or baseProfile="full". Convert and validate with a BIMI-specific tool, and check the logo in your mailbox provider's checker if it offers one.
Host it where your DNS record can reference it, with a valid certificate on that web host (use the SSL Checker to confirm it is sound):
https://example.com/brand/bimi-logo.svgStep 4: VMC and CMC certificates
A mark certificate proves you are entitled to use the logo. There are two kinds:
| Type | What it proves | Typical requirement | What you may get |
|---|---|---|---|
| VMC (Verified Mark Certificate) | The logo is a registered trademark owned by you | A registered trademark in a recognized jurisdiction | Logo, and in Gmail the verified checkmark |
| CMC (Common Mark Certificate) | You have used the logo publicly for a time | Documented prior use of the logo, with no trademark registration required | Logo in supported clients, without the checkmark in Gmail |
Both are issued by certificate authorities that the BIMI ecosystem recognizes, after identity and logo validation, and they cost money and take time. Prices and lead times vary by issuer, so ask for quotes. The certificate is published as a PEM file at a public HTTPS URL.
Whether a certificate is mandatory depends on the mailbox provider. As of this writing, Gmail requires a VMC or CMC for logo display, Apple Mail requires a VMC, and some others display a logo without a certificate, but support changes, so check each provider's current documentation. Outlook-family products have not been widely reported to display BIMI logos.
Step 5: The BIMI DNS record
The record lives at the default selector under _bimi:
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/example-vmc.pem"Tags:
v=BIMI1: required version.l=: URL of the SVG logo.a=: URL of the certificate (PEM) containing the VMC or CMC. Optional if you are targeting a provider that does not require one.
To opt a domain out, publish v=BIMI1; l=;. Subdomains can have their own BIMI records at default._bimi.news.example.com, and receivers may fall back to the organizational domain's record.
Which providers show it
Provider support is the least stable part of BIMI. Reported behavior as of this writing, which you should re-check:
- Gmail: displays the logo with a VMC or CMC, and a verified checkmark with a VMC.
- Apple Mail: shows logos for domains with a VMC, on recent OS versions.
- Yahoo and some other providers: have supported BIMI logos, in some cases without a certificate.
- Microsoft Outlook: not generally reported to display it.
Do not promise stakeholders a universal logo. In practice you reach part of your audience.
How to test
- DNS: query the record.
dig +short TXT default._bimi.example.com- Certificate and logo fetch: the URLs must return 200 over valid HTTPS. Check them with the HTTP Status Checker. A redirect, a 404 or an expired certificate breaks BIMI silently.
- Authentication: send mail from the domain through the Email Deliverability Test and confirm DMARC passes with alignment.
- Headers: at a supporting receiver, look in the message headers for a BIMI result. Gmail, for instance, can add
BIMI-Selectorinformation when it evaluates a message. - Display: be patient. Logos do not always show up immediately after publishing, and a sender may need some reputation before a provider displays a logo.
Common reasons BIMI does not display
| Cause | Fix |
|---|---|
DMARC is p=none or pct below 100 | Move to enforcement |
| Mail sent from a subdomain with a weaker policy | Align sp= or publish a BIMI record and policy for that subdomain |
| SVG is not Tiny PS | Reconvert and validate |
| Certificate expired, mismatched logo, or wrong domain | Reissue; the certificate must match the SVG and domain |
| Logo or certificate URL not served over HTTPS | Fix hosting |
| Weak sender reputation or low volume | Providers may withhold display; keep sending authenticated mail |
| Message not authenticated for that send (forwarded, third party) | Ensure DKIM alignment on every sender |
Is BIMI worth it?
Decide with a clear head. BIMI will not improve deliverability by itself. Its value is brand recognition in the inbox, and there are real costs: certificate fees, design work, and the DMARC project. If you were going to reach enforcement anyway for anti-spoofing, BIMI is a reasonable finishing step for a brand that sends a lot of customer-facing email. If you have not yet got SPF, DKIM and DMARC right, start with the authentication guide.
Next steps
- Check what DMARC policy you publish with the Email DNS Checker.
- Draft a DMARC record using the SPF & DMARC Generator.
- Follow the DMARC rollout guide to reach enforcement.
- Confirm your logo host has a sound certificate with the SSL Checker.
- Test with a real message in the Email Deliverability Test.
FAQ
Do I need a VMC to use BIMI?
It depends on the mailbox provider. Gmail currently requires a mark certificate (VMC or CMC) and Apple Mail requires a VMC, while some providers display logos without one. Check each provider's current rules.
What is the difference between a VMC and a CMC?
A VMC requires a registered trademark and unlocks the verified checkmark in Gmail. A CMC accepts documented prior use of the logo without a trademark, but does not give the checkmark.
Will BIMI improve my inbox placement?
No. It only displays your logo for mail that already passes authentication and is accepted. It is a branding feature.
Can I use p=quarantine for BIMI?
Yes. BIMI requires enforcement, meaning quarantine or reject, with the policy applied to 100 percent of mail. p=none does not qualify.
Get notified when this guide updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.