Short answer
BIMI (Brand Indicators for Message Identification) lets mailbox providers show your logo next to the email you send. You publish a TXT record at default._bimi.yourdomain.com that points to your logo as an SVG Tiny PS file and, for Gmail and Apple Mail, to a mark certificate (a VMC or CMC) that proves the logo is yours. Gmail, Yahoo Mail, Apple Mail and a few other providers display it.
It only works once your domain's DMARC policy is enforced, at p=quarantine or p=reject and applied to all mail. BIMI doesn't authenticate anything itself; it rewards a domain that is already protected. Gmail needs a certificate, Yahoo doesn't, and every provider decides for itself when to show the logo.
What BIMI is, and what it isn't
BIMI is a DNS record plus two files: your logo, and usually a certificate that ties the logo to your organization. When a message passes DMARC under an enforced policy, a provider that supports BIMI looks up your record, checks the logo and certificate, and shows the logo in the inbox list or the open message instead of a generic initial.
The specification is maintained by the BIMI Group and published as an IETF Internet-Draft. It isn't an RFC, and providers implement it with their own extra rules, which is why the same record can show a logo at Yahoo and not at Gmail.
What it isn't: an authentication method. SPF, DKIM and DMARC do the authenticating, and BIMI only builds on a domain where they already pass. None of the provider pages cited here says BIMI improves inbox placement on its own.
Which inboxes show BIMI logos
| Mailbox provider | Shows logos | Certificate | Other conditions |
|---|---|---|---|
| Gmail | Yes, in the inbox list and the open message | Required: VMC or CMC. A checkmark shows next to senders verified with a VMC | DMARC p=quarantine or p=reject, pct=100 |
| Yahoo Mail and AOL | Yes, in the mobile apps and desktop webmail | Not required. A VMC is used if the record has one | Enforced DMARC, bulk mail only, enough reputation and engagement |
| Apple Mail (macOS 13, iOS 16, iPadOS 16 and later) | Yes, when the recipient's mail provider has checked the message | A BIMI evidence document, for example a VMC the provider trusts | The provider must be on the BIMI Group's list and verified by Apple |
| Fastmail, La Poste, au (KDDI), Zone | Listed by the BIMI Group | Check each provider | Each provider sets its own rules |
| Outlook.com and Microsoft 365 | Not on the BIMI Group's list of providers that display logos | - | - |
From each provider's own documentation and the BIMI Group's list. Support changes, so check the linked pages before you buy a certificate.
Last checked on each vendor's public page.
The DMARC requirement
BIMI is only for domains that tell receivers to act on DMARC failures. Google's BIMI setup page says the policy must be quarantine or reject, that BIMI doesn't support p=none, and that pct must be 100. The BIMI Group's implementation guide adds that the policy must be at enforcement on the organizational domain and its subdomains, so an sp=none breaks it too.
; Works with BIMI
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
; Doesn't work with BIMI
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" ; monitoring only
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; pct=50; rua=mailto:dmarc@example.com" ; not 100%
_dmarc.example.com. TXT "v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@example.com" ; subdomains not enforcedThe logo: SVG Tiny PS
BIMI logos must be SVG files in the SVG Tiny Portable/Secure (Tiny PS) profile, a restricted form of SVG with nothing that can run or load anything. An ordinary SVG exported from a design tool usually isn't valid as it is. The requirements, from Google and the BIMI Group:
- The root
<svg>element hasbaseProfile="tiny-ps"andversion="1.2", and nox=ory=attributes. - A
<title>element with your company name. A<desc>element is recommended for accessibility. - A square image, centred, on a solid background. Transparent backgrounds may not display as expected.
- No scripts, animation, interactive elements, or external links and references beyond the XML namespaces.
- 32 KB or smaller.
- For Gmail, at least 96 by 96 pixels, set in absolute pixels rather than percentages.
- Served over HTTPS. The draft specification allows no other transport for the logo or the certificate.
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
<title>Example Inc</title>
<desc>Example Inc logo</desc>
<rect width="512" height="512" fill="#ffffff"/>
<!-- your logo's paths here: no scripts, no external images, no x or y on the root -->
</svg>A mark certificate contains your logo, which is why Google's example record leaves l= empty when a= is set. Get the SVG right before you order one: a different logo means a new certificate.
VMC vs CMC: which certificate you need
A mark certificate is a certificate from a certificate authority that confirms your organization is entitled to use the logo. It's published as a PEM file and referenced from your BIMI record. There are two kinds:
| Topic | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
|---|---|---|
| What it needs | A logo registered as a trademark with an office the issuers recognise | No trademark: a logo in use for at least 12 months and shown on your current website |
| Time to get one | The trademark can take 6 to 12 months, according to Google, plus the certificate's own validation | The certificate's validation only |
| Gmail | Accepted, with a checkmark next to the sender | Accepted. Google's page promises the checkmark for VMCs only |
| Yahoo | Not required; used if present | Not required |
| Apple Mail | Named by Apple as an example of evidence a provider can trust | Not mentioned in Apple's guidance |
| Issuers | Mark Verifying Authorities listed by the BIMI Group | Mark Verifying Authorities listed by the BIMI Group |
Sources: Google, Yahoo, Apple, GlobalSign on CMC requirements, BIMI Group issuer list.
Last checked on each vendor's public page.
At the time of writing the BIMI Group lists DigiCert, GlobalSign and SSL.com as Mark Verifying Authorities. Both certificate types are sold as paid, renewing certificates, and prices vary by issuer and term, so get a current quote from the issuer. If you already have a registered trademark for your logo, a VMC gets you the Gmail checkmark; if you don't, a CMC is the faster route to a logo in Gmail.
Publish your BIMI record, step by step
- 01Enforce DMARCGet to
p=quarantineorp=rejectwith nopctbelow 100 and nosp=none, on the domain in your From address and its organizational domain. Check it with the DMARC checker. - 02Make the SVG Tiny PS logoSquare, solid background,
baseProfile="tiny-ps", a<title>, under 32 KB. Validate it before you order a certificate, because the certificate is issued for that exact file. - 03Get a certificate if your providers need oneGmail needs a VMC or CMC; Yahoo doesn't. Order from a Mark Verifying Authority and download the PEM file it issues.
- 04Host both files over HTTPSFor example
https://example.com/bimi/logo.svgandhttps://example.com/bimi/vmc.pem. Public, no login, no redirect to a sign-in page. - 05Publish the TXT record at default._bimiHost
default._bimion your sending domain (some DNS dashboards want justdefault._bimi, others the full name). Value:v=BIMI1; l=your logo URL; a=your PEM URL. Google suggests a TTL of 3600. - 06Check it and waitLook it up with
dig, then send real mail to Gmail and Yahoo accounts. Google says the logo can take up to 48 hours to appear.
; With a certificate (VMC or CMC): the record Gmail needs
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
; Logo only, no certificate: enough for Yahoo, not for Gmail
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg"| Tag | Required | Value |
|---|---|---|
v | Yes | Always BIMI1 |
l | Yes | HTTPS URL of the SVG Tiny PS logo. Google's example leaves it empty when a= is set, since the certificate contains the logo |
a | No | HTTPS URL of the VMC or CMC as a PEM file. Empty, or left out, when you have no certificate |
# Expect one line starting with "v=BIMI1"
dig +short TXT default._bimi.example.com @1.1.1.1
# The logo and certificate must load over HTTPS without a redirect to a login
curl -sI https://example.com/bimi/logo.svg | head -1
curl -sI https://example.com/bimi/vmc.pem | head -1Subdomains: if you send from mail.example.com, receivers look for default._bimi.mail.example.com first and fall back to the organizational domain's record, per the draft specification. Yahoo says it prefers BIMI and DMARC set up on the organizational domain, so publishing at default._bimi.example.com covers the most ground.
Check BIMI and DMARC with Groundmail
The free DMARC checker looks up your DMARC policy and shows your BIMI record next to it, with what's still needed. For domains you send from with Groundmail, the domain page in the dashboard has a "Logo in the inbox (BIMI)" check that says whether a BIMI record is published and whether DMARC is at p=quarantine or p=reject yet.
The same analysis is in the API: GET /domains/{id} returns analysis.dmarc with the parsed policy, and analysis.bimi with the record, its l= logo location and a= certificate location, and requires_dmarc_enforcement (domains docs). These checks read your DNS. They don't validate the SVG file or the certificate itself, so check those with your certificate issuer.
To get to enforcement safely, free DMARC monitoring reads your aggregate reports, shows every service sending as your domain and its pass rate, and tells you when it's safe to move from p=none to p=quarantine.
Common mistakes
| Mistake | What happens | Fix |
|---|---|---|
DMARC at p=none | No provider shows the logo | Move to p=quarantine or p=reject once reports are clean |
pct below 100, or sp=none | Treated as not enforced | Remove pct (or set 100) and sp=none |
| An ordinary SVG | The logo is rejected | Convert to SVG Tiny PS: baseProfile="tiny-ps", version="1.2", a <title>, no scripts or external references |
| Transparent or non-square logo | Displays badly or cropped | Square, centred, solid background |
| Logo-only record and expecting Gmail | Nothing shows in Gmail | Gmail needs a VMC or CMC in a= |
| Record on the wrong host | Lookup finds nothing | Some DNS dashboards append the domain: enter default._bimi, not the full name twice |
| Files behind a redirect, login or HTTP | The provider can't fetch them | Serve both over HTTPS, publicly |
| Certificate expired | The logo disappears | Renew before expiry and keep the PEM URL the same |
| Testing with a few personal messages at Yahoo | No logo | Yahoo shows logos on bulk mail from senders with enough reputation |
Frequently asked questions
What is BIMI?
Brand Indicators for Message Identification: a standard that lets mailbox providers show your logo next to messages from your domain. It needs DMARC at enforcement, an SVG Tiny PS logo, a TXT record at default._bimi, and for Gmail a VMC or CMC certificate.
What is a BIMI record?
A DNS TXT record at default._bimi.yourdomain.com with the value v=BIMI1; l=<logo URL>; a=<certificate URL>. l= points to your SVG Tiny PS logo and a= to your VMC or CMC as a PEM file, both over HTTPS.
Do I need a VMC for BIMI?
For Gmail you need a mark certificate, either a VMC or a CMC. Yahoo doesn't require one. Apple Mail relies on the recipient's mail provider having verified evidence such as a VMC. A VMC needs a registered trademark; a CMC needs a logo that has been in use for at least 12 months.
What's the difference between a VMC and a CMC?
Both are certificates that tie your logo to your organization. A VMC requires the logo to be a registered trademark and, in Gmail, adds a checkmark next to your name. A CMC doesn't need a trademark, only proof the logo has been in use for at least 12 months and is on your current website.
Can I use BIMI with DMARC p=none?
No. Google says BIMI doesn't support p=none, and the BIMI Group requires enforcement (quarantine or reject) on the organizational domain and its subdomains, at 100%.
Why isn't my BIMI logo showing in Gmail?
Check, in order: DMARC is at quarantine or reject with pct 100; the record is at default._bimi on the right domain; the record has an a= link to a valid VMC or CMC; the SVG is Tiny PS and matches the certificate; both files load over HTTPS. Google says changes can take up to 48 hours to show.
Does Outlook support BIMI?
Outlook.com and Microsoft 365 aren't on the BIMI Group's list of providers that display BIMI logos.
Does BIMI improve deliverability?
Not directly. BIMI requires an enforced DMARC policy, which protects your domain from spoofing, and Yahoo only shows logos for senders with enough reputation. None of the provider documentation we cite says BIMI itself moves mail out of spam.
Sources
Facts on this page about other companies' products, prices and policies come from these public pages. They change, so check them before you decide.
- BIMI Group: Implementation guide
- BIMI Group: Where is my BIMI logo displayed?
- BIMI Group: Creating BIMI SVG logo files
- BIMI Group: Mark Verifying Authorities
- Google Workspace: Set up BIMI
- Google Workspace: Add a BIMI TXT record
- Yahoo Sender Hub: BIMI
- Apple Developer: Prepare your email server for BIMI support in Apple Mail
- GlobalSign: Common Mark Certificate requirements
- IETF draft: Brand Indicators for Message Identification