Next to each message in many inboxes is a small circle showing the sender's initial or a generic avatar. Some brands show their actual logo there instead. That is BIMI, short for Brand Indicators for Message Identification. It is a standard that lets you publish your logo in DNS so supporting mailbox providers can display it beside your authenticated emails. It is not a shortcut to the inbox, but it is a visible reward for having your email authentication properly in order.
What BIMI is, and what it is not
BIMI connects three things: your domain's email authentication, a logo file in a specific format, and (for the major providers) a certificate proving you are entitled to use that logo. When a supporting provider receives a message from your domain that passes DMARC, it looks up your BIMI record, fetches the logo, checks the certificate if required, and may display the logo.
It is worth setting expectations:
- BIMI does not improve spam filtering in itself. Mail must already be authenticated and trusted for the logo to show.
- Display is at the mailbox provider's discretion. Meeting the requirements makes your logo eligible, not guaranteed.
- Support varies by provider and by app. Gmail, Yahoo and Apple Mail are among those that support it, each with its own criteria.
BIMI requirements
| Requirement | Detail |
|---|---|
| SPF and DKIM | Configured and passing for your sending domain |
| DMARC at enforcement | p=quarantine or p=reject, applying to all mail (no pct below 100), and the subdomain policy must not be none |
| Logo in SVG Tiny PS | A restricted SVG profile, square, served over HTTPS |
| Mark certificate | A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC); required by Gmail and Apple Mail |
| BIMI DNS record | A TXT record at default._bimi.yourdomain |
The DMARC requirement is the one that holds most organisations back, and for good reason: it means you have found and authenticated every legitimate source of your mail. BIMI is often the motivation that finally gets a domain from p=none to enforcement.
Step 1: Get DMARC to enforcement
If your DMARC record still says p=none, start there. Use aggregate reports to find every service sending as your domain, set up SPF and DKIM with alignment for each, and move to quarantine and then reject. Our SPF, DKIM and DMARC checker confirms your current policy and highlights gaps.
Step 2: Prepare the logo
BIMI requires the SVG Tiny Portable/Secure (SVG Tiny PS) profile, a cut-down version of SVG without scripts, external references or animation. A regular SVG exported from a design tool will usually be rejected. Practical guidance:
- Use a square logo with a solid background colour; inboxes crop it to a circle or rounded square.
- Keep the main mark centred with comfortable padding so it is not clipped.
- Include a
<title>element with your brand name, and setversion="1.2"andbaseProfile="tiny-ps"on the root<svg>element. - Remove
xandyattributes on the root element and any embedded raster images. - Keep the file small; a few tens of kilobytes at most is a sensible target.
- Host it on HTTPS at a stable URL, such as
https://example.com/brand/bimi-logo.svg.
Validators published by the BIMI Group and by certificate authorities will check the file before you publish.
Step 3: Obtain a mark certificate
A Verified Mark Certificate is issued by an approved certificate authority after verifying your organisation and confirming that the logo is a registered trademark with a recognised trademark office. Gmail shows a blue verified checkmark alongside senders with a VMC.
A Common Mark Certificate is a newer option for logos that are not registered trademarks; instead, the authority verifies that the logo has been in public use by your organisation for a period of time. Gmail accepts CMCs for displaying the logo, without the checkmark.
Both certificates cost money and require verification paperwork, and pricing varies by authority, so obtain quotes. The certificate is provided as a PEM file, which you host on HTTPS just like the logo.
Step 4: Publish the BIMI record
Create a TXT record at default._bimi under your domain:
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/vmc.pem"v=BIMI1: the version, required.l=: the HTTPS URL of the SVG logo.a=: the HTTPS URL of the VMC or CMC (the "authority evidence"). Leave it empty if you have no certificate, accepting that certificate-requiring providers will not show the logo.
The default selector is used unless your mail specifies another via a BIMI-Selector header, which lets different mail streams show different logos. Most organisations only need default. Confirm the record is visible with the DNS lookup tool or dig default._bimi.example.com TXT +short.
Step 5: Test and wait
Send messages to accounts at supporting providers. Logos can take some time to appear, because providers cache BIMI data and may require a history of good sending reputation. If nothing shows after a reasonable period, check in order: DMARC policy and pct, alignment in real message headers, logo format validation, certificate validity, and that both URLs return the files over HTTPS with valid certificates. The SSL checker helps with the last point.
Is BIMI worth it?
For brands that send a lot of email to consumers, a recognisable logo makes messages easier to spot and harder to imitate convincingly, because spoofers cannot pass your DMARC. The bigger benefit is often indirect: the work needed to qualify, namely full authentication and DMARC enforcement, protects your domain whether or not the logo ever appears.
Key takeaways
- BIMI lets supporting inboxes show your logo beside authenticated messages.
- You need SPF, DKIM, DMARC at quarantine or reject, an SVG Tiny PS logo, and for Gmail and Apple Mail a VMC or CMC.
- Publish the record at
default._bimi.yourdomainwith the logo and certificate URLs. - Display is at the provider's discretion; the authentication work is valuable regardless.