A logo shown next to the sender in the message list: that is BIMI’s promise (Brand Indicators for Message Identification). Behind this visibility gain sit a technical requirement — flawless authentication — and, for most mailbox providers, a paid certificate. This guide walks through the prerequisites, the logo format and the records to publish.
What BIMI changes in the inbox
BIMI is an open standard that lets a mailbox provider display a brand’s official logo next to its emails, both in the message list and in the header of the opened message. The goal is twofold: strengthen brand recognition and give the recipient a visual signal of legitimacy that is harder to fake than a mere sender name.
BIMI replaces nothing: it is a layer laid on top of existing authentication. Without properly configured SPF, DKIM and DMARC, no logo appears. BIMI rewards domains that are already clean; it does not fix the ones that are not.
The absolute prerequisite: aligned authentication
The entry condition is DMARC in strict enforcement. The published policy must be p=quarantine or p=reject, with pct=100: a p=none policy is not enough. This is where most projects stall, because moving a domain to reject without breaking legitimate mail requires a period of watching DMARC reports.
A domain that still regularly lands in the junk folder is not ready for BIMI anyway: it is better to deal with the causes of spam placement first, before considering a logo.
BIMI rewards domains that are already clean; it does not redeem failing authentication.
VMC or CMC: two certificates, two display levels
Most major mailbox providers require a certificate that attests the brand is entitled to use the logo. Two types coexist.
| Criterion | VMC (Verified Mark Certificate) | CMC (Common Mark Certificate) |
|---|---|---|
| Proof required | Registered trademark | Continuous logo use for at least 12 months |
| Gmail display | Logo + blue verified checkmark | Logo (brand avatar), no checkmark |
| Apple Mail | Supported | Supported |
| Validity | 397 days maximum | 397 days maximum |
The choice depends on the trademark portfolio: a company without a registered trademark can aim for a CMC to get the logo displayed, without the blue checkmark reserved for the VMC.
Preparing the logo: the SVG Tiny PS format
The logo must be an SVG file in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, square, served over HTTPS and preferably under 32 KB. This profile bans scripts, animations and external references: an SVG exported by a design tool almost always has to be cleaned up before publishing.
Watch out: a regular SVG is not an SVG Tiny PS. You have to remove the forbidden elements (<script>, external stylesheets, editor metadata), declare the baseProfile="tiny-ps" profile and check that the artwork fits in a square. A non-compliant logo is simply ignored by the provider, with no error message.
Publishing the BIMI DNS record
The record is published on the domain’s default._bimi selector as a TXT record. It points to the logo (l=) and, when a certificate is used, to that certificate (a=).
; Politique DMARC en application stricte (prerequis)
_dmarc.exemple.fr. IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]"
; Enregistrement BIMI : logo + certificat
default._bimi.exemple.fr. IN TXT "v=BIMI1; l=https://exemple.fr/bimi/logo.svg; a=https://exemple.fr/bimi/vmc.pem"The l= tag is mandatory; the a= tag is effectively mandatory for Gmail and Apple Mail, which only display the logo after validating the certificate. Once the record is published, a check is in order:
$ dig +short TXT default._bimi.exemple.fr
"v=BIMI1; l=https://exemple.fr/bimi/logo.svg; a=https://exemple.fr/bimi/vmc.pem"Provider support and common pitfalls
Gmail displays the logo provided a valid VMC or CMC accompanies the record. Apple Mail supports BIMI from iOS 16, iPadOS 16 and macOS Ventura, as well as on iCloud.com. Yahoo Mail displays the logo without requiring a certificate but recommends one. Propagation delays and provider-side caching mean a logo can take several days to appear.
Three pitfalls recur: a DMARC left at p=none, an SVG that does not comply with the Tiny PS profile, and an expired certificate — its validity capped at 397 days forces an annual renewal that is easy to forget.
What to take away
BIMI is not a deliverability lever in itself: it is the visual reward for authentication that is already solid. The path is linear — align SPF, DKIM and DMARC, move DMARC to quarantine or reject, prepare an SVG Tiny PS logo, obtain a VMC or a CMC, then publish the default._bimi record. Without a certificate, display stays limited to a few providers; with a VMC, Gmail adds the blue checkmark.
I rarely advise starting with BIMI. When a client tells me they want “their logo to show up in Gmail”, I look at their DMARC reports first: nine times out of ten the domain is not yet at reject, and that is where the real work is. BIMI comes last, like the cherry on top — good for the brand, but only once the authentication foundation is locked down. — Simon Janvier
Further reading: the official BIMI Group documentation.
