Guides

BIMI: what it is and whether you need it

30 October 2026

BIMI (Brand Indicators for Message Identification) is a DNS record that points mailbox providers to your logo, so they can show it next to your messages. It only works once your DMARC policy is at quarantine or reject, and Gmail also wants a paid mark certificate. It does not change delivery. Most small senders do not need it yet. Fix SPF, DKIM, and DMARC first, because BIMI cannot start until they are done.

What BIMI does, and what it does not

The BIMI Group’s FAQ for senders describes it as a standard that lets a sending domain publish a logo in DNS that mailbox providers can consider displaying. Two parts of that description matter:

• “Can consider displaying.” BIMI does not guarantee a logo. The FAQ says each provider’s own policies decide if and when it shows.
• “Does not change message delivery.” The BIMI Group says so directly. A logo will not move mail out of spam. Authentication and reputation do that.

What BIMI does give you is a visible brand mark in the inbox, and with Gmail, a checkmark next to senders verified with a Verified Mark Certificate. That is a marketing benefit, not a deliverability fix.

Who shows BIMI logos

The BIMI Group FAQ links support pages for Apple, AU, Fastmail, Gmail, La Poste, Onet Poczta, Yahoo, Zoho Mail, Zone, and Zoner, and warns that the list may not be complete. Google’s Set up BIMI page notes that the logo shows in email clients that support BIMI, and that non-Gmail web apps do not support Gmail’s version of the feature.

Microsoft’s Outlook is not on the BIMI Group’s list.

What you need

1. DMARC at enforcement

This is the gate. Google’s page says the DMARC policy must be p=quarantine or p=reject, and pct must be 100. The BIMI Group says the same: p=none or a pct under 100 does not count as enforcement, and most providers that support BIMI require enforcement before they consider a logo. Yahoo requires quarantine or reject too.

Getting to enforcement safely is the bulk of the work. See our guide to DMARC policies for the rollout, and why DMARC fails for the problems you will hit on the way.

2. A logo in the right SVG format

BIMI logos use a restricted SVG profile called SVG Tiny Portable/Secure (baseProfile="tiny-ps", version 1.2). From Google’s page and the BIMI Group FAQ:

• No external links, scripts, animations, or embedded raster images.
• A square shape. Google recommends centering the logo in a square with a solid background.
• Gmail requires at least 96 by 96 pixels, in absolute pixels.
• Google recommends keeping the file to 32 KB or less, with a <desc> element.
• Served over HTTPS, with the content type image/svg+xml.

The BIMI Group also suggests a simple, high-contrast design, since the logo has to stay recognizable at about 20 to 24 pixels. A standard SVG export from a design tool will usually need converting to the Tiny PS profile.

3. A mark certificate, for Gmail

Google requires a certificate from a third-party issuer, one of two kinds:

• Verified Mark Certificate (VMC). Google’s recommended option. Your logo must be a registered trademark with an IP office that VMC issuers recognize. Google notes that registering a trademark can take 6 to 12 months. A VMC brings the checkmark in Gmail.
• Common Mark Certificate (CMC). For logos that are not trademarked. Check the issuer’s eligibility rules.

The BIMI Group lists issuers on its site. It does not give prices and says to expect an annual fee that varies by issuer and term. Get quotes before you commit, and budget for renewal every year.

Yahoo is the main exception. The BIMI Group FAQ says Yahoo accepts a self-asserted BIMI record and may show a logo without a certificate, though it shows logos only on bulk mail. Gmail and Apple require a certificate.

4. The BIMI DNS record

A TXT record at default._bimi on your domain. The BIMI Group’s example:

default._bimi.example.com  TXT  "v=BIMI1; l=https://www.example.com/brand/logo.svg; a=https://www.example.com/brand/vmc.pem;"

• v=BIMI1 is required.
• l= is the HTTPS URL of the SVG logo.
• a= is the HTTPS URL of the certificate file (PEM). Optional in the spec, but required by providers that want a certificate.

Google’s page gives the certificate-only form, v=BIMI1;l=;a=https://…/certificate.pem, since the VMC file contains the logo. It asks for the PEM to include the intermediate and root certificates, served over HTTPS with TLS 1.2 or later, and says the logo can take up to 48 hours to appear after you publish.

Do you need it?

BIMI is not part of the Gmail and Yahoo sender requirements. Those rules ask for SPF, DKIM, and DMARC at p=none or stronger. No provider requires a logo to deliver your mail.

It may be worth it if

• You send a lot of marketing email to Gmail and Apple Mail users, and brand recognition in a crowded inbox matters to you.
• Your logo is already a registered trademark, so a VMC is within reach.
• Your DMARC is already at quarantine or reject at 100%, with clean reports.
• You are a target for impersonation, and a checkmark helps customers tell your mail from fakes.

Skip it for now if

• Your DMARC is still at p=none. That is the real project. BIMI cannot start until it is done.
• Your logo is not trademarked and you mainly mail Gmail users. A CMC is the alternative, but you will still pay yearly for a certificate.
• You send mostly one-to-one business email. The logo matters most where people scan a list of brand messages.
• You are hoping it will fix spam-folder placement. It will not.

The useful part of chasing BIMI is the DMARC enforcement it requires. Getting to p=quarantine or p=reject asks receivers to filter or refuse mail that spoofs your exact domain, with or without a logo.

Order of work

1. Publish SPF and DKIM for every service that sends as your domain. See creating an SPF record and setting up DKIM.
2. Publish DMARC at p=none with reports, and fix every failing legitimate source.
3. Move to p=quarantine, then to full enforcement with no pct below 100.
4. Prepare the SVG Tiny PS logo and host it on HTTPS.
5. For Gmail and Apple, get a VMC (trademarked logo) or a CMC from an issuer the BIMI Group lists.
6. Publish the default._bimi TXT record, and wait up to 48 hours.

Sources

• Google Workspace: Set up BIMI
• BIMI Group: FAQs for senders and ESPs (checked October 2026)
• RFC 9989: DMARC