What is BIMI and how does it show your logo in email?

BIMI (Brand Indicators for Message Identification) is an email standard that lets supporting inboxes, such as Gmail, Apple Mail and Yahoo, display your brand's logo next to messages from your domain. You publish a TXT record at default._bimi.yourdomain that points to your logo in a special SVG format and, for most mailbox providers, to a mark certificate that proves you're entitled to use it. The logo only appears when the message passes DMARC at an enforcement policy of quarantine or reject, so BIMI is effectively a visible reward for having strong email authentication in place.

BIMI is popular with marketing teams because the logo makes emails more recognisable in a crowded inbox, and popular with security teams because it gives them a business reason to finish their DMARC rollout. In this article you'll learn how BIMI works when a message arrives, exactly what you need before you start, how to prepare the SVG logo and certificate, how to publish and test the DNS record, and which mailbox providers support it.

How BIMI Works

When a message arrives at a mailbox provider that supports BIMI, the receiving system does the following:

1. Authenticates the message: It checks SPF, DKIM and DMARC as usual.
2. Checks the DMARC policy: The domain in the visible From address must pass DMARC, and its published policy must be p=quarantine or p=reject. A policy of p=none doesn't qualify.
3. Looks up the BIMI record: It queries DNS for a TXT record at default._bimi.example.com, or at a different selector if the message includes a BIMI-Selector header.
4. Fetches the logo and certificate: It downloads the SVG from the l= URL and, where required, the mark certificate from the a= URL, and checks that the certificate is valid and matches the logo.
5. Applies its own policies: The provider may also consider your sending reputation and volume.
6. Displays the logo: If everything passes, your logo replaces the generic initial or avatar next to your messages.

Mailbox providers usually cache the logo, so they don't fetch it for every message.

Where the Logo Appears

The logo typically shows up in the inbox list beside the sender's name and in the open message header. In Gmail, a domain with a Verified Mark Certificate also gets a blue checkmark next to the sender name, with a note that the sender has verified that they own the domain and logo.

What You Need Before Setting Up BIMI

BIMI has stricter prerequisites than most DNS records. Work through these first.

1. DMARC at Enforcement

Your domain needs a DMARC record with a policy of quarantine or reject, applied to all mail:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Some details matter:

• pct must be 100: If you use pct= to apply your policy to only a percentage of messages, BIMI won't work. Leave pct out, since it defaults to 100.
• The organisational domain counts too: If you send from news.example.com, the policy for example.com must also be at enforcement, and its subdomain policy (sp=) must not be none.
• Get there safely: If you're still at p=none, read your DMARC reports, make sure every legitimate sending service passes SPF or DKIM with alignment, then move to quarantine and finally reject.

You can check your current policy with:

dig +short TXT _dmarc.example.com

"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

2. Strong Authentication on Every Sender

Every service that sends email as your domain, including your marketing platform, help desk and billing system, must pass DMARC. If a third party sends unauthenticated mail, it'll be quarantined or rejected under your enforcement policy, and it won't get the logo.

3. A Logo in SVG Tiny Portable/Secure Format

BIMI logos must be in SVG Tiny Portable/Secure (SVG Tiny P/S), a restricted profile of SVG designed to be safe to display in email clients. An ordinary SVG exported from a design tool won't pass.

4. A Mark Certificate (for Most Providers)

Gmail and Apple Mail require a certificate that verifies your right to use the logo. There are two types:

Certificate	Requirement	Gmail display
Verified Mark Certificate (VMC)	Logo is a registered trademark with a recognised trademark office	Logo and blue checkmark
Common Mark Certificate (CMC)	Logo has been publicly displayed on your domain for at least a year, with no trademark needed	Logo without checkmark

Both are issued by a small number of certificate authorities, including DigiCert, Sectigo and GlobalSign. The process involves verifying your organisation and your rights to the logo, which takes longer than an ordinary TLS certificate, and certificates are paid annually. Prices vary between issuers, so compare current offers. Check each mailbox provider's documentation for which certificate types it accepts, since Gmail accepts both but support elsewhere differs.

Preparing Your BIMI Logo

SVG Tiny P/S Requirements

The key rules for a BIMI SVG are:

• The root <svg> element must include version="1.2" and baseProfile="tiny-ps".
• It must contain a <title> element, normally your company name.
• No scripts, animation, interactivity or external references, including linked images and fonts.
• No raster images embedded inside the SVG.
• A square aspect ratio, because providers crop logos into circles or rounded squares.
• A solid background colour is strongly recommended, so the logo looks right in both light and dark themes.
• Keep the file small; 32 KB is a common recommended maximum.

Here's a minimal valid structure:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
     viewBox="0 0 512 512">
  <title>Example Ltd</title>
  <rect width="512" height="512" fill="#1d4ed8"/>
  <circle cx="256" cy="256" r="150" fill="#ffffff"/>
  <path d="M196 196h120v40h-80v20h70v40h-70v20h80v40H196z" fill="#1d4ed8"/>
</svg>

Keep the logo centred with some padding, because the circular crop in many inboxes cuts off the corners.

Converting an Existing Logo

Most design tools export standard SVG, which needs cleaning up. Common steps are:

1. Export from your design tool as SVG with text converted to outlines, so no fonts are referenced.
2. Remove any embedded bitmaps, gradients defined by external references, filters and scripts.
3. Edit the root element to add version="1.2" and baseProfile="tiny-ps", remove x and y attributes, and add a <title>.
4. Check that the viewBox is square.
5. Run it through a BIMI SVG validator, such as the one provided by the BIMI Group, or your certificate authority's checker.

If you're getting a VMC or CMC, use exactly the same SVG file for the certificate application and for hosting, since the certificate embeds the logo and the two must match.

A Quick Local Check

Before using an online validator, this Python script catches the most common problems:

#!/usr/bin/env python3
"""Basic checks for a BIMI SVG Tiny P/S logo."""
import os
import sys
import xml.etree.ElementTree as ET

SVG_NS = "{http://www.w3.org/2000/svg}"

def check(path: str) -> list[str]:
    problems = []
    if os.path.getsize(path) > 32 * 1024:
        problems.append("file is larger than 32 KB")

    root = ET.parse(path).getroot()
    if root.tag != f"{SVG_NS}svg":
        problems.append("root element is not an SVG")
    if root.get("version") != "1.2":
        problems.append('missing version="1.2"')
    if root.get("baseProfile") != "tiny-ps":
        problems.append('missing baseProfile="tiny-ps"')
    if root.find(f"{SVG_NS}title") is None:
        problems.append("missing <title> element")

    viewbox = root.get("viewBox", "").replace(",", " ").split()
    if len(viewbox) == 4 and float(viewbox[2]) != float(viewbox[3]):
        problems.append("viewBox is not square")

    for element in root.iter():
        name = element.tag.replace(SVG_NS, "")
        if name in {"script", "image", "foreignObject", "animate", "set"}:
            problems.append(f"forbidden element <{name}>")
        for attr in element.attrib:
            if attr.endswith("href"):
                problems.append(f"external reference on <{name}>")
    return problems

if __name__ == "__main__":
    issues = check(sys.argv[1])
    print("\n".join(issues) if issues else "No obvious problems found")

Run it with python3 bimi_check.py logo.svg. It's not a full validator, but it catches the issues that most often cause rejection.

Publishing the BIMI Record

Host the Files

Upload the SVG, and the certificate PEM file if you have one, to a public HTTPS URL on a server with a valid TLS certificate. A dedicated path keeps things tidy:

• https://example.com/bimi/logo.svg
• https://example.com/bimi/vmc.pem

Check that both are publicly reachable and served with sensible content types:

curl -sI https://example.com/bimi/logo.svg | grep -iE '^(HTTP|content-type)'

HTTP/2 200
content-type: image/svg+xml

The URLs must not redirect to a login page or be blocked by bot protection, because mailbox providers fetch them automatically.

Add the TXT Record

Create a TXT record at the default._bimi subdomain:

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

The tags are:

• v=BIMI1: The version, which must come first.
• l=: The HTTPS URL of your SVG logo.
• a=: The HTTPS URL of your VMC or CMC in PEM format. Leave it empty (a=;) if you don't have a certificate, which some providers, such as Yahoo, may still accept.

In most DNS dashboards, you enter default._bimi as the name and the quoted value as the content.

Using Different Logos With Selectors

If you want a different logo for one stream of mail, such as a sub-brand, publish another record at a different selector:

brand2._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/bimi/brand2.svg; a=https://example.com/bimi/brand2.pem"

Then configure that sending platform to add this header to its messages:

BIMI-Selector: v=BIMI1; s=brand2;

Messages without the header use the default selector.

Subdomains

If you send from a subdomain such as mail.example.com, providers look for default._bimi.mail.example.com first, and fall back to the organisational domain's record, default._bimi.example.com, if it isn't there. One record at the apex can cover all your subdomains.

Testing Your BIMI Setup

Confirm the record is published correctly:

dig +short TXT default._bimi.example.com

"v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Then check the full chain:

1. Validate with a BIMI checker: The BIMI Group and several email security vendors provide free inspectors that check the DMARC policy, the record, the SVG and the certificate in one go.
2. Inspect the certificate: You can read the PEM with OpenSSL to check its subject and expiry date:

curl -s https://example.com/bimi/vmc.pem -o vmc.pem
openssl x509 -in vmc.pem -noout -subject -issuer -enddate

3. Send real test messages: Send to a Gmail account and an Apple Mail account. Display isn't instant: providers cache results and may take from a few hours to several days to show your logo the first time.

Which Mailbox Providers Support BIMI?

Provider	BIMI support	Certificate
Gmail	Yes	VMC or CMC required; VMC adds a blue checkmark
Apple Mail (iOS, iPadOS, macOS)	Yes	Mark certificate required
Yahoo Mail and AOL	Yes	Certificate not always required, subject to sender reputation
Fastmail and some others	Varies	Check the provider's documentation
Microsoft Outlook	Not supported at the time of writing	Microsoft uses its own sender display features

Support changes over time, so check each provider's current documentation before you commit to a certificate type.

Common BIMI Problems

• DMARC at p=none or pct below 100: The most common reason logos don't appear.
• An SVG that isn't Tiny P/S: Missing baseProfile="tiny-ps", embedded images or fonts, or a non-square shape.
• Logo and certificate don't match: The SVG you host must be the same one embedded in your VMC or CMC.
• Files not reachable: Redirects, firewalls or bot protection blocking the mailbox provider.
• Expired certificate: Mark certificates expire like any other, and when they do the logo disappears. Put the renewal date in your calendar.
• Low sending reputation: Providers may withhold the logo from new or low-volume senders even when everything else is correct.

---

FAQ: BIMI

---

Conclusion

BIMI lets inboxes show your brand logo next to authenticated email, using a single TXT record at default._bimi that points to an SVG Tiny P/S logo and, for Gmail and Apple Mail, a Verified or Common Mark Certificate. The logo only appears for messages that pass DMARC under a quarantine or reject policy, which is what makes it hard for spoofers to copy.

Treat BIMI as the final step of an email authentication project. Get SPF, DKIM and DMARC fully enforced first, then prepare a compliant logo, choose the right certificate, publish the record and test with real inboxes. The result is a more recognisable inbox presence and a clear signal to your customers that your email is genuine.