BIMI: requirements and setup for a logo in the inbox

What BIMI is (and isn't)

Brand Indicators for Message Identification lets a domain owner publish a logo that participating mailbox providers show beside messages that pass DMARC. It's a reward for authentication, not a security control. It adds no protection on its own, and providers decide whether to show it based on your reputation.

Requirement 1: DMARC at enforcement

Your DMARC policy must be p=quarantine or p=reject. A monitoring-only p=none disqualifies the domain. If you publish a subdomain policy (sp=), it must also be at enforcement. Get here first using the DMARC rollout guide.

Requirement 2: The logo file

BIMI logos use a restricted SVG profile, SVG Tiny Portable/Secure ("SVG P/S"):

• Root element with version="1.2" and baseProfile="tiny-ps", and no x= or y= attributes on it.
• A <title> element containing your organisation's name.
• A square image, with a solid (non-transparent) background.
• No scripts, animation, external references or embedded raster images.
• Small: commonly cited guidance is 32 KB or less.
• Served over HTTPS as image/svg+xml, publicly reachable without authentication or bot-blocking.

Most design tools don't export SVG P/S directly. Convert an ordinary SVG with a dedicated tool, then validate it.

Requirement 3: A mark certificate

Certificates are issued by approved certificate authorities after identity and mark verification, and are renewed yearly.

Who shows what

• Gmail shows logos backed by a VMC or CMC; self-asserted records (no certificate) are not displayed.
• Apple Mail requires a VMC and its own verification.
• Yahoo and AOL may display logos with or without a certificate, depending on sender reputation.
• Microsoft Outlook and Microsoft 365 do not display BIMI logos as of 2026.

Requirement 4: The DNS record

default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

default is the selector most senders use. A different selector can be requested per message with a BIMI-Selector header, which is useful if one brand sends for several sub-brands.

Setup order

1. Get DMARC to enforcement and keep it there for a few weeks with clean reports.
2. Create and validate the SVG P/S logo, and host it.
3. Apply for a VMC (with a trademark) or a CMC (after 12 months of public logo use).
4. Host the certificate PEM, then publish the BIMI record.
5. Check the record with the DNS Name Lookup (choose BIMI), then send test messages to Gmail and Yahoo.

Common mistakes

• Publishing BIMI while DMARC is p=none. Nothing will display.
• A logo with a transparent background, or not square. Validators reject it.
• The logo URL behind a bot-protection challenge or redirect chain. Mailbox providers fetch it automatically and fail.
• Expecting the logo immediately. Providers cache, and they still weigh reputation.

From the field: Most small or mid-sized organizations do not bother with setting this up. It is worth it if you regularly send emails that carry great importance and you want to ensure users know they can trust what reaches their mailbox.

Sources

• Red Sift: BIMI in 2026: verified logos, CMCs and display
• BIMI Group