BIMI Explained

Published 27 April 2026

Brand Indicators for Message Identification (BIMI) is a standard that displays your verified brand logo alongside emails from your domain in supporting inboxes — Gmail, Yahoo, AOL, Apple Mail, and an increasing number of others. To recipients, it's the difference between an anonymous "from" line and a clearly branded message that looks like it came from a real, verified sender.

BIMI also has a real practical purpose: it gives senders a tangible reward for completing DMARC enforcement. Until BIMI, the security benefit of DMARC was abstract to non-technical stakeholders ("we're now harder to spoof"). With BIMI, completing DMARC produces a visible logo in your customers' inboxes — concrete enough to justify the rollout effort.

What BIMI Looks Like

In a Gmail inbox, BIMI-supported senders show their logo as the round "avatar" next to the sender name. Without BIMI, Gmail shows a generic letter (the first letter of the sender domain). With BIMI, the same email shows your custom logo. Apple Mail does the same in its message list. Yahoo and AOL show the logo in the message header.

The logo is fetched from your DNS — specifically, an SVG file at a URL you publish. As long as the message passes DMARC at p=quarantine or p=reject, the receiver looks up your BIMI record and renders the logo.

What BIMI Requires

1. DMARC enforcement. Your domain must publish DMARC at p=quarantine or p=reject. p=none doesn't qualify. (Domains with p=none can publish a BIMI record but receivers won't display the logo.)
2. An SVG logo formatted to a specific subset of the SVG spec — SVG Tiny PS Portable/Secure 1.2. Most existing logos need to be re-exported.
3. A BIMI DNS record pointing to the logo URL.
4. (Optional but increasingly required) a Verified Mark Certificate (VMC) proving you legally own the trademark on the logo.

The VMC is what determines which receivers actually display your logo. Some — like Gmail — require a VMC. Others — like Yahoo and AOL — accept logos without VMCs (so-called "self-asserted" BIMI). Without a VMC, you're only getting partial coverage.

The Verified Mark Certificate

A VMC is a digital certificate issued by a Certificate Authority (similar to an SSL certificate, but for logos rather than domains). The CA verifies that:

• You own the trademark on the logo.
• The trademark is registered in a recognised jurisdiction (usually a national trademark office).
• You operate the domain.

VMCs cost roughly $1,000–$2,000 USD per year, depending on the CA and discounts. They're issued only by a small number of CAs (DigiCert, Entrust). Issuance takes 1–4 weeks.

The trademark requirement is the gating one for many businesses. If your logo isn't a registered trademark, you can't get a VMC. Registering a trademark itself takes 6–18 months and costs $200–$2,000 in filing fees per country, plus optional legal counsel.

For larger brands with existing trademark registrations, BIMI is a no-brainer add-on once DMARC is at p=reject. For small businesses without registered trademarks, the cost-benefit gets harder.

The DNS Record

The BIMI record is a TXT record at default._bimi.{domain}. Minimum form:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg"

With a VMC:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

• v=BIMI1 — version marker.
• l=URL — URL where the SVG logo is hosted.
• a=URL — URL where the VMC PEM file is hosted (optional but required by Gmail).

The selector default applies to all mail from the domain. You can use other selectors (e.g. marketing._bimi.example.com) for different sending patterns, but most domains just use default.

The SVG Constraints

BIMI's SVG profile is deliberately restricted to prevent abuse — a malicious SVG could otherwise execute scripts or load external resources. The required profile (SVG Tiny PS) bans:

• JavaScript and event handlers.
• External resource loading (no <image>, no remote fonts).
• Scripts, animations beyond simple SMIL.
• Foreign objects, iframes, links.

The SVG must be:

• Square aspect ratio.
• Under 32KB.
• Self-contained — no external references.
• A specific baseProfile="tiny-ps" attribute set on the root element.

Most existing logos need re-export. Adobe Illustrator, Inkscape, and online tools (BIMI Inspector, Valimail's BIMI checker) can convert standard SVGs to BIMI-compliant ones. After conversion, validate it before publishing.

The Setup Steps

1. Confirm DMARC is at p=quarantine or p=reject. No point setting up BIMI before this.
2. Convert your logo to BIMI-compliant SVG. Use a tool, validate the result.
3. Host the SVG on HTTPS at a stable URL. Browsers and mail clients will fetch it; performance and uptime matter.
4. (Optional but recommended) Apply for a VMC through a CA. Allow 1–4 weeks for issuance.
5. Publish the BIMI TXT record at default._bimi.example.com.
6. Send a test message to a Gmail or Yahoo account that supports BIMI. Confirm the logo appears.
7. Re-test after 24-48 hours. Some receivers cache BIMI lookups; the logo may take a day to fully propagate.

What to Expect After Launch

Coverage of BIMI in 2026:

• Gmail — displays logos with valid VMC. Around 1.8 billion accounts.
• Apple Mail — supports BIMI without requiring a VMC.
• Yahoo and AOL — support BIMI without requiring a VMC.
• Microsoft 365 / Outlook — partial support; rolling out in stages.
• Others — Fastmail, La Poste, and a handful of smaller providers support it.

Together, these cover roughly 70-80% of consumer email worldwide. For B2B mail, coverage is lower — Microsoft 365 dominates business mail and is the laggard on BIMI.

You typically won't see the logo on your own messages because most clients suppress avatars on self-sent mail. Test by sending to an outside address (a personal Gmail account, for instance).

Is BIMI Worth It?

For consumer-facing brands with:

• An existing registered trademark on the logo.
• DMARC already at p=reject (or close).
• A meaningful share of marketing email going to Gmail/Yahoo/AOL recipients.
• Brand recognition that benefits from a logo on every message.

The answer is yes — the VMC pays for itself in trust signal alone. BIMI also has a measurable engagement lift — open rates on BIMI-displayed mail are typically 5–15% higher than non-BIMI baseline. For high-volume marketing programs, that's significant revenue.

For:

• Small businesses without a registered trademark.
• Domains primarily sending B2B mail (low BIMI coverage in business inboxes).
• Domains still working through DMARC rollout.
• Internal-only domains.

The VMC cost is hard to justify. You can still publish BIMI without a VMC (the "self-asserted" form) — it'll work in Yahoo, AOL, and Apple Mail at no cost beyond the SVG conversion and DNS update. That's a free upgrade for the receivers that don't require VMCs.

The Honest Recommendation

Phase 1 (free): convert your logo to BIMI-compliant SVG, host it, publish the BIMI TXT record without a VMC. You get logos in Yahoo, AOL, and Apple Mail. Cost: a few hours of one-off work.

Phase 2 (paid, when ready): apply for a VMC if Gmail coverage matters and your trademark is registered. Cost: ~$1,500/year + setup time. Adds Gmail coverage, which is most consumer mail.

Pre-requisite for both phases: DMARC at p=quarantine or p=reject. If you're not there yet, that's the project to do first — see our DMARC progression guide.

And once you have BIMI live, run periodic checks via DMARC Dashboard to confirm DMARC is still at the policy level BIMI requires — a slip back to p=none will quietly remove your logo from inboxes.