What is Brand Indicators for Message Identification (BIMI)?

Brand Indicators for Message Identification (BIMI) is the email standard that puts your verified brand logo next to the messages you send. Put DMARC at enforcement, add a mark certificate and a compliant SVG logo, publish the BIMI record, and your logo shows for recipients at participating providers like Gmail.

To be eligible, your domain needs DMARC at enforcement. Current provider rules define that as a DMARC policy of p=quarantine or p=reject applied to all of your mail, and where you publish a subdomain policy the sp= value must also be at enforcement. A monitor-only policy of p=none is not accepted.

BIMI works with two kinds of evidence for your logo. A Verified Mark Certificate (VMC) proves a registered trademark. A Common Mark Certificate (CMC) covers a logo you have displayed publicly on a domain you own for at least 12 months without a registered trademark. Gmail accepts a VMC or a CMC and shows its verified checkmark for a VMC only.

Pair BIMI with DMARC at enforcement, and your logo can appear in supporting inboxes such as Gmail and Yahoo. DMARC at enforcement reduces exact-domain spoofing, though it does not stop every form of impersonation, because lookalike domains and display-name tricks remain.

BIMI inserts your logo next to your email address at participating providers. It doesn't prevent business email compromise (BEC), that's DMARC's job, and if someone spoofs you while BIMI is in place your logo won't appear. Depending on your DMARC policy the message may not arrive at all.

Like your SPF, DKIM, and DMARC records, your BIMI record lives in your DNS as a text (TXT) file. When a message you send reaches the recipient inbox, the receiving server looks up the record to confirm the mail is authenticated with DMARC. Once the message passes DMARC at p=quarantine or p=reject, the TXT record tells the receiving server where the logo lives and which certificate backs it, and the provider can then show the logo.

If your DMARC policy is set to p=none, BIMI will not function. Providers only evaluate a logo once your domain's DMARC policy is at enforcement.

Your prerequisite here is DMARC at enforcement. If you are not there yet, work through how to reach DMARC enforcement first, then come back to BIMI.

The readiness gate covers six areas. Clear all six before you apply for a certificate or publish a record.

Work the phases in order. Each phase gates the next, so do not start a later phase until the earlier one is stable.

Phase 1. Reach DMARC enforcement. Confirm your current DMARC policy, review aggregate reports for authentication failures, authenticate every legitimate sending source (including third-party senders such as ESPs and CRMs), move to p=quarantine, and then to p=reject once your authentication coverage is stable. BIMI cannot proceed until your policy is at enforcement and holding. This is usually the longest stage, commonly around 6 to 8 weeks, driven by how many senders you have to line up.

Phase 2. Prepare and validate the logo. Convert your logo to SVG P/S, validate it against the BIMI profile in Section 5, and host it over HTTPS at a stable public URL. Keep the mark simple, since it renders as a small avatar and fine detail or thin text becomes unreadable. If your registered mark includes the company name as separate text, you need a version that works without it, because a VMC logo must match the trademark. A CMC does not require a trademark, which gives more flexibility in logo choice.

Phase 3. Apply for the certificate. Choose the evidence type. A VMC needs a registered trademark in a recognized jurisdiction, a CMC needs 12 months of public logo use, and a Government Mark Certificate is for government entities. Complete the certificate authority's identity and domain-control verification. You can submit the application through the Red Sift OnDMARC workflow. Issuance is usually quick once you qualify, about a week or two, though registering a brand-new trademark for a VMC can add months.

Phase 4. Publish the BIMI record. Generate the TXT record with your logo URL and certificate URL, validate the syntax, publish it in your DNS zone, and allow time for DNS propagation, usually a day or two. Then check your BIMI readiness, send test messages to Gmail, Yahoo, and other supporting providers, and confirm the logo shows. Only a VMC produces the Gmail verified checkmark.

Phase 5. Monitor and maintain. Keep DMARC at enforcement, alert on any policy downgrade, track certificate expiry, and renew before the certificate lapses. Section 9 covers maintenance and rebrands in full.

Publish the record as a DNS TXT entry at this location.

default._bimi.example.com    IN TXT

The value uses three tags.

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/certificate.pem

• v= is the version and is always BIMI1.
• l= is the HTTPS URL of your SVG P/S logo file.
• a= is the HTTPS URL of your PEM certificate, a VMC or a CMC.

The a= tag is optional in the BIMI specification and is reserved for a VMC or CMC. When a= is empty or absent, the record is self-asserted, a logo with no certificate. Self-asserted records have limited and inconsistent provider support and are not shown by Gmail.

For providers that require a certificate, the logo is read through the certificate named in a=, so the file at l= and the logo bound to the certificate must be the same mark.

Your SVG file must meet the SVG P/S profile, a profile of SVG Tiny 1.2. The root element needs baseProfile="tiny-ps" and version="1.2" with no root x= or y= attributes, a <title> element carrying the company name is required, the artwork must be square with a solid non-transparent background, and the file must be at most 32 KB with no scripts, animation, or external references.

Host the file over HTTPS at a stable URL, serve it with the MIME type image/svg+xml, and keep it publicly reachable with no authentication, hotlink, geo, or robots blocking on provider fetches.

After you publish, check your BIMI readiness to validate the record and the logo.

If your logo is not appearing, try these troubleshooting steps.

1. DMARC policy at enforcement. Confirm your published policy is p=quarantine or p=reject for all mail, including any sp=. Next action, read your current DMARC record.
2. Live-message alignment. Confirm that real sent messages pass DMARC with aligned SPF or DKIM, not just that a record exists. Next action, check aggregate reports or send a test to a seed address.
3. BIMI record and selector. Confirm the TXT record exists at default._bimi for the sending domain, with a valid v=, l=, and a= and the selector you actually use. Next action, query the record.
4. SVG validity. Confirm the file meets the SVG P/S profile from Section 5. Next action, validate the SVG.
5. Hosting, TLS, MIME, redirects, and hotlinking. Confirm the logo and certificate load over HTTPS with MIME image/svg+xml, no redirect chain, and no authentication, hotlink, geo, or robots block. Next action, fetch both URLs from outside your network.
6. Certificate or evidence validity. Confirm the VMC or CMC is current, unexpired, issued by a recognized certificate authority, and bound to the same logo. Next action, check the certificate's validity dates and mark.
7. Propagation and cache. Allow time for DNS propagation and for the provider to refresh its cache after any change. Next action, re-test after propagation.
8. Provider eligibility. Even with a clean technical pass, each provider applies its own reputation, engagement, and discretion rules, and some providers such as Microsoft Outlook do not render inbound BIMI at all. Next action, confirm the target provider supports BIMI for your case in Section 8.

For the full requirements, jurisdictions, and roles, compare VMC and CMC.

Support varies by provider, and a few add their own conditions on top of a valid BIMI setup. Check the row for the providers your recipients use.

Where your logo appears on desktop and mobile. The same valid setup can look different across a reader's devices, which matters when you are planning your brand's impact across platforms. Gmail shows the logo in its web client and its Android and iOS apps, with the verified checkmark (VMC only) in the message view. Yahoo and AOL show it in the message list and the read view in their mobile apps, and in the read view in desktop webmail. Apple Mail shows it in the message view on macOS 13, iOS 16, and iPadOS 16 and later. Some surfaces show the logo in the inbox list while others show it only once the message is open, so test on the devices your recipients actually use.

Apple Business Connect is a separate Apple program from BIMI, and enrolling in Business Connect is not the same as publishing a BIMI record.

Keep the setup healthy after go-live. Keep DMARC at enforcement and alert on any downgrade, since the logo stops showing if your policy drops below enforcement. Track certificate expiry, because a VMC or CMC is valid for about one year, up to a maximum of 397 days, and the logo stops showing once it lapses. A routine renewal with no logo change reuses your existing URLs.

Changing the logo is different from renewing. The logo is bound to the certificate, so a new logo needs a new certificate. Run a rebrand in this order. Validate the new SVG against the BIMI profile, obtain the updated certificate or evidence for the new mark, host the new files over HTTPS, update the l= and a= URLs in your DNS record, allow DNS propagation, validate the record, and send test messages. Replacing a certificate-bound logo without a matching new certificate breaks the certificate relationship and the logo stops showing.

The clearest next step is to check your BIMI readiness, which tests your domain and shows what is still missing.

From there, the common paths depend on what you need next.

• If you need a compliant logo file, create a BIMI-compatible SVG logo.
• If you are deciding on evidence, compare VMC and CMC.
• If you would rather have it implemented and managed for you, get help managing BIMI implementation.

• BIMI Group — Implementation Guide
• BIMI Group — FAQs for Senders and ESPs
• BIMI Group — Creating a BIMI SVG logo
• BIMI Group — Participating providers
• Google Workspace — Set up BIMI
• Yahoo Sender Hub — BIMI
• Apple — Support BIMI in Apple Mail
• Fastmail — Using BIMI
• DigiCert — Verified Mark Certificates
• DigiCert — BIMI setup guide (VMC and CMC)
• SSL.com — Common Mark Certificate