BIMI explained: how to show your brand logo in the inbox

BIMI (Brand Indicators for Message Identification) lets your logo appear next to your messages in supporting inboxes. It doesn't block anything. It's a reward for finishing DMARC: receivers only show the logo when your domain enforces DMARC and the message passes. This guide covers the requirements, which providers show logos, what it really costs, and how to set it up.

What is BIMI and how does it work?

BIMI is a TXT record you publish at default._bimi. in front of your domain. It points to your logo and, optionally, to a certificate that proves you have the right to use it. The format is defined in an IETF Internet-Draft. It's not yet an RFC, so details can still change.

When a supporting mailbox provider receives your message, it:

1. Checks that the message passes DMARC.
2. Checks that your domain's DMARC policy is at enforcement.
3. Looks up your BIMI record and fetches the logo, and the certificate if there is one.
4. Validates the logo and certificate, then decides whether to show the logo.

The last step matters. Every provider keeps its own rules and can decline to show your logo even if everything is valid.

A typical record looks like this:

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

default is the selector. Senders can choose a different selector per message with a BIMI-Selector header, which the draft says should be covered by your DMARC-aligned DKIM signature. Most domains only need default.

What are the requirements for BIMI?

1. DMARC at enforcement

This is the gate. The BIMI Group's sender FAQ says DMARC must be enforced, meaning p=quarantine or p=reject. The BIMI draft adds detail:

• The policy must be strong on both the From domain and the organizational domain.
• p=none on either one stops BIMI.
• A subdomain policy (sp), if you publish one, must not be none.
• A quarantine policy must not use pct below 100.

Google states the same thing for Gmail: p must be quarantine or reject, and pct must be 100 (Google Workspace Admin Help). Under RFC 9989, pct no longer exists, so the simple rule is: don't publish a pct lower than 100, and don't use t=y test mode while you expect a logo. If you're still at p=none, start with our guide on moving DMARC from p=none to p=reject.

2. A logo in SVG Tiny PS

The logo must be an SVG file in the SVG Tiny Portable/Secure profile, described in its own Internet-Draft. Normal SVG exports from design tools usually fail. Google's requirements for Gmail include:

• baseProfile="tiny-ps" and version="1.2".
• No scripts, animations or external references.
• Width and height in absolute pixels, at least 96 by 96.
• A square image, centered, on a solid background (recommended).
• A file size of 32 KB or less (recommended).
• A <desc> element describing the logo (recommended).

The file must be served over HTTPS. The BIMI Group says to serve it with the image/svg+xml content type.

3. A mark certificate (for most providers)

A mark certificate is issued by a certificate authority after it checks your right to the logo. The certificate embeds the SVG, and you publish it as a PEM file in the a= tag. There are two kinds:

On the CMC side, the BIMI Group describes prior-use marks as reflecting "a history of legitimate use without necessitating trademark registration". Issuers check that history themselves. Sectigo, for example, says the logo must have been in use for at least 12 months and checks this with the Internet Archive. Ask your chosen issuer for its exact rules before you apply.

The BIMI Group says mark certificates have a maximum validity of 398 days, so plan for yearly renewal.

Which mailbox providers show BIMI logos?

Support depends on the recipient's mailbox provider, not yours. Here's what each provider's own documentation says, checked in October 2026:

Sources: Google, Apple, Yahoo.

Two details are easy to miss:

• Gmail only uses certificates. Google says Gmail supports BIMI only with PEM files, and standalone SVG files aren't supported. A self-asserted record with no a= tag won't show a logo in Gmail.
• Apple Mail depends on the server. Apple says the logo appears only when the mail provider has checked BIMI and vouched for it in headers. Apple's page mentions VMCs and doesn't mention CMCs, so don't assume a CMC works there.

The BIMI Group's display list also includes Fastmail, La Poste, AU (KDDI) and Zone, and its FAQ links to a provider infographic. That infographic lists Microsoft under "Does not support BIMI".

How much does BIMI cost?

Be realistic before you start:

• The DNS record is free. So is hosting a small SVG file.
• The certificate is a yearly fee. Prices vary by issuer. The BIMI Group says to expect an annual fee, and that extra checks, such as multiple marks or jurisdictions, may raise it. We don't quote prices because they change.
• A trademark costs time and money. If you don't already have one, a VMC is months away. Google cites 6 to 12 months for registration.
• DMARC enforcement is the real work. Getting every legitimate sender to pass aligned SPF or DKIM is usually the longest step, and it's the step that actually stops spoofing.

If your domain is at p=none today, BIMI shouldn't be your first project. Enforcement protects your customers whether or not a logo ever appears. Our research on the top 1,000 domains found 16.4% published a BIMI record in October 2026, while 38.3% didn't enforce DMARC at all.

How do you set up BIMI step by step?

1. Confirm DMARC enforcement. Run the DMARC Checker. You need p=quarantine or p=reject on your organizational domain, no pct below 100, no t=y, and no sp=none. If you need a new record, the DMARC Generator builds one.
2. Check every sender passes. Read a few weeks of aggregate reports. Mail that fails DMARC won't get a logo, and at enforcement it may not be delivered either.
3. Prepare the logo. Convert your logo to SVG Tiny PS: square, solid background, no scripts or external references, 32 KB or less. Validate it before going further.
4. Decide on a certificate. If you want Gmail and Apple Mail, plan on a VMC (registered trademark) or, for Gmail, a CMC. If Yahoo is enough, a self-asserted record may do.
5. Apply to an issuer. You'll submit the SVG, proof of your right to the mark, and organization details. The issuer embeds the logo in the certificate.
6. Host the files. Put the SVG and the PEM file on an HTTPS URL you control. Google says to append any intermediate and root certificates from the issuer to the PEM file.
7. Publish the record. Add a TXT record at default._bimi.yourdomain, for example v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem. Google's own example for a certificate-only setup leaves l= empty.
8. Test. Check the record with the BIMI Checker, then send to a Gmail and a Yahoo address. Allow up to 48 hours.
9. Set a renewal reminder. Certificates expire within 398 days. An expired certificate means no logo.

Common BIMI mistakes

BIMI also won't help with lookalike domains. A logo only appears for mail that passes DMARC for your domain. Attackers using a similar-looking domain are a separate problem, covered in lookalike domain phishing.

Next steps

1. Check where you stand with the BIMI Checker, which reads your BIMI record, logo and certificate URLs and your DMARC policy. The Email Health Check grades DMARC alongside SPF and DKIM.
2. If DMARC isn't at enforcement, finish that first. The DMARC record examples guide shows each stage.
3. Decide whether Gmail and Apple Mail matter enough to justify a certificate and, if needed, a trademark.
4. Protect any domains you own but don't send from. See how to protect parked domains from spoofing.

iBlockSpam filters inbound mail and doesn't issue mark certificates. Domain monitoring can alert you if your DMARC record changes, which matters because a weakened policy would quietly switch your logo off.

Browse our other SPF, DKIM and DMARC guides.