# BIMI explained: how to show your brand logo in the inbox

URL: https://iblockspam.com/blog/bimi-explained-brand-logo-in-inbox
Last updated: 2026-10-09
Published: 2026-10-09
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> What BIMI is, what it needs (DMARC enforcement, an SVG Tiny PS logo, a VMC or CMC), which mailbox providers show the logo, what it costs and how to set it up.

## Short answer

BIMI is a DNS record at default._bimi.yourdomain that points to your logo, and usually to a mark certificate proving you own it. Supporting mailbox providers show the logo next to mail that passes DMARC, but only if your domain enforces DMARC with p=quarantine or p=reject. Gmail requires a VMC or CMC.

BIMI (Brand Indicators for Message Identification) lets your logo appear next to your messages in supporting inboxes. It doesn't block anything. It's a reward for finishing DMARC: receivers only show the logo when your domain enforces DMARC and the message passes. This guide covers the requirements, which providers show logos, what it really costs, and how to set it up.

## What is BIMI and how does it work?

BIMI is a TXT record you publish at `default._bimi.` in front of your domain. It points to your logo and, optionally, to a certificate that proves you have the right to use it. The format is defined in an [IETF Internet-Draft](https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification). It's not yet an RFC, so details can still change.

When a supporting mailbox provider receives your message, it:

1. Checks that the message passes [DMARC](https://www.rfc-editor.org/rfc/rfc9989.html).
2. Checks that your domain's DMARC policy is at enforcement.
3. Looks up your BIMI record and fetches the logo, and the certificate if there is one.
4. Validates the logo and certificate, then decides whether to show the logo.

The last step matters. Every provider keeps its own rules and can decline to show your logo even if everything is valid.

A typical record looks like this:

```
default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"
```

| Tag | Required? | What it does |
|---|---|---|
| `v` | Yes | Version, always `BIMI1` |
| `l` | Yes | HTTPS URL of the SVG logo, or empty |
| `a` | No | HTTPS URL of the mark certificate (a PEM file) |

`default` is the selector. Senders can choose a different selector per message with a `BIMI-Selector` header, which the draft says should be covered by your DMARC-aligned DKIM signature. Most domains only need `default`.

## What are the requirements for BIMI?

### 1. DMARC at enforcement

This is the gate. The BIMI Group's [sender FAQ](https://bimigroup.org/faqs-for-senders-esps/) says DMARC must be enforced, meaning `p=quarantine` or `p=reject`. The BIMI draft adds detail:

- The policy must be strong on both the From domain and the organizational domain.
- `p=none` on either one stops BIMI.
- A subdomain policy (`sp`), if you publish one, must not be `none`.
- A `quarantine` policy must not use `pct` below 100.

Google states the same thing for Gmail: `p` must be `quarantine` or `reject`, and `pct` must be 100 ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/set-up-bimi)). Under [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), `pct` no longer exists, so the simple rule is: don't publish a `pct` lower than 100, and don't use `t=y` test mode while you expect a logo. If you're still at `p=none`, start with our guide on [moving DMARC from p=none to p=reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business).

### 2. A logo in SVG Tiny PS

The logo must be an SVG file in the SVG Tiny Portable/Secure profile, described in its own [Internet-Draft](https://datatracker.ietf.org/doc/html/draft-svg-tiny-ps-abrotman). Normal SVG exports from design tools usually fail. Google's requirements for Gmail include:

- `baseProfile="tiny-ps"` and `version="1.2"`.
- No scripts, animations or external references.
- Width and height in absolute pixels, at least 96 by 96.
- A square image, centered, on a solid background (recommended).
- A file size of 32 KB or less (recommended).
- A `<desc>` element describing the logo (recommended).

The file must be served over HTTPS. The BIMI Group says to serve it with the `image/svg+xml` content type.

### 3. A mark certificate (for most providers)

A mark certificate is issued by a certificate authority after it checks your right to the logo. The certificate embeds the SVG, and you publish it as a PEM file in the `a=` tag. There are two kinds:

| | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
|---|---|---|
| Needs a registered trademark | Yes | No |
| Typical basis | Logo registered with a recognized trademark office | Prior use of the logo, or a modified registered mark |
| Gmail | Accepted, with a checkmark | Accepted; Google documents the checkmark for VMCs only |
| Lead time | Trademark registration can take 6 to 12 months (Google) | Depends on the issuer |

On the CMC side, the BIMI Group [describes](https://bimigroup.org/understanding-bimi-certificate-types/) prior-use marks as reflecting "a history of legitimate use without necessitating trademark registration". Issuers check that history themselves. [Sectigo, for example](https://www.sectigo.com/faqs/detail/Eligibility-Requirements-for-VMC-and-CMC-Certificates), says the logo must have been in use for at least 12 months and checks this with the Internet Archive. Ask your chosen issuer for its exact rules before you apply.

The BIMI Group says mark certificates have a maximum validity of 398 days, so plan for yearly renewal.

## Which mailbox providers show BIMI logos?

Support depends on the **recipient's** mailbox provider, not yours. Here's what each provider's own documentation says, checked in October 2026:

| Provider | Certificate needed | Conditions they document |
|---|---|---|
| Gmail | VMC or CMC (PEM file required) | DMARC `p=quarantine` or `p=reject`; logo can take up to 48 hours to appear. Google says the checkmark appears for senders verified with a VMC |
| Apple Mail | A BIMI Evidence Document "for example, a VMC" | The recipient's mail provider must validate BIMI and add the required headers; Apple Mail on iOS 16, iPadOS 16, macOS Ventura 13 or later |
| Yahoo | Not mentioned; the BIMI Group says self-asserted records work | Valid SVG, DMARC `quarantine` or `reject`, bulk mail, and "sufficient reputation and engagement" |

Sources: [Google](https://knowledge.workspace.google.com/admin/security/set-up-bimi), [Apple](https://developer.apple.com/support/bimi), [Yahoo](https://senders.yahooinc.com/faqs/).

Two details are easy to miss:

- **Gmail only uses certificates.** Google says Gmail supports BIMI only with PEM files, and standalone SVG files aren't supported. A self-asserted record with no `a=` tag won't show a logo in Gmail.
- **Apple Mail depends on the server.** Apple says the logo appears only when the mail provider has checked BIMI and vouched for it in headers. Apple's page mentions VMCs and doesn't mention CMCs, so don't assume a CMC works there.

The BIMI Group's [display list](https://bimigroup.org/where-is-my-bimi-logo-displayed/) also includes Fastmail, La Poste, AU (KDDI) and Zone, and its FAQ links to a provider infographic. That infographic lists Microsoft under "Does not support BIMI".

## How much does BIMI cost?

Be realistic before you start:

- **The DNS record is free.** So is hosting a small SVG file.
- **The certificate is a yearly fee.** Prices vary by issuer. The BIMI Group says to expect an annual fee, and that extra checks, such as multiple marks or jurisdictions, may raise it. We don't quote prices because they change.
- **A trademark costs time and money.** If you don't already have one, a VMC is months away. Google cites 6 to 12 months for registration.
- **DMARC enforcement is the real work.** Getting every legitimate sender to pass aligned SPF or DKIM is usually the longest step, and it's the step that actually stops spoofing.

If your domain is at `p=none` today, BIMI shouldn't be your first project. Enforcement protects your customers whether or not a logo ever appears. Our [research on the top 1,000 domains](https://iblockspam.com/research/email-security-top-1000) found 16.4% published a BIMI record in October 2026, while 38.3% didn't enforce DMARC at all.

## How do you set up BIMI step by step?

1. **Confirm DMARC enforcement.** Run the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). You need `p=quarantine` or `p=reject` on your organizational domain, no `pct` below 100, no `t=y`, and no `sp=none`. If you need a new record, the [DMARC Generator](https://iblockspam.com/tools/dmarc-generator) builds one.
2. **Check every sender passes.** Read a few weeks of aggregate reports. Mail that fails DMARC won't get a logo, and at enforcement it may not be delivered either.
3. **Prepare the logo.** Convert your logo to SVG Tiny PS: square, solid background, no scripts or external references, 32 KB or less. Validate it before going further.
4. **Decide on a certificate.** If you want Gmail and Apple Mail, plan on a VMC (registered trademark) or, for Gmail, a CMC. If Yahoo is enough, a self-asserted record may do.
5. **Apply to an issuer.** You'll submit the SVG, proof of your right to the mark, and organization details. The issuer embeds the logo in the certificate.
6. **Host the files.** Put the SVG and the PEM file on an HTTPS URL you control. Google says to append any intermediate and root certificates from the issuer to the PEM file.
7. **Publish the record.** Add a TXT record at `default._bimi.yourdomain`, for example `v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem`. Google's own example for a certificate-only setup leaves `l=` empty.
8. **Test.** Check the record with the [BIMI Checker](https://iblockspam.com/tools/bimi-checker), then send to a Gmail and a Yahoo address. Allow up to 48 hours.
9. **Set a renewal reminder.** Certificates expire within 398 days. An expired certificate means no logo.

## Common BIMI mistakes

| Mistake | Result | Fix |
|---|---|---|
| DMARC still at `p=none` | No logo anywhere | Move to `quarantine` or `reject` |
| `sp=none` on the organizational domain | BIMI blocked by the draft's rules | Remove `sp` or set it to an enforcing value |
| Regular SVG export | Logo rejected | Convert to SVG Tiny PS |
| No `a=` certificate | No logo in Gmail | Get a VMC or CMC |
| Expecting the logo on person-to-person mail at Yahoo | Logo not shown | Yahoo shows logos for bulk mail with good reputation |
| Logo on HTTP or blocked by a firewall | Fetch fails | Serve over HTTPS, publicly reachable |

BIMI also won't help with lookalike domains. A logo only appears for mail that passes DMARC for **your** domain. Attackers using a similar-looking domain are a separate problem, covered in [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## Next steps

1. Check where you stand with the [BIMI Checker](https://iblockspam.com/tools/bimi-checker), which reads your BIMI record, logo and certificate URLs and your DMARC policy. The [Email Health Check](https://iblockspam.com/tools/email-health-check) grades DMARC alongside SPF and DKIM.
2. If DMARC isn't at enforcement, finish that first. The [DMARC record examples](https://iblockspam.com/blog/dmarc-record-examples) guide shows each stage.
3. Decide whether Gmail and Apple Mail matter enough to justify a certificate and, if needed, a trademark.
4. Protect any domains you own but don't send from. See [how to protect parked domains from spoofing](https://iblockspam.com/blog/protect-parked-domains-from-spoofing).

iBlockSpam filters inbound mail and doesn't issue mark certificates. Domain monitoring can alert you if your DMARC record changes, which matters because a weakened policy would quietly switch your logo off.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### Does BIMI improve email deliverability?

Not directly. The BIMI Group says BIMI does not change message delivery. What it does is reward domains that already enforce DMARC, which is the real protection against spoofing. Treat the logo as a visible result of good authentication, not as a way to get out of the spam folder.

### Do I need a trademark for BIMI?

For a Verified Mark Certificate, yes. Google says the logo must be trademarked with an intellectual property office that certificate issuers recognize, which can take 6 to 12 months. If your logo isn't trademarked, Gmail also accepts a Common Mark Certificate. Yahoo can show a self-asserted logo with no certificate at all.

### Why is my BIMI logo not showing?

Check four things: DMARC is at p=quarantine or p=reject and the message passes it, the SVG meets the SVG Tiny PS profile, the certificate (if used) is valid and matches the logo, and you've waited long enough. Google says up to 48 hours. Yahoo also requires bulk volume and good reputation.

### Does Outlook support BIMI?

The BIMI Group's provider infographic, checked in October 2026, lists Microsoft under 'Does not support BIMI', and we found no Microsoft documentation saying Outlook displays BIMI logos. Plan on Gmail, Apple Mail and Yahoo being the main places your logo can appear, and check the BIMI Group site for updates.

### Does BIMI work on a subdomain?

Yes. Receivers look for a BIMI record at the From domain and fall back to the organizational domain. The BIMI draft requires a strong DMARC policy on both the From domain and the organizational domain, and any subdomain policy published must not be none.

## Sources

- [Google Workspace Admin Help: Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi)
- [Apple Developer: Prepare your email server for BIMI support in Apple Mail](https://developer.apple.com/support/bimi)
- [Yahoo Sender Hub: FAQs (BIMI)](https://senders.yahooinc.com/faqs/)
- [BIMI Group: FAQs for senders and ESPs](https://bimigroup.org/faqs-for-senders-esps/)
- [BIMI Group: Where is my BIMI logo displayed?](https://bimigroup.org/where-is-my-bimi-logo-displayed/)
- [IETF Internet-Draft: Brand Indicators for Message Identification (BIMI)](https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification)
- [IETF Internet-Draft: SVG Tiny Portable/Secure](https://datatracker.ietf.org/doc/html/draft-svg-tiny-ps-abrotman)
- [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989.html)

## Free tools for this guide

- [BIMI Checker](https://iblockspam.com/tools/bimi-checker): Check your BIMI record, logo and certificate URLs, and the DMARC policy BIMI needs.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/bimi-explained-brand-logo-in-inbox (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt