InboxRatio
Check your domain

Glossary term

What is BIMI? Your logo in the inbox, earned the hard way

What BIMI is

BIMI — Brand Indicators for Message Identification — is a specification that lets a domain owner publish a logo in DNS so that participating mailbox providers can display it next to authenticated messages from that domain. In Gmail, Yahoo Mail and Apple Mail, a working BIMI setup replaces the generic initial-letter avatar with your actual brand mark.

The record itself is small. It lives at default._bimi.yourdomain.com as a TXT record:

v=BIMI1; l=https://yourdomain.com/brand/logo.svg; a=https://yourdomain.com/brand/vmc.pem

l= points to the logo file; a= points to evidence that you have the right to use it — a Verified Mark Certificate, discussed below.

What makes BIMI interesting is not the record. It is the prerequisite: BIMI only activates for domains with DMARC at an enforcement policy. The logo is a reward for finishing your authentication homework, and that design is deliberate — the specification's authors wanted a visible incentive to push domains from p=none to quarantine or reject. BIMI is developed by the BIMI Group (an industry working group) and specified in an IETF draft rather than a published RFC, which is worth knowing when you evaluate how stable the requirements are.

How BIMI differs from DMARC

The two are easy to conflate because one depends on the other, but they answer different questions.

DMARC is an authentication policy: it tells receivers what to do with mail that fails to prove it comes from your domain. It protects your domain from spoofing whether or not any human notices.

BIMI is a display layer: it changes what recipients see when your mail passes. It adds no authentication of its own. A message does not "pass BIMI" — it passes DMARC, and BIMI then tells the mailbox provider which logo the passing domain has registered.

The dependency runs one way only. DMARC is fully functional without BIMI, and most domains with enforced DMARC never publish a BIMI record. BIMI without enforced DMARC does nothing at all: providers ignore the record entirely if your policy is p=none, and most also refuse pct values below 100 or a subdomain policy of sp=none, since either leaves spoofing room under the logo.

If DMARC is a lock on the door, BIMI is the brass nameplate you are allowed to mount once the lock is verified.

How BIMI works

When a participating provider receives a message from your domain, the chain runs like this:

  1. The message must pass DMARC with your policy at enforcement (quarantine or reject, applied to 100% of mail, subdomains included).
  2. The provider looks up default._bimi.yourdomain.com and finds the record.
  3. It fetches the logo from the l= URL. The file must be an SVG in the Tiny PS profile — a deliberately restricted SVG subset that forbids scripts, external references and animation, because mail clients will render this file inside their own UI.
  4. If the provider requires certification (Gmail does), it validates the a= evidence: a Verified Mark Certificate (VMC) issued by an authorized certification authority, attesting that the logo is your registered trademark. A newer, cheaper tier — the Common Mark Certificate (CMC) — attests prior use of the logo without a trademark registration, and earns the logo but not the additional verified checkmark Gmail shows for VMC holders.
  5. The logo displays next to your message. Providers cache aggressively, so changes propagate slowly.

Requirements differ by provider, and this is where implementations get stuck. Yahoo has historically displayed logos for some senders without a certificate, at its own discretion and with reputation weighting. Gmail requires a valid certificate, full stop. Apple Mail follows the certificate route as well. Treat "logo file + record + VMC/CMC + enforced DMARC" as the portable minimum and provider-specific leniency as a bonus you do not plan around.

The SVG profile deserves respect. Ordinary design-tool SVG exports fail the Tiny PS restrictions routinely — embedded raster images, external fonts, <style> blocks and stray metadata are all disqualifying. Expect to hand-clean the export or use a conversion tool, then validate. A BIMI checker confirms the record resolves, the logo URL serves correctly, and the DMARC prerequisite is actually met.

BIMI and your deliverability

Here is the honest version: BIMI does not directly move inbox placement. Filtering decisions happen before display decisions, and no major provider has documented a placement bonus for publishing a BIMI record. Any claim that BIMI itself lifts deliverability should be read as marketing.

The real deliverability value is indirect, and it is substantial:

It forces DMARC enforcement. Every prerequisite BIMI imposes — p=reject or quarantine, full coverage, subdomains included — is a thing that independently protects your domain reputation from spoofing. Organizations that would have parked at p=none indefinitely finish the job because someone in marketing wants the logo. This is the specification working as designed.

It raises the cost of impersonating you. A phisher can copy your template pixel-for-pixel but cannot produce your logo through the BIMI pipeline, because that requires passing DMARC as your domain and holding your certificate. Recipients used to seeing the logo have one more cue when it is absent. (The protection is probabilistic — most recipients do not consciously check — but it stacks with everything else.)

Engagement effects are plausible but unproven at your scale until you test them. A recognizable logo may lift opens for a recognizable brand. Measure it on your own audience rather than importing someone else's case study; we apply the same rule to every vendor claim in our review standards.

Limitations and failure modes

The certificate cost surprise. VMCs are issued by a small number of authorized certification authorities, require a registered trademark for the exact logo, and renew annually at a price that reliably exceeds what a small sender expects to pay for "an email logo". Budget for the certificate before promising the logo to anyone. If the trademark itself is missing, registration adds months to the timeline; a CMC shortcuts this for logos with demonstrable prior use, at the cost of Gmail's checkmark.

Publishing the record before DMARC is ready. The most common failure we see: a BIMI record deployed while DMARC sits at p=none, or at p=quarantine; pct=10. Nothing errors — the logo simply never appears, and the team burns weeks debugging the SVG when the blocker is the policy.

SVG rejections. Design-tool exports fail the Tiny PS profile silently. The record validates, the file exists, the logo still does not show. Validate the file against the profile, not just the URL.

Subdomain and From-domain mismatches. The BIMI lookup keys off the From header domain. Mail sent from news.yourdomain.com looks up default._bimi.news.yourdomain.com first and falls back to the organizational domain — but the fallback still requires the subdomain's mail to pass enforced DMARC. A subdomain excluded from enforcement never shows the logo.

Display is discretionary. Even with everything correct, providers reserve the right to withhold the logo from senders whose reputation they distrust. BIMI display trailing off is occasionally the first visible symptom of a reputation problem, which makes it an odd but real monitoring signal.

The specification is still a draft. Requirements have shifted before — certificate tiers, provider participation, profile details — and can shift again. Re-verify the current rules at implementation time rather than trusting a two-year-old blog post.

Related terms

DMARC, DKIM, SPF record, domain reputation, sender reputation, inbox placement, double opt-in.

Frequently asked questions

Does BIMI improve email deliverability? Not directly. No major provider documents a placement bonus for BIMI. Its deliverability value is indirect: it requires enforced DMARC, which protects your domain reputation from spoofing.

What does BIMI require before the logo will show? DMARC at p=quarantine or p=reject covering 100% of mail including subdomains, a Tiny PS profile SVG logo served over HTTPS, a BIMI TXT record at default._bimi. on your domain, and — for Gmail and Apple Mail — a valid Verified Mark Certificate or Common Mark Certificate.

Do I need a trademark to use BIMI? For a VMC, yes — the certificate attests that the logo is your registered mark. A CMC accepts documented prior use of the logo instead of a trademark registration, and displays the logo without Gmail's verified checkmark.

Why isn't my BIMI logo showing even though the record is valid? Work the list in order: DMARC not at full enforcement (including pct and subdomains), SVG failing the Tiny PS profile, missing or invalid certificate where the provider requires one, provider-side caching, or a sender reputation the provider considers too weak to decorate.

Which mailbox providers support BIMI? Gmail, Yahoo Mail and Apple Mail are the major participants; support and certificate requirements vary by provider and change over time. Microsoft Outlook has notably remained outside the ecosystem, so a large share of B2B recipients will not see the logo regardless of your setup.

Is BIMI worth it for a small sender? Do the DMARC enforcement work regardless — that part is free and protects you. Whether the certificate is worth its annual cost depends on how much brand recognition your audience attaches to the logo. Enforcement first, nameplate second.

The practical path: reach DMARC enforcement, clean your SVG, price the certificate honestly — and confirm each step with the BIMI checker instead of waiting for the logo to appear on its own.

Sources