BIMI: how to show your logo next to your emails

What BIMI is - and what it isn't

BIMI (Brand Indicators for Message Identification) is a way to publish a logo for your domain in DNS. When a message from your domain passes DMARC, a mailbox provider that supports BIMI can fetch the logo and show it in the inbox instead of a generic letter avatar. Some providers add a verified checkmark when the logo is backed by a trademark certificate.

It's worth being clear about its limits. BIMI doesn't authenticate anything by itself - all of the security comes from the DMARC check that must pass first. It is not a deliverability fix either: a message that would land in spam still lands in spam, and a logo is only shown on mail the provider already accepts. Think of it as a reward for having finished your email authentication. The specification is maintained by the BIMI Group's working group and published as an Internet-Draft; it is not an RFC yet.

Requirement 1: DMARC at enforcement

Your domain's DMARC policy must actually protect it: p=quarantine or p=reject. A monitoring-only p=none is not enough, and neither is a policy that applies to only part of your mail (pct below 100). Gmail states both conditions explicitly.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

• pct defaults to 100, so leaving it out is fine. Writing pct=50 during a rollout means no logo until you remove it.
• The BIMI Group advises putting the organizational domain (example.com) and every subdomain you send from at enforcement - check that a sp=none doesn't undo it for subdomains.
• Each message also has to pass DMARC itself, meaning an aligned SPF or DKIM pass. Mail from a newsletter tool that isn't authenticated for your domain won't get the logo, even if everything else is.

If you're still on p=none, follow the rollout in the DMARC guide first. Moving to enforcement just for the logo, before every legitimate sender is authenticated, risks losing real mail.

Requirement 2: the logo as SVG Tiny PS

The logo must be an SVG file in the SVG Tiny Portable/Secure (SVG Tiny PS) profile - a restricted subset of SVG Tiny 1.2 that can be displayed safely inside a mail app. An ordinary SVG export from a design tool almost never qualifies as it is.

• The root element declares version="1.2" and baseProfile="tiny-ps", and the file includes a <title> element, normally your company name.
• No scripts, no external references (fonts, images, links), no embedded raster images, no animation.
• Square, with the logo centred: inboxes may crop it to a circle or a rounded square, so keep important parts away from the corners and give it a solid background rather than a transparent one.
• Small - the BIMI Group's guidance is no more than 32 KB.
• Served over HTTPS, publicly reachable, with the content type image/svg+xml.

Most vector editors can't write this profile directly. The BIMI Group publishes conversion tools and guidance, and certificate issuers check the file as part of their validation.

Requirement 3: the BIMI record

The record is a TXT record at default._bimi under your domain. default is the selector; other selectors exist, but senders that don't ask for one get default.

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/bimi-cert.pem"

A record with empty l= and a= (v=BIMI1; l=; a=;) explicitly declines BIMI for the domain. Like other TXT records, the value is entered under the host default._bimi in most DNS panels - see how to add DNS records.

VMC or CMC: the mark certificate

A logo in DNS on its own proves nothing - anyone could publish someone else's logo on a look-alike domain that passes DMARC. That's why the large providers only show logos backed by a mark certificate: a certificate in which a certificate authority confirms that your organization has the right to use that logo. There are two kinds:

Both are issued by a small number of certificate authorities, are paid, and must be renewed. If your logo isn't trademarked yet, a CMC is the quicker route - Google notes that registering a trademark can take 6 to 12 months. Check with the issuer which countries' trademark offices they accept before you apply.

Where the logo shows up

Support depends on the mailbox provider, not on the sender, and the list changes. According to the BIMI Group's list of supporting providers (last updated May 2025), BIMI is supported by, among others, Gmail, Apple Mail, Yahoo, Fastmail, Zoho Mail, La Poste, Comcast and - relevant for Polish recipients - Onet Poczta. Microsoft's Outlook.com isn't on that list.

• Gmail requires a VMC or CMC and shows the checkmark only with a VMC.
• Apple Mail (iOS 16 and macOS Ventura onwards) requires a VMC, according to the BIMI Group's FAQ.
• Yahoo may show a logo without a certificate, for bulk senders with good reputation and an enforcing DMARC policy.

Even with everything in place, providers decide for themselves whether to display a logo, and they may take into account the sender's reputation and volume. A correct setup makes your logo eligible; it doesn't guarantee it.

Setting it up, in order

1. Get SPF and DKIM passing and aligned for every service that sends as your domain.
2. Move DMARC to p=quarantine or p=reject without a pct below 100, and watch the reports.
3. Prepare the SVG Tiny PS logo and publish it on an HTTPS URL.
4. If you want the logo in Gmail or Apple Mail, obtain a VMC or CMC and publish the PEM file on an HTTPS URL.
5. Publish the default._bimi TXT record and check it.

The email authentication checker reads your BIMI record, shows the logo URL, notes when there is no certificate, and warns when your DMARC policy isn't strong enough for BIMI to be honoured. BIMI is reported there but not graded. With AnyMail, BIMI is entirely a matter of your own DNS and web server: your mail is DKIM-signed with your own domain, so it can pass the aligned DMARC check that BIMI depends on.