BIMI (Brand Indicators for Message Identification) is a DNS record that tells supporting inboxes to display your logo beside your messages, and it only functions on domains with DMARC at p=quarantine or p=reject. The logo must be an SVG in a specific restricted profile, and most inboxes require a paid certificate proving you own the mark.
BIMI is the last step of an authentication project, not a shortcut to looking established.
What BIMI requires
Four conditions, all of which must hold.
| Requirement | Detail |
|---|---|
| DMARC at enforcement | p=quarantine or p=reject, applied at pct=100. p=none does not qualify |
| SPF and DKIM passing and aligned | The prerequisites of DMARC enforcement itself |
| A conforming SVG logo | SVG Tiny Portable/Secure (SVG Tiny P/S), square, on a solid background |
| A certificate | A VMC or CMC, hosted at a public URL, for most inbox display |
The DMARC requirement is the real gate. Reaching enforcement is weeks of staged rollout, described in how to set up DMARC safely, and it is the part of a BIMI project that takes actual time.
VMC versus CMC
Two certificate types exist, and the difference decides whether BIMI is available to you at all.
| VMC | CMC | |
|---|---|---|
| Full name | Verified Mark Certificate | Common Mark Certificate |
| Requires a registered trademark | Yes | No |
| Alternative requirement | — | Logo used publicly on a domain you own for at least 12 months |
| Gmail | Logo and verified checkmark | Logo only, no checkmark |
| Yahoo / AOL | Accepted, subject to reputation | Accepted, subject to reputation |
| Apple Mail | Documented support (macOS 13+, iOS 16+) | Not confirmed |
| Microsoft Outlook | Not displayed | Not displayed |
| Typical annual cost | Higher | Lower |
The Common Mark Certificate is the development that opened BIMI to small senders. Before CMCs existed, BIMI required a registered trademark, which excluded most small businesses and every solo operator. A CMC removes that barrier at the cost of Gmail's blue verified checkmark.
Certificates are issued by a small number of authorities — DigiCert and Entrust being the established ones — and pricing sits in the region of several hundred to over a thousand US dollars a year depending on issuer, certificate type, and term length. Verify current pricing directly with an issuer rather than trusting any published figure, including this one.
What BIMI actually does for open rates
Vendor case studies report open-rate lifts from BIMI. The claims deserve scepticism for a structural reason.
Every domain eligible for BIMI has DMARC at enforcement, which means it has completed a full authentication project. A domain that has just fixed its authentication, cleaned up its sending, and reached enforcement will see improved placement and improved opens whether or not a logo appears. Attributing that lift to the logo confuses the reward with the work that earned it.
The honest position: BIMI produces a visible brand indicator in Gmail, Yahoo, and Apple Mail. It is plausible that recognisability helps opens at the margin. No independent evidence isolates the logo's effect from the authentication work required to display it.
Microsoft Outlook does not display BIMI at all, which removes a substantial share of most B2B audiences from any benefit.
Whether BIMI is worth it
| Situation | Verdict |
|---|---|
Already at DMARC p=reject, recognisable brand, consumer audience |
Worth it — the hard work is done and the logo is cheap by comparison |
| Already at enforcement, B2B audience on Outlook | Marginal — the primary audience never sees it |
| Not yet at enforcement | Reach enforcement first; decide on BIMI afterward |
| Solo operator or small brand, no trademark | A CMC makes it possible; the annual cost rarely returns value at small volume |
| Chasing the Gmail verified checkmark specifically | A VMC is the only route, and it needs a registered trademark |
The strongest argument for pursuing BIMI has nothing to do with the logo. It forces a domain to DMARC enforcement, and enforcement stops spoofing, satisfies the strictest reading of provider requirements, and protects the brand from impersonation. Treating BIMI as the motivation to finish an authentication project is a reasonable use of it.
How to set up BIMI
Five steps, in order. The first is the longest by a wide margin.
Step 1 — Reach DMARC enforcement
Publish p=quarantine or p=reject at pct=100 after a staged rollout, and confirm the policy has propagated. A policy applied to only part of your mail does not qualify.
Step 2 — Prepare the logo as SVG Tiny P/S
The profile is restrictive by design, because inboxes render the file directly and a permissive format would be a security risk.
Requirements:
- SVG Tiny 1.2 Portable/Secure profile — no scripts, no external references, no animation, no raster images embedded
- Square aspect ratio, centred, with the mark filling the frame
- A solid background colour — transparency renders unpredictably
- A
<title>element containing the brand name, for accessibility - Small file size — a few kilobytes, not a few hundred
Design tools export SVG that almost never conforms on the first attempt. Converting an existing logo usually means stripping metadata, flattening effects, and removing any embedded font by converting text to paths.
Step 3 — Obtain a VMC or CMC
Apply through a certificate authority. Expect identity verification: company registration documents, and for a VMC, evidence of the registered trademark with its registration number and jurisdiction. For a CMC, evidence that the logo has been in public use on a domain you own for at least twelve months.
Verification takes days to weeks depending on how quickly documents are supplied.
Step 4 — Host the logo and certificate
Both files must be reachable over HTTPS at stable public URLs on a domain you control. The certificate file is typically a .pem.
Moving or renaming either file breaks BIMI silently, so put them somewhere they will not be reorganised.
Step 5 — Publish the BIMI DNS record
Create a TXT record at default._bimi.yourdomain.com:
v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/certificate.pem
| Tag | Meaning |
|---|---|
v |
Version. Always BIMI1 |
l |
HTTPS URL of the SVG logo |
a |
HTTPS URL of the VMC or CMC. Omitting it means most inboxes will not display the logo |
default is the selector, matching the default in default._bimi. Alternative selectors exist for multiple logos and are rarely needed.
Why a BIMI logo isn't showing
| Symptom | Cause |
|---|---|
| No logo anywhere | DMARC not at enforcement, or not at pct=100 |
| Logo in Yahoo, not Gmail | Missing or invalid certificate, or insufficient sending reputation at Gmail |
| Nothing in Outlook | Expected — Microsoft does not display BIMI |
| Worked, then stopped | Certificate expired, or a file was moved or renamed |
| Record valid, still nothing | Insufficient sending history; providers apply a reputation threshold on top of the technical requirements |
Meeting every technical requirement does not guarantee display. Gmail and Yahoo apply their own reputation thresholds before showing a logo, and a technically perfect BIMI setup on a domain with poor engagement shows nothing — which is consistent with everything else in email, explained in why authenticated emails still land in spam.
What's in the book, not here. The SVG preparation specification and the issuer comparison are in The Email Deliverability Playbook.
Frequently asked questions
Do I need a VMC for BIMI?
A certificate is required for display in most supporting inboxes, and it can be either a VMC or a CMC. A VMC requires a registered trademark and unlocks Gmail's blue verified checkmark. A CMC requires only that the logo has been publicly used on a domain you own for at least twelve months, and displays the logo without the checkmark.
How much does a VMC cost?
Pricing sits in the region of several hundred to over a thousand US dollars a year depending on issuer, certificate type, and term length, with CMCs generally cheaper than VMCs. Verify current pricing directly with an issuer such as DigiCert or Entrust, because published third-party figures date quickly.
Why isn't my BIMI logo showing?
The most common causes are DMARC not at p=quarantine or p=reject with pct=100, a missing or expired certificate, an SVG that does not conform to the Tiny P/S profile, or a moved file. Providers also apply their own reputation thresholds, so a technically valid setup on a low-reputation domain displays nothing.
Does BIMI improve open rates?
Vendor case studies report lifts, and no independent evidence isolates the logo's effect from the authentication work required to display it. Every BIMI-eligible domain has reached DMARC enforcement, which improves placement on its own.
Does Outlook support BIMI?
No. Microsoft Outlook does not display BIMI logos, which removes a substantial share of most B2B audiences from any benefit.
What is SVG Tiny P/S?
SVG Tiny Portable/Secure is a restricted SVG profile with no scripts, external references, animation, or embedded raster images. Inboxes render the file directly, so the restrictions exist for security. Standard design-tool exports almost never conform without editing.
Can I use BIMI without a certificate?
Some inboxes have displayed unverified logos historically, and current behaviour at Gmail and Yahoo effectively requires a certificate. Publishing a BIMI record without the a tag is valid syntax that usually results in no logo displaying anywhere.
What to do next
Check your DMARC policy before anything else. A domain at p=none cannot use BIMI, and the path to enforcement is the entire project — the logo is an afternoon.
If you are already at p=reject, get a pricing quote from a certificate authority and compare it against how much of your audience uses Gmail, Yahoo, or Apple Mail. Outlook-heavy audiences make the decision straightforward.
Free: The 60-Minute Email Authentication Fix — verify SPF, DKIM, DMARC, and alignment before spending anything on BIMI.
Go deeper: The Email Deliverability Playbook — the SVG preparation spec and the issuer comparison.
Related guides
- How to set up DMARC safely — the prerequisite, and the long part
- Email authentication: SPF, DKIM, DMARC and BIMI — where BIMI sits in the stack
- Bulk sender requirements 2026 — what is actually required, and what isn't
- Why authenticated emails still land in spam — why a valid record still shows nothing
- How to read DMARC reports — confirming enforcement is safe
The short version
- Reach DMARC enforcementPublish p=quarantine or p=reject at pct=100 after a staged rollout and confirm propagation. A policy applied to only part of your mail does not qualify.
- Prepare the logo as SVG Tiny P/SSquare, centred, solid background, no scripts or external references, a title element with the brand name, and a small file size. Convert text to paths.
- Obtain a VMC or CMCApply through a certificate authority and supply identity documents, plus trademark evidence for a VMC or twelve months of public logo use for a CMC.
- Host the logo and certificateBoth files must be reachable over HTTPS at stable public URLs on a domain you control. Moving or renaming either file breaks BIMI silently.
- Publish the BIMI DNS recordCreate a TXT record at default._bimi.yourdomain.com reading `v=BIMI1; l=<logo URL>; a=<certificate URL>`.
Free: The 60-Minute Email Authentication Fix
A no-fluff checklist to set up SPF, DKIM & DMARC correctly and pass Gmail & Yahoo's sender requirements.
Muhammad Basim has worked in digital marketing since 2013, focused on email deliverability and AI-assisted content production. He is the author of the Email Deliverability Playbook and the Email Copywriting Playbook, and has run 100+ email campaigns for ecommerce brands, coaches, and B2B senders. He writes about email, SEO, WordPress, and AI — with a bias toward what can be tested over what sounds good.
Related Articles
How to Read Google Postmaster Tools
Google Postmaster Tools is a free dashboard reporting how Gmail treats mail from your domain, and since 2025 it no longer reports a reputation grade — it reports compliance, spam rate, and a plain-language verdict on whether Gmail's users want your email. No third-party checker carries the same authority, because no third party is making […]
Email Verification Tools: Which Are Worth Paying For
Email verification checks whether an address can receive mail, and it cannot tell you whether anyone behind it wants yours. That distinction decides whether the spend is worth it, because a verified address that never opens damages your reputation exactly as much as it did before you paid to confirm it exists. Verification solves one […]
Email Spam Traps: How to Find and Remove Them
A spam trap is an email address that exists only to catch senders with poor list practice, and no tool can tell you whether one is on your list. Traps accept mail silently. They do not bounce, they do not complain, and they do not appear in any report until the damage is already done. […]