BIMI Explained: Brand Logos in Email

BIMI puts your verified brand logo right next to authenticated messages in the inbox, but only if your domain is already passing DMARC at enforcement. Brand Indicators for Message Identification is the standard behind that little logo, and it is built on top of email authentication rather than alongside it. You cannot bolt BIMI onto a domain that still spoofs easily; the whole point is that the logo appears only on mail that provably came from you. If the underlying concepts are new, read Email authentication explained first.

The logo is the reward, not the mechanism. BIMI leans entirely on DMARC, defined in RFC 7489, which means your From domain has to pass SPF or DKIM with alignment and carry a published policy that tells receivers to act on failures. Once that foundation holds, you publish a BIMI record and supply a logo. For a refresher on the policy layer underneath, see DMARC explained.

Why BIMI exists

Inboxes are noisy and phishers are good at imitation. BIMI gives brands a way to surface a recognizable, controlled logo on legitimate mail, which helps recipients distinguish the real thing from a lookalike. The BIMI Group, the industry body that maintains the specification, frames it as both a trust signal and an incentive: to earn the logo slot, you first have to authenticate your mail properly. That pushes more domains toward DMARC enforcement, which benefits the whole ecosystem.

It is worth being clear about what BIMI is not. It does not improve authentication on its own, it does not guarantee inbox placement, and it does not replace SPF, DKIM, or DMARC. It sits on top of all three.

The prerequisites

Getting a logo to render takes more than dropping a file in DNS. Each piece has to be in place, in order.

Requirement	Detail	Notes
DMARC enforcement	Policy of quarantine or reject	A policy of none does not qualify
Alignment	SPF or DKIM aligned to the From domain	Same rule DMARC already enforces
BIMI record	TXT record at default._bimi	Points to your logo and, if used, your certificate
Logo format	SVG Tiny PS (Portable/Secure profile)	Square, centered, solid background
Verified Mark Certificate	VMC tying the logo to a registered trademark	Required by Gmail and several others

The DMARC requirement trips up most people. Many domains sit at p=none for monitoring and never advance. BIMI simply will not display until you reach quarantine or reject, so the move to enforcement is the real prerequisite, not a formality.

The SVG Tiny PS format is stricter than ordinary SVG. It must be a specific portable profile, square, with the logo centered on a solid background and no scripts or external references. Most design files need conversion and cleanup before they validate.

The Verified Mark Certificate

A VMC is a certificate from an authorized provider confirming that the logo you want to display belongs to a trademark you actually own. Gmail and a growing set of providers require one before they will render your BIMI logo. Securing a VMC usually means holding a registered trademark for the mark, then paying an annual fee to the certificate authority. That cost, often in the hundreds of dollars per year, is the main reason smaller senders pause.

Some providers will show a logo with a self-asserted record and no VMC, but coverage is inconsistent and the major mailboxes lean toward requiring the certificate.

Which providers support it

Support has broadened steadily. Gmail, Apple Mail, Yahoo, and Fastmail display BIMI logos for senders that meet their requirements, with Gmail and Apple generally insisting on a VMC. Behavior differs by provider and keeps changing, so treat any single list as a snapshot rather than a guarantee. Check current support through the BIMI Group before you invest.

Is it worth the effort?

For an established brand that already runs DMARC at enforcement, BIMI is a modest, sensible add-on: the logo reinforces recognition and may nudge engagement. For a small sender still stuck at p=none, the honest answer is to fix authentication first. The work you do to qualify for BIMI, reaching enforcement and tightening alignment, delivers most of the deliverability and anti-spoofing value on its own. The logo is a nice finish, not the foundation.

A reasonable path: get to p=reject, confirm clean alignment, then decide whether a VMC fits your budget and brand visibility goals.

Curious whether your domain is even ready for BIMI? Check your DMARC policy and DNS records free at DomainIntel and see how close you are to enforcement.