BIMI setup and requirements

What BIMI is

BIMI stands for Brand Indicators for Message Identification. It is a way for a domain to tell mailbox providers where to find an official logo, so that the provider can display it in the inbox next to authenticated messages from that domain. The domain publishes a TXT record that points to the logo and, optionally, to a certificate that proves the right to use it.

BIMI is not an authentication mechanism. It adds nothing to how mail is verified. It is a visible reward for domains that have already reached DMARC enforcement, and that is how it should be planned: as the last step of an email authentication project, not as a shortcut.

The four requirements

A logo appears only when every one of these holds. The first is the one most domains have not met.

1. DMARC at enforcement: the policy must be quarantine or reject, on the organisational domain, applied to all mail.
2. A logo in the SVG Tiny PS format, hosted at an HTTPS address.
3. For Gmail and Apple Mail, a mark certificate that covers the logo.
4. A BIMI TXT record that points to the logo and the certificate.

DMARC enforcement, precisely

Mailbox providers will not show a logo for a domain that does not protect itself from spoofing, since the logo would then lend credibility to forged mail. The DMARC policy must be p=quarantine or p=reject. A policy of p=none does not qualify. A pct value below 100 does not qualify at the major providers either, and a subdomain policy of sp=none can disqualify the domain.

The individual message must also pass DMARC, which means SPF or DKIM passing with alignment. If your domain is still at p=none, start there. Reaching enforcement safely takes weeks of reading aggregate reports, and no amount of work on the logo changes that.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

The logo file

The logo must be an SVG in a restricted profile called SVG Tiny Portable/Secure, usually written SVG Tiny PS. An ordinary SVG exported from a design tool is not in this profile and will be rejected. The profile forbids scripts, animation, external references and embedded bitmap images, and requires specific attributes on the root element.

1. The root element declares version 1.2 and the base profile tiny-ps.
2. A title element is present, containing the brand name.
3. No script, no animation, no links to external files and no embedded raster images.
4. A square aspect ratio, since providers display the logo in a square or a circle.
5. A solid background colour rather than transparency, so the logo looks the same in light and dark themes.
6. The logo centred with some margin, because circular cropping cuts off the corners.
7. A small file. Keep it well under the size limits the providers publish.

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
  <title>Example Ltd</title>
  <rect width="512" height="512" fill="#10203C"/>
  <path d="..." fill="#ffffff"/>
</svg>

Mark certificates: VMC and CMC

A mark certificate is issued by a certificate authority that has checked your organisation and your right to the logo. It contains the logo itself, so the mailbox provider can confirm that the file you host is the one that was verified. There are two kinds.

A Verified Mark Certificate requires the logo to be a registered trademark at one of the intellectual property offices the issuers accept. A Common Mark Certificate does not require a trademark; it is issued on evidence that the logo has been in public use by the organisation for a period of time. Both involve a validation process and an annual fee.

The two are not treated identically. Gmail displays logos backed by either kind, and shows its verified checkmark only for a Verified Mark Certificate. Other providers set their own rules, and they change, so check each provider's current documentation before buying.

The BIMI record

The record is a TXT record at the selector default, under _bimi, under your domain. The l tag gives the address of the logo and the a tag gives the address of the certificate file. Both must be HTTPS. The a tag is left out when there is no certificate.

A domain can publish other selectors for different logos, chosen per message with a BIMI-Selector header, but almost every domain needs only the default.

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/brand/logo.svg"

Putting it in order

The sequence below avoids paying for a certificate before the domain can use it.

1. Bring DMARC to quarantine or reject at 100 percent and keep it there for a few weeks.
2. Prepare the logo as SVG Tiny PS and validate it with a BIMI-aware tool.
3. Decide whether you need a certificate, based on where your recipients are. If most use Gmail or Apple Mail, you do.
4. If the logo is not a registered trademark, check whether a Common Mark Certificate is accepted where you need it, or begin a trademark registration, which takes months.
5. Obtain the certificate. The issuer returns a PEM file that includes the certificate chain.
6. Host the SVG and the PEM file at stable HTTPS addresses.
7. Publish the BIMI record and read it back.
8. Send test messages and wait. Providers may take days to begin showing a logo.

Why a correct record shows nothing

BIMI is a request, and each provider decides whether to honour it. When the record is right and no logo appears, the cause is usually one of the following.

1. The DMARC policy is p=none, or pct is below 100, or the subdomain policy is none.
2. The message itself failed DMARC, or passed only at a subdomain whose organisational domain is not at enforcement.
3. The SVG is not valid Tiny PS. This is the most frequent file problem.
4. The certificate is missing where one is required, has expired, or does not match the hosted logo exactly.
5. The certificate file does not include the full chain.
6. The logo or certificate address redirects, or is not served over HTTPS.
7. The sending domain or IP address has a poor reputation or low volume at that provider. Providers show logos for senders they already trust.
8. The recipient's mail client does not support BIMI, or the message was sent to a mailbox type where the provider does not display it.

Which providers show BIMI logos

Support varies and has changed over time. Gmail, Apple Mail, Yahoo Mail and several others display BIMI logos under their own conditions; some large providers have their own separate logo programmes and do not use BIMI. Because of this, the same message can show a logo in one inbox and initials in another, with nothing wrong on your side. Treat each provider's published requirements as the source of truth and re-check them before a renewal.

Keeping it working

BIMI depends on more moving parts than any other email record, and each can lapse. The mark certificate expires every year. The trademark behind it must stay registered. The logo and certificate files must remain at the same addresses, which a website redesign easily breaks. And the DMARC policy must stay at enforcement: someone relaxing it to p=none to debug a delivery problem removes the logo as a side effect.

When the brand changes its logo, the certificate must be reissued for the new mark before the file is replaced, or the hosted logo will no longer match the certificate.

Is it worth it

The honest answer depends on the sender. The work of reaching DMARC enforcement is worth doing regardless; it protects the domain and is increasingly expected by mailbox providers. The logo on top of that costs a certificate fee each year and, for a Verified Mark Certificate, a registered trademark. For a consumer brand that sends a lot of mail, a recognisable logo in the inbox is a plausible benefit. For a small business sending mainly to business recipients, many of whom use mail systems that do not display BIMI, the return is less clear.

Publishing a BIMI record without a certificate costs nothing and is harmless. It will show a logo at the providers that do not require one and nothing at the others.

Checking a domain

A BIMI check has several separate parts: the record exists and parses, the logo address is reachable over HTTPS, the certificate address is reachable, and the DMARC policy qualifies. The CloudSpex BIMI Record Checker reads the record and reports what the domain declares; the BIMI Record Generator builds a record from your logo and certificate addresses. Neither can tell you whether a particular mailbox provider will choose to display the logo, because that decision also depends on reputation that is not public.