What Is BIMI? Brand Indicators for Email Explained

BIMI, short for Brand Indicators for Message Identification, is an email standard that lets a verified sender display its brand logo next to messages in supporting inboxes. It builds on DMARC: the sending domain has to be at quarantine or reject, publish an SVG Tiny PS logo, and, for Gmail's blue checkmark, hold a Verified Mark Certificate.

Worth saying before you budget for it: BIMI does nothing for a domain whose authentication is broken. It sits on top of work you should already have finished, and it will not rescue a sender whose reputation is the actual problem. If SPF, DKIM, and DMARC aren't clean yet, start with what DMARC is and the SPF vs DKIM vs DMARC comparison, then come back.

What is BIMI?

BIMI is a DNS-based specification that tells participating mailbox providers which logo to show beside your messages. You publish a default._bimi TXT record pointing at a hosted SVG file and, optionally, a certificate. Supporting clients render that logo in the message list, the avatar circle, or a sender profile card.

The draft spec lives at the IETF, with the BIMI Group coordinating implementers. It has been in working-group status for years, which is part of why support across providers is uneven.

How BIMI works

When a message arrives, a BIMI-aware mail server authenticates it with SPF, DKIM, and DMARC. If DMARC passes and the policy is at quarantine or reject with pct=100, the server looks up default._bimi.yourdomain.com, fetches the SVG named in the l= tag, validates any certificate named in the a= tag against a trusted CA, and then renders the logo.

A minimal record looks like this:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

v=BIMI1 is the version. l= is the HTTPS URL of the logo; it has to be served over TLS, publicly reachable, and small (under about 32KB in practice). a= points at your certificate file. Leave a= out and Gmail shows nothing at all for your domain.

What BIMI requires

Three things, and the third is where most senders stall.

First, DMARC at enforcement. Your published record must be at p=quarantine or p=reject with pct=100; p=none fails the check, and so does a partial percentage rollout. If you're still building toward that, the DMARC generator handles the syntax and the deliverability guide covers the rollout sequence.

Second, a compliant logo. It has to be square, in the SVG Tiny Portable/Secure profile, with no raster images, no external fonts, no scripts, and no animation. All text converts to paths. The root element declares baseProfile="tiny-ps" and version="1.2", and the file needs <title> and <desc> elements. Most designers will hand you an ordinary SVG that fails validation, so budget a round trip. Our BIMI generator validates the file before you publish it.

Third, a certificate. A Verified Mark Certificate is essentially a TLS certificate issued against a registered trademark, and only two CAs issue them commercially: DigiCert and Entrust. Expect roughly $1,000 to $1,500 per year per domain, plus a few weeks of lead time while the trademark is checked.

If you have no registered trademark, both CAs now offer a Common Mark Certificate, which uses proof of prior use rather than a filing and runs closer to $400 to $600 per year. A CMC will display your logo in Apple Mail and several other clients; it will not earn Gmail's blue verified checkmark.

Where BIMI actually renders

The list is short but stable. Gmail shipped BIMI in July 2021 and added the verified blue checkmark in May 2023. Apple Mail added support in iOS 16, iPadOS 16, and macOS Ventura and accepts both certificate types. Yahoo Mail, AOL, and Fastmail shipped before Gmail did and remain supporters.

Microsoft is the gap that matters. If your list skews toward Outlook and Microsoft 365 mailboxes, most of your audience will never see the logo, and the certificate is hard to justify on brand grounds alone.

Whether BIMI is worth the money

My position, after setting this up for several senders: the brand effect is real and the engagement effect is small. A Gmail inbox where every row carries your mark looks like a company rather than a mailing list, and that consistency is the honest reason to do it.

What BIMI will not do is move a metric you can defend in a review. If someone promises you an open rate lift from a logo, ask which segment, which provider, and over what window; the effect, where it exists at all, belongs to consumer brands whose logo subscribers already recognize. A B2B SaaS company sending receipts and product updates should expect no measurable change.

There is a security argument that holds up better. BIMI can't stop someone spoofing a lookalike domain, but it does mean an impostor's message arrives without the mark your subscribers are used to seeing, because they can't pass DMARC on your domain or present your certificate. That's a slow-acting benefit built on habit, not a filter.

Treat it as a late-stage investment. Fix sender reputation, list hygiene, and DMARC first; buy the certificate once those are boring.

Setting it up, and what breaks

Assuming DMARC is already running, the sequence is short. Move the policy to p=quarantine; pct=100 or p=reject and let it run for a few weeks while you read aggregate reports. Prepare and validate the square SVG Tiny PS logo. Host it at an HTTPS URL on your own domain; a CDN is fine. Decide between VMC and CMC based on whether Gmail's checkmark matters to you. Publish the default._bimi record, then wait; Gmail caches heavily, so give it 24 to 48 hours before you conclude anything.

When the logo doesn't appear, the cause is almost always one of five things, roughly in the order I hit them: DMARC isn't at enforcement with pct=100; the SVG isn't Tiny PS compliant; the URL in the a= tag is wrong or the certificate has expired; the cache hasn't refreshed; or the sending domain doesn't match the domain that passes DMARC alignment. Check them in that order and you'll find it faster than you'll find it by rereading the spec.