What is BIMI?
BIMI — Brand Indicators for Message Identification — puts your logo next to your messages in the inbox, in place of the grey initial most senders get. It is the one email standard your recipients can actually see, and it is the reward for doing the rest of email authentication properly: BIMI only works for a domain whose DMARC policy is already enforced.
What it takes
Three things, in this order.
1. DMARC at enforcement. Your DMARC policy must be p=quarantine or p=reject, applied to all of your mail — Gmail also requires pct=100 if you publish a pct tag, and a subdomain policy of sp=none disqualifies the domain. A domain on p=none is not eligible, because nothing stops someone else sending mail that would carry your logo. If you are not there yet, DMARC policy: none, quarantine, reject explains the ramp.
2. A logo in the right format. The logo must be an SVG file in the restricted SVG Tiny PS profile, square, served over HTTPS. An ordinary SVG export usually needs converting; most design tools and BIMI generators can produce the Tiny PS variant.
3. A BIMI record in DNS at default._bimi.<your domain>:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"l=is the HTTPS address of the logo. Bothv=andl=are mandatory (an emptyl=is allowed, and means "no logo").a=is the HTTPS address of a mark certificate, and it is optional in the record — but see below.
The certificate question
Which inboxes show the logo depends on whether you have a certificate:
- Gmail shows a BIMI logo only with a certificate: a Verified Mark Certificate (VMC), which requires a registered trademark, or a Common Mark Certificate (CMC). Both are issued by a small set of certificate authorities after checking your organisation, and typically cost approximately $1,000 a year.
- Apple Mail also shows a BIMI logo only after the mail provider has verified a certificate for it.
- Other mailbox providers set their own rules, and they change; check the current requirements of the ones your recipients use.
So a BIMI record without a= is not wrong, but Gmail and Apple Mail will not show its logo.
Who uses it
Mostly brands that send a lot of mail to consumers — retailers, banks, airlines, newsletters — where a recognisable logo in the inbox is worth the certificate. For a business that mainly emails its own customers and partners, BIMI is a nice finish, not a priority: getting DMARC to enforcement matters far more, and is the prerequisite anyway.
Hosting your logo with DMARCmetric
On paid plans (pricing) we can host the logo file for you. Open the domain's Settings page and find Brand logo (BIMI):
- Upload your logo as an SVG file in the SVG Tiny PS format: square, 32 KB at most. We check it against the main rules of the format, and if we refuse it we list the problems we find (up to 10 kinds); a few checks run only once those are fixed. We publish the file exactly as you uploaded it — we never change it, because a certificate covers those exact bytes.
- Publish the record we show: a
default._bimiTXT record whosel=is your logo's address onbimi.dmarcmetric.com. If you already have a BIMI record, edit it instead of adding a second one; when we can read your current record, the record we show keeps the certificate (a=) it names, and when we can't, the page tells you to keep that part yourself. - Check the list under it: whether your logo, your record and your DMARC policy are in place.
Every new file you upload becomes a version with its own address, up to 3 per domain; uploading the same file again gives you the version you already have. When you change your logo, update l= to the new address, then delete the old version. Uploading opens once your domain's DMARC record names your DMARCmetric report address, so only someone who controls the domain's DNS can publish a logo for it. The logo is public, like every BIMI logo: mailbox providers fetch it without signing in. For Gmail and Apple Mail to show it you still need a certificate, issued by a certificate authority.
Preparing the file
If the only problems we list are about the <svg> element's version and baseProfile and its <title>, only the start of the file needs changing: the <svg> element needs version="1.2" and baseProfile="tiny-ps", and its first child must be a <title> with your brand name.
A picture inside the file. An SVG file can carry a picture (PNG, JPEG or similar) inside it. BIMI logos must be drawn entirely as vector shapes, so when a file we refuse contains such a picture, the page says so first, above any other problems. If your whole logo is that picture — common with online PNG-to-SVG converters — ask whoever designed your logo for the original vector artwork (for example an .ai, .eps, .pdf or .svg file).
What the Domain health card shows
| Result | What it means |
|---|---|
| not published | No BIMI record. Optional — Gmail and Apple require a logo certificate (approximately $1,000/year) to display your logo. |
| record only | A valid record with no a= certificate (or an empty l=, which means "no logo"). Gmail and Apple Mail will not show a logo without a certificate. |
| record + VMC | The record declares both the logo and a certificate (VMC or CMC). |
| malformed | A record is published but does not parse: v=BIMI1 and l= are both mandatory, and a non-empty l= or a= must be an HTTPS address. |
| couldn't read | Our DNS lookup failed. This says nothing about your domain — press Re-check. |
The card checks the record. It does not download or validate the logo or the certificate, and it reads the default selector only. The free BIMI checker reads any selector, checks the DMARC prerequisite and can show the logo; neither validates the certificate. Unlike the four mail transport security rows (MTA-STS, TLS-RPT, DNSSEC, DANE), the BIMI row is on every plan.