BIMI: get your logo in the inbox

That little brand logo next to emails in Gmail and Apple Mail isn't decoration — it's BIMI. And it only appears for domains that have their authentication fully in order. Here's what BIMI is, what it requires, and how to set it up.

What is BIMI, exactly?

BIMI — Brand Indicators for Message Identification — is an open standard that lets mailbox providers display your brand logo next to your authenticated emails. It works in Gmail, Apple Mail, Yahoo Mail and several others. The key detail: BIMI rides on top of DMARC. It only shows your logo when your domain proves it is really you — p=none won't cut it. That's what makes the logo meaningful: when recipients see it, they know the message passed real authentication checks.

What do you need before BIMI will work?

Four things, in dependency order:

1. DMARC at enforcement. Your policy must be p=quarantine or p=reject — a monitoring-only p=none policy doesn't qualify. If you're not there yet, follow the DMARC rollout guide and the DMARC policies guide first.
2. Aligned SPF and/or DKIM. Your mail has to pass SPF or DKIM with proper DMARC alignment for your domain — the same bar enforcement already requires.
3. A square SVG logo, hosted over HTTPS. BIMI uses the SVG Tiny 1.2 profile: a square, centered mark (no tagline text — it renders tiny), served from a stable HTTPS URL you control.
4. A certificate proving the logo is yours. Gmail and Yahoo require a Verified Mark Certificate (VMC) — or, for Gmail, the lower-cost Common Mark Certificate (CMC) if you don't have a registered trademark. Apple Mail shows BIMI logos without any certificate.

What does a BIMI record look like?

BIMI is a TXT record at the default._bimi host of your domain — for example, default._bimi.example.com. A finished record looks like this:

The l= tag points to your logo file (required). The a= tag points to your VMC or CMC certificate file — optional in the BIMI spec itself, but Gmail and Yahoo won't display your logo without it.

How do you set up BIMI step by step?

1. Get DMARC to enforcement. p=quarantine or p=reject at pct=100, with every legitimate sender passing alignment. This is the hard part — and the part that actually protects your domain.
2. Create the logo. A square SVG in the Tiny 1.2 profile: your mark centered, generous padding, no fine text. Test how it looks at 48 pixels — that's roughly how small it renders.
3. Host it over HTTPS at a URL that won't change, e.g. https://yourdomain.com/bimi/logo.svg.
4. Get your certificate. A VMC requires a registered trademark matching the logo and is issued by authorities like DigiCert or Entrust. If you don't have a trademark, Gmail also accepts a Common Mark Certificate (CMC) — cheaper and faster, but it only unlocks the logo in Gmail.
5. Publish the TXT record at default._bimi.yourdomain.com with your l= and a= values.
6. Verify. Send test mail to Gmail and Apple Mail inboxes and check that the logo appears, or run your record through a BIMI validator. Allow up to 24–48 hours for DNS and mailbox-provider caches to catch up.

Do you actually need a VMC certificate?

It depends on where your recipients read mail. Gmail and Yahoo require a certificate (VMC, or CMC for Gmail) — it's what stops anyone from slapping your logo on their own mail, and it's the main cost of BIMI. Apple Mail and some other providers show BIMI logos with no certificate at all. That's why you'll sometimes see a sender's logo in Apple Mail but a plain letter avatar in Gmail: the authentication is fine, the certificate is what's missing.

Will BIMI improve your deliverability?

Honest answer: BIMI doesn't change spam-filter decisions — authentication and sender reputation do that. What it changes is recognition: your mail is instantly identifiable in a crowded inbox, which builds trust and can lift open and engagement rates over time. And the real deliverability win is hiding in the prerequisite: reaching DMARC enforcement, which stops spoofing of your domain cold. Think of BIMI as the visible reward for doing the invisible work.

Check your setup first

Before spending money on a certificate, confirm your foundation is solid: run your domain through the free DMARC audit tool to verify you're at enforcement with clean alignment. BIMI is a finishing touch — enforcement is the house it's built on.