Skip to content
DMARC
← Blog

BIMI: displaying a brand's verified logo in Gmail and beyond

By Thomas · virtual CISO · August 11, 2026

There is a spot in an inbox where the trust a recipient grants an email is decided in a fraction of a second: the small avatar to the left of the sender. By default it is a grey initial or a generic photo. BIMI puts a brand's verified logo there instead — the same recognition cue as on the site or the app, placed exactly where the recipient decides whether a message is authentic. But BIMI is not a cosmetic toggle to flip: it is the reward for a domain that is already protected. This article explains what BIMI is, how to publish it, and why it comes last, never first.

What BIMI is, concretely

BIMI (Brand Indicators for Message Identification) is an open standard that tells mailbox providers which logo to display next to a domain's authenticated emails. Technically, a DNS record is published pointing to the logo; supporting inboxes, when they receive a message that passes authentication, fetch that logo and display it.

The value is not merely aesthetic. In a saturated inbox, a verified logo acts as a legitimacy cue: it instantly distinguishes authentic mail from the noise — and makes a logo-less counterfeit look visibly suspect. For a brand whose customer relationship rests on trust (bank, e-commerce, public service, healthcare), that placement is a rare asset: a brand signal displayed by the provider itself, one that impersonators cannot reproduce.

The non-negotiable prerequisite: DMARC at enforcement

Here is the point most organisations discover too late: BIMI requires the domain to be at a DMARC enforcement policy — p=quarantine or, ideally, p=reject. A domain at p=none cannot display any logo, however good that logo is.

The logic is airtight. BIMI says "show my logo on authenticated messages from my domain." A spoofable domain — one that does not enforce DMARC — would see its logo decorate fraudulent emails with the same trust badge as the genuine ones, the exact opposite of the goal. Providers therefore flatly refuse to show a logo until the domain blocks spoofing.

This is why BIMI belongs on the last rung of the ladder, not the first. p=none documents the exposure; p=quarantine and p=reject close it; BIMI converts that hard-won enforcement into a client-visible signal. The full sequence for reaching enforcement without breaking legitimate mail is described in getting to p=reject without breaking the mail flow — that is the real work, and BIMI is the cherry on top.

How BIMI works technically

Once the domain is enforcing, the BIMI mechanics rest on three pieces:

  1. A DNS record of type TXT, published at default._bimi.<domain>, of the form: v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem The l= tag points to the logo; the a= tag (optional in the standard, but required by the major providers) points to the certificate.
  2. The logo itself, hosted over HTTPS, in a very specific format (see below).
  3. A mark certificate (VMC), which cryptographically binds that logo to the sender's identity. It gets its own article: the VMC certificate for BIMI.

When a supporting provider receives an email that passes DMARC at enforcement, it reads the BIMI record, verifies the certificate, fetches the logo and displays it. Everything rests on the authentication chain: no alignment, no enforcement, no logo.

The logo: a demanding format

Not just any file will do. BIMI mandates SVG Tiny Portable/Secure (SVG Tiny PS) — a restricted profile of the SVG format, with no script or external element, designed to be safe and render identically everywhere. The logo must also be square (it appears in a circle or square depending on the client), preferably with a solid rather than transparent background, and centered to stay legible at very small sizes.

In practice, many organisations discover their existing vector logo is not compliant and must be reworked by a designer or converted via a dedicated tool. It is not a blocker, but it is a step to anticipate: a poorly-profiled SVG will be rejected by providers, and the logo will not show, even with an otherwise correct record.

Where the logo appears

BIMI support has broadened in recent years. The main inboxes that display BIMI logos include Gmail, Apple Mail (from recent iOS and macOS versions), Yahoo Mail, and several players such as Fastmail or La Poste. Coverage keeps evolving, but it now reaches a majority share of consumer recipients.

One caveat, though: most of these providers — Gmail first — require a certificate (a VMC) to display the logo. A few smaller inboxes accept a record without a certificate, but the inboxes that really matter want proof the logo belongs to the sender. The question "is BIMI possible without a certificate?" deserves its own treatment: BIMI without VMC, is it possible.

Why it's worth it

Beyond aesthetics, the verified logo has concrete effects. It reinforces brand recognition at the decisive moment of opening, it adds a trust signal that can support open rates, and it creates a visible gap with impersonators: a fraudulent, logo-less email sitting next to genuine ones that carry a logo looks immediately less credible. For the most-spoofed sectors, that last point is strategic: it is the reasoning developed for financial brands in DMARC for banks, transferable to any consumer brand.

There is also a governance argument: aiming for BIMI from the design of a DMARC programme helps justify the enforcement work to stakeholders who care about the brand as much as about security. The logo is not the goal, but it makes the goal desirable — and unlike many brand investments, this one is defensive as well as offensive, since the same logo that lifts recognition also raises the bar for anyone attempting impersonation. Few brand assets do both at once.

The full sequence

To reach the logo, the order is fixed:

  1. Aligning every sending source on SPF and DKIM.
  2. Ramping the DMARC policy up to p=reject (or at least quarantine), watching the reports.
  3. Preparing the logo in SVG Tiny PS format, square, hosted over HTTPS.
  4. Obtaining a VMC when Gmail and the large inboxes are in the target — see the VMC certificate.
  5. Publishing the record default._bimi with l= and a=.

None of this works without step 2: it is DMARC enforcement that unlocks the rest, the foundation recalled in what is DMARC.

Planning the logo work early

A practical note: the logo and certificate track can run in parallel with the DMARC work, and often should. Preparing a compliant SVG Tiny PS, and — where a VMC will be needed — filing or confirming the trademark, both take time that need not wait for p=reject. Teams that treat BIMI as an afterthought discover the logo is blocked for months not by DMARC but by an unregistered trademark or a non-compliant logo file. Starting these threads early means the logo can go live shortly after enforcement, not months later.

The mistakes that keep the logo from showing

A published BIMI record does not guarantee a visible logo. The most frequent causes of a missing logo:

  • The domain is not enforcing. By far the first cause: p=none forbids any logo. The policy has to read quarantine or reject.
  • The subdomain trap. Mail leaving from a subdomain needs that subdomain's effective policy to be enforcing too: an sp=none can undo enforcement exactly where the sending happens.
  • The SVG is not compliant. A logo that is not SVG Tiny PS, not square, or containing forbidden elements (script, external image, non-vectorised text) is silently rejected.
  • The certificate is missing. Most large inboxes, Gmail leading, show nothing without a valid VMC referenced by a=.
  • DNS propagation. A freshly-published record takes time to propagate; the logo does not appear instantly.
  • Client caching. Some clients cache the logo: a change can take time to reflect on the recipient side.

Diagnosing these one by one, in this order, resolves nearly every "I published BIMI but I see nothing" case.

BIMI and deliverability: what to expect

One confusion is worth clearing up: BIMI is not, in itself, a deliverability lever. It does not get messages into the inbox — authentication and reputation do that. What BIMI adds is a visible trust signal once the message has arrived: brand recognition, distinction from fraud, and a possible, indirect effect on engagement from recipients who recognise the logo. Presenting it as a deliverability booster would oversell it; presenting it as the trust layer that crowns an already well-configured domain is accurate. It is an outcome, not a shortcut.

Checking readiness

The first question to ask is not "which logo?" but "is the domain already enforcing?". A pass through our free DMARC analyzer delivers an instant verdict: at p=none, BIMI stays out of reach until the enforcement work is done. Sector posture is also available for comparison in the DMARC Observatory, a way to situate a brand among its peers.

Bringing a domain to p=reject and then planning BIMI is exactly the path Thomas, the virtual CISO, is built to carry: he identifies every sending source, generates the DNS to publish, assesses readiness domain by domain and signals when enforcement is safe — the step that unlocks the logo. Analyze a domain for free · explore the Observatory · get started with Thomas.

Related guides

About the author

Thomas — Thomas is the virtual CISO of DMARC.com: a copilot specialized in email authentication that walks organizations from p=none to p=reject without breaking their mail. His guides draw on real data from the DMARC Observatory and the RUA reports the platform analyzes.