BIMI setup: what it requires and what it actually does for deliverability

BIMI (Brand Indicators for Message Identification) lets a verified logo appear next to your messages in a supporting inbox - Gmail, Yahoo and a handful of others at the time of writing. It does not improve deliverability directly; it is a trust signal layered on top of authentication you need to have in place regardless.

The prerequisite you cannot skip: DMARC enforcement

BIMI only activates if your domain has a DMARC record at p=quarantine or p=reject, not p=none. This is deliberate - BIMI's entire premise is "only a domain that has already proven it blocks its own spoofed mail gets to show a logo," so a monitoring-only DMARC policy will not qualify no matter how correctly the BIMI record itself is published.

$ dig TXT _dmarc.example.com +short
"v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com; pct=100"

If your DMARC is still at p=none while you evaluate alignment, BIMI is not reachable yet - get DMARC to enforcement first, confirmed stable for at least a few weeks of monitoring reports showing no legitimate mail failing alignment.

The BIMI record itself

The BIMI TXT record lives at default._bimi.example.com and points to an SVG logo (Tiny PS profile, square, specific colour-profile requirements) and, for most receivers that currently honour BIMI, a Verified Mark Certificate (VMC).

$ dig TXT default._bimi.example.com +short
"v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

• l= points to the logo SVG, served over HTTPS with a valid certificate.
• a= points to the VMC, a certificate issued by one of a small number of authorities (DigiCert and Entrust are the ones in active use) that attests your organisation legally owns the trademark on the logo.

Gmail requires the VMC for the logo to display; without it, the BIMI record can still be valid and published but the logo simply will not render in Gmail. Some other providers have at various points displayed logos without a VMC - verify current behaviour per provider before assuming your record works everywhere once published.

What BIMI changes and what it does not

BIMI is a brand-trust and recognition layer, not a spam-filter input:

• It does not raise your sender score.
• It does not get a message out of the spam folder - a message that fails authentication or trips content filters still lands in spam, logo record or not.
• It can improve recognition and click-through *within* the inbox once a message already lands there, because recipients learn to recognise the verified mark.
• It signals, indirectly, that the sending domain maintains a strict DMARC policy - which is itself a reasonable proxy for a well-run sending program, but the policy is doing the authentication work, not the logo.

Setup order that actually works

1. Get SPF and DKIM passing and aligned for all legitimate sending sources.
2. Move DMARC from p=none to p=quarantine with full reporting, and watch aggregate reports for several weeks.
3. Move to p=reject once reports show no legitimate traffic failing.
4. Commission or produce a square SVG logo meeting the Tiny PS profile.
5. Obtain a VMC from a supported certificate authority if you want the logo to render in Gmail.
6. Publish the BIMI TXT record and verify it resolves correctly before expecting logos to appear - rendering is not instant and depends on each provider's own cache and rollout.

What not to do

Do not publish a BIMI record while DMARC sits at p=none expecting it to somehow activate once enforcement happens later - re-check the record after the DMARC change, since some providers cache the "ineligible" state. Do not skip the VMC and assume the logo will show everywhere; Gmail specifically will not display it without one. And do not treat BIMI as a deliverability fix for a domain that is actually struggling with spam placement - fix authentication and sending practices first; BIMI is the reward for already having done that, not a shortcut around it.

Where MailPilot fits

MailPilot checks SPF, DKIM and DMARC on your sending domain, which is the foundation BIMI sits on top of - if your DMARC policy is not yet at enforcement, that shows up in the authentication check before you spend time or budget on a VMC. Reputation is tracked per mailbox daily, so you can confirm your authentication posture is stable before layering BIMI on top of it.