BIMI: what it takes to show your logo, and what it does not do

BIMI — Brand Indicators for Message Identification — displays your logo next to your messages in email clients that support it. The entry requirement is strict: a DMARC policy of p=quarantine or p=reject on the sending domain, a logo in a specific SVG profile, a certificate from an authorised certificate authority, and a TXT record pointing at both. Get the order right and it works. Skip a prerequisite and nothing displays, with no error anywhere.

Start with the uncomfortable part: BIMI does not improve deliverability. It changes nothing about how filters score your mail. Its value is recognition in the inbox and a visible signal that your domain is authenticated and enforced. Any article promising inbox-placement gains from BIMI is describing the DMARC enforcement that BIMI *requires*, not BIMI itself.

Where it fits among the records

SPF authorises servers. DKIM proves a signature. DMARC enforces alignment between those and the visible From domain, and reports on failures. BIMI sits on top and says: for mail that already passes DMARC under an enforcing policy, here is the verified logo to display. It cannot exist without the layers beneath it, which is the whole design — the logo is only meaningful because the mail is provably yours.

The five prerequisites, in order

1. DMARC at enforcement. p=quarantine or p=reject on the domain in the From header. p=none does not qualify. If you are not there yet, that is the real project; BIMI is an afternoon afterwards.

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourdomain.com

Reach it the usual way: p=none with reports until every sender is aligned, then quarantine for a week, then reject. Do not jump.

2. A logo in SVG Tiny Portable/Secure. Not any SVG. The SVG Tiny PS profile is deliberately restrictive: no scripts, no external references, no raster images embedded, a square aspect ratio, a solid background, and a title element carrying the brand name. Most design tools export something that fails validation; the logo usually needs hand-editing of the SVG source. Keep it legible at around 32 pixels, which means a mark, not a wordmark.

3. A Verified Mark Certificate. A VMC is issued by a certificate authority authorised for this purpose — the recognised issuers have been DigiCert and Entrust — and it attests that the logo belongs to you. It normally requires a registered trademark for the mark, in a jurisdiction the issuer recognises, and it is a paid, renewing certificate. This is the step that stops most BIMI projects, and it is better to discover it now than after the logo work.

For organisations without a registered trademark, a Common Mark Certificate based on prior use has emerged as an alternative, but client support for CMCs is narrower than for VMCs. Check what the clients you care about currently honour before choosing that path.

4. The DNS record. A TXT record at a BIMI selector, by convention default:

default._bimi.yourdomain.com   TXT   "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem"

l= is the HTTPS URL of the SVG, a= is the HTTPS URL of the certificate. Both must be served over valid HTTPS with correct content types, publicly reachable with no authentication, and stable — these are fetched by mail providers, not by your recipients. An expired TLS certificate on the host serving your logo breaks BIMI silently.

A selector other than default can be named per message with a BIMI-Selector header, which is how a brand runs different logos for different mail streams.

5. Testing. Send to a mailbox at a supporting client and look. Gmail has supported BIMI for authenticated senders with a VMC; Yahoo and Apple Mail have their own support, and other clients have none. Expect inconsistency across clients and expect caching delays after a logo change. Also check the Authentication-Results header for a bimi= verdict where the receiver reports one.

What goes wrong

• DMARC is at `p=none`. Nothing displays, no error. The most common cause by far.
• Subdomain mismatch. Mail from news.yourdomain.com needs BIMI and enforcing DMARC applicable to *that* name. Check sp= and publish a selector for the subdomain if needed.
• The SVG fails the profile. Validate it before publishing; a visually fine logo with a <script> or an embedded raster is rejected.
• The certificate expired. VMCs renew. Put the expiry in the same calendar as your TLS certificates.
• The logo or certificate URL is behind a redirect, a login, or a CDN rule that blocks unknown user agents. Fetch both with curl -I from outside your network and confirm a 200 with a sensible content type.
• Mail that does not pass DMARC on every path. BIMI only shows on messages that pass. A stream that relies on an unaligned SPF pass will display inconsistently.

Who should bother

Worth it: consumer brands whose domains are actively impersonated, financial and transactional senders, and organisations that have already reached p=reject and want the visible return on that work.

Not worth it: B2B senders at modest volume, anyone still at p=none, anyone without a registered trademark, and anyone hoping it will lift inbox placement. The DMARC enforcement BIMI requires is the part that helps you; do that part regardless, and treat the logo as optional.

What not to do

• Do not start with the logo. Start with DMARC enforcement, which is the long pole.
• Do not publish a BIMI record while at p=none and conclude BIMI is broken.
• Do not host the SVG or the certificate on an endpoint that can change or expire without anyone noticing.
• Do not expect a logo everywhere. Client support is partial by design.
• Do not treat BIMI as anti-spoofing. DMARC does that work; BIMI advertises it.

MailPilot checks SPF, DKIM and DMARC on each connected mailbox's sending domain and measures real per-provider inbox placement with a seed-inbox network — the groundwork that has to be right before a logo beside your name is worth paying for.