How to set up BIMI: logo, DMARC and certificates

BIMI (Brand Indicators for Message Identification) lets you publish your logo in DNS so that participating mailbox providers can show it next to your messages. It sits on top of DMARC: a logo is only considered for mail that passes DMARC under an enforcing policy.

Two things to know before you start:

• BIMI is not an IETF standard. The specification is an individual Internet-Draft, draft-brand-indicators-for-message-identification (revision 14, May 2026), which has no formal IETF standing. The logo format is another individual draft. In practice, what each mailbox provider requires matters more than the draft — and the providers differ.
• BIMI doesn’t improve delivery. In the BIMI Group’s words, it “does not change message delivery; it is a display signal on top of strong authentication.” Even with everything valid, the provider decides whether to show the logo, and reputation plays a part. The security benefit comes from the DMARC enforcement BIMI requires, not from the logo.

Where logos appear

Provider	Certificate	Notes
Gmail	VMC or CMC required	A checkmark appears next to senders verified with a VMC. The record must point to the certificate (PEM file).
Apple Mail (iOS and iPadOS 16, macOS Ventura 13 and later, iCloud.com)	VMC	Apple’s documentation mentions VMCs and “other forms of BIMI Evidence Documents”; the BIMI Group lists Apple among providers that require a VMC.
Yahoo	Not required	Only for bulk mail, and only when Yahoo sees sufficient reputation and engagement. A VMC, if present, informs eligibility.

The BIMI Group’s list of supporting providers (last updated May 2025) also includes Fastmail, Zoho Mail, La Poste, Onet Poczta and Comcast, among others. It lists Microsoft as not supporting BIMI, so don’t expect a logo in Outlook.com or Microsoft 365 mailboxes. Rules change; check each provider’s own documentation.

Prerequisite: DMARC at enforcement

The draft requires, before any BIMI processing:

• a DMARC policy of p=quarantine or p=reject for the From domain and its organizational domain — p=none on either disqualifies the message;
• if a subdomain policy sp is published, it must not be none;
• the message itself must pass DMARC, through aligned SPF or aligned DKIM (receivers may also accept a trusted ARC chain).

A record that qualifies:

_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc-reports@example.com"

Don’t rush to enforcement for the logo’s sake: an enforcing policy sends your own mail to spam, or rejects it, when it comes from a service that isn’t properly aligned. Follow the rollout in How to configure DMARC.

Step 1: prepare the logo (SVG Tiny PS)

BIMI accepts only SVG, in a restricted profile called SVG Tiny Portable/Secure (draft-svg-tiny-ps-abrotman). A normal SVG export from a design tool almost never complies. The requirements:

• the root element has version="1.2" and baseProfile="tiny-ps";
• it contains a non-empty <title> element — your brand name; the draft recommends at most 64 characters;
• no scripts, animation, interactive elements, links or external references, and no embedded bitmap images;
• no x= or y= attributes on the root <svg> element (Illustrator adds them);
• uncompressed size of at most 32 KB, as the draft recommends.

Gmail adds its own rules: at least 96 × 96 pixels, given in absolute pixel units rather than percentages. Google also recommends centring the logo in a square with a solid background, since transparent backgrounds may not display as expected.

A minimal skeleton:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
     width="96px" height="96px" viewBox="0 0 96 96">
  <title>Example</title>
  <rect width="96" height="96" fill="#ffffff"/>
  <!-- logo shapes go here -->
</svg>

The BIMI Group publishes SVG conversion tools and an SVG assistant that help with this. Host the file over HTTPS; the BIMI Group recommends serving it with Content-Type: image/svg+xml.

Step 2: get a mark certificate

A mark certificate is issued by a Mark Verifying Authority and ties your logo — the SVG is embedded in the certificate — to your organization and domain. There are two kinds:

	VMC (Verified Mark Certificate)	CMC (Common Mark Certificate)
Logo must be	a registered trademark (or government mark)	a prior-use mark, or a modified registered trademark
Gmail	logo with checkmark	logo, no checkmark
Apple Mail	accepted	not mentioned in Apple’s documentation

• CMC eligibility: DigiCert, for example, requires the logo to have been used for at least 12 months on a domain you control.
• Issuers are listed on the BIMI Group’s certificate issuers page; at the time of writing, DigiCert, GlobalSign and SSL.com.
• Trademarks take time. If your logo isn’t registered yet, Google notes that the process can take 6 to 12 months.
• Renewal: mark certificates are valid for at most 398 days, so plan for a yearly renewal.
• The PEM file: it holds your certificate followed by the issuer’s intermediate certificates (Google’s instructions also append the root certificate). Host it at an HTTPS URL and make sure the whole chain is in the file.
• Changing the logo means a new certificate. If your record lists both the SVG and the certificate, the receiver checks that the two logos are identical (draft section 7.9).

Step 3: publish the BIMI record

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://brand.example.com/bimi/logo.svg; a=https://brand.example.com/bimi/certificate.pem"

Tag	Meaning
v=BIMI1	Required, first, exact. Anything else and the record is ignored.
l=	HTTPS URL of the SVG logo. Required tag; an empty l= together with an empty a= declines BIMI. Google’s example leaves l= empty and relies on the logo inside the certificate at a=, but the draft expects a valid URL in l=, so filling in both is the safer choice.
a=	HTTPS URL of the PEM file with your VMC or CMC. Optional; without it there is no evidence, which Gmail and Apple won’t accept.

• Name: default._bimi in front of your domain. As with DMARC, many DNS panels append the domain themselves — enter just default._bimi.
• One record only. If there are several, no BIMI processing happens.
• Timing: Google suggests a TTL of one hour and says the logo can take up to 48 hours to appear.
• Subdomains: for mail from news.example.com, receivers look up default._bimi.news.example.com first, then fall back to default._bimi.example.com. To keep a subdomain out while the main domain has a logo, publish an explicit declination there: v=BIMI1; l=; a=;.
• Selectors: default is used unless a message carries a BIMI-Selector header covered by an aligned DKIM signature. The draft also defines an lps= tag that derives the selector from the local part of the sender’s address. Most domains need nothing else.

The record is tied to the From domain, not to a sending server, so it covers mail from your newsletter or CRM service too — as long as that mail passes DMARC.

Why the logo doesn’t show

• DMARC is at p=none, sp=none, pct below 100, or t=y.
• The message fails DMARC — typically a third-party service sending without aligned DKIM.
• The SVG isn’t Tiny PS: missing <title>, x/y on the root element, an embedded bitmap, the wrong baseProfile.
• Gmail: no a= tag, an unreachable PEM file, or intermediate certificates missing from it.
• The logo at l= differs from the one in the certificate.
• The record ended up at default._bimi.example.com.example.com, or there are two records.
• The provider doesn’t support BIMI, or doesn’t trust the sender yet — reputation, volume, and for Yahoo, bulk mail only. Caching can also delay display; test with fresh messages.

Check your setup

Run the BIMI checker: it reads default._bimi, checks the SVG against the Tiny PS profile, examines the VMC or CMC, and verifies that your DMARC policy meets the requirement. Then send a message to a mailbox at a supporting provider and paste its headers into the email header analyzer. dmarc=pass is the precondition; receivers that implement the draft may also add a bimi= result (pass, none, fail, temperror, declined, skipped) to Authentication-Results.