BIMI: Showing Your Logo in the Inbox and What You Need First

BIMI is a standard that lets your brand logo appear next to your emails in the inbox of supporting mail providers, but only when your messages prove that they really come from you. The name stands for Brand Indicators for Message Identification. For a business that sends newsletters, invoices or order confirmations, a recognisable logo beside the sender name can make a message easier to spot among dozens of others and, in some mail apps, adds a visual signal of authenticity. It is not a magic switch, however, and it cannot be set up in an afternoon without preparation. BIMI sits at the top of a stack of email authentication measures, and every layer below it has to be in place first.

This guide explains how BIMI works, what you need before you start, the roles of SPF, DKIM and DMARC, the logo and certificate requirements, which mailbox providers display the logo, and whether the effort is worth it for your business. Provider rules change, so confirm the current requirements in the official documentation before you commit budget.

What BIMI Does and What It Does Not Do

BIMI publishes a pointer in your DNS to an official version of your logo. When a supporting mailbox provider receives a message from your domain, it checks that the message passes authentication and that your domain has a strong DMARC policy. If everything checks out, and the provider’s own conditions are met, it can display your logo as the sender avatar. Some providers also require a certificate that proves you own the logo, and in some cases they show an additional verified mark.

BIMI does not improve delivery to the inbox by itself. It does not protect against all phishing, since attackers can use look-alike domains, and it is not a replacement for good list hygiene or consent-based sending. What it does is reward domains that already authenticate their mail properly, by giving the recipient a small, consistent visual cue. For a brand that has invested in its identity, that cue can support recognition and trust. For a small business that sends a few hundred messages a month, the benefit may be modest, and the main value of the project may be the authentication work you complete along the way.

The Foundations: SPF, DKIM and DMARC

BIMI depends on three older standards, which together prove that a message comes from an authorised sender and has not been altered.

• SPF lists the servers allowed to send mail for your domain.
• DKIM adds a cryptographic signature to each message, which the receiver verifies with a public key in your DNS.
• DMARC tells receivers what to do when SPF or DKIM fails to align with the visible sender domain, and where to send reports.

If these are new to you, start with our guide to SPF, DKIM and DMARC. For BIMI, the DMARC policy must be at enforcement: quarantine or reject, applied to all messages. A policy of “none”, which only monitors, is not enough. Getting there safely takes time, because you must first identify every service that sends mail in your name: your mail platform, your newsletter tool, your invoicing system, your helpdesk and any website forms. Move to enforcement too early and legitimate messages will be blocked. The usual path is to start with a monitoring policy, read the reports for weeks, fix each sender, move to quarantine at a low percentage, increase gradually and only then choose reject if it suits you.

The Requirements at a Glance

Preparing the Logo

The BIMI logo must be an SVG file that follows a restricted profile, usually called SVG Tiny Portable Secure. It must be a square image, because many apps show it in a circle or rounded square, and it should have a solid background colour, not transparency, so that it displays well in light and dark modes. Scripts, animations, external references and embedded bitmaps are not allowed. Many logos exported from design software contain features that break the profile, so use a converter or validator, and open the final file in the BIMI group’s checker. The BIMI Group publishes the specification, tools and a list of supporting providers.

Design the square version deliberately. A wide logo with a long wordmark becomes unreadable in a small circle, so many brands use only the symbol, or a simplified version of it. The logo you use should match your registered or established brand identity. Do not alter a registered logo without checking how that affects your trademark, and keep the same file for the certificate and the DNS record. If your logo is not yet registered, our guide to what to register before you launch explains the sequence.

Certificates: VMC and CMC

Some mailbox providers, most notably Gmail, require a certificate before they will show the logo. Two types exist. A Verified Mark Certificate proves that you own the logo as a registered trademark, and it is issued by approved certificate authorities after identity and trademark verification. A Common Mark Certificate was introduced as a more accessible option for logos that are not registered but have been in use for a period, with different display rules. The exact requirements, the price and the visible result, such as whether a verified checkmark appears, depend on the provider and on the certificate type, and they have changed over time.

Plan for cost and lead time. Certificates are an annual subscription, and the verification process can take days or weeks, especially if the trademark record, company name or address do not match exactly. This is where a missing or mismatched trademark registration causes delays. Check the current rules in the provider’s help pages, such as Google’s BIMI setup guide for Workspace, before you buy.

Publishing the DNS Record

The BIMI record is a TXT record that lives at the name “default._bimi” under your domain. It contains a version tag, the web address of the logo file and, if you have one, the address of the certificate file. In shape it looks like a short line beginning with “v=BIMI1”, followed by “l=” and the logo address and “a=” and the certificate address. Create it in the same DNS zone as your other mail records. If you do not manage DNS yourself, ask whoever does, and keep a copy of the previous state before changing anything. The guide to DNS for business owners explains how records are organised.

After publishing, wait for DNS to propagate, then test with an online BIMI checker, which verifies the record, the logo format and the DMARC policy, and send a test message to a mailbox at a supporting provider. Remember that display is also subject to the provider’s reputation checks. A domain with a poor sending history may not show the logo even if everything is technically correct, so reputation work, such as that described in our article on email warm-up, supports BIMI.

Who Shows the Logo

Support is uneven and changes. Several large providers have supported BIMI in some form, and each has its own conditions: some require a certificate, some display the logo only for domains with a good reputation, and some show it only in certain apps. Others do not show it at all. Before you invest, check which providers your own customers use. If most of your recipients are on a provider that does not display BIMI logos, the visible benefit will be small. A practical way to decide is to look at the mailbox providers in your newsletter reports and in your customer database.

Is BIMI Worth It?

Consider BIMI if you send significant volumes of customer email, if your brand is known to recipients, if you are already at DMARC enforcement and if you can afford the certificate. It is also attractive for organisations that are impersonated, such as banks, shops and delivery services, because a visible logo can help recipients tell real messages from fake ones. Be sceptical if you send few messages, if the logo is not yet registered and you have other priorities, or if your authentication is incomplete. In these cases, the work of fixing SPF, DKIM and DMARC and cleaning your list will give you more benefit than a logo.

Whichever way you decide, treat BIMI as the final step in a sequence. Our e-marketing team can help you review sending sources, get to DMARC enforcement safely and plan the logo and certificate. Do not rush that sequence, since a mistake at enforcement can block real messages.

A Worked Example

A regional online shop sends order confirmations through its shop platform, newsletters through a separate service and invoices from its accounting software. The domain has SPF and DKIM for the main mail platform but a DMARC policy of “none”. The owner wants a logo in customers’ inboxes. The team lists every sending service by reading three weeks of DMARC reports, adds the newsletter and accounting senders to SPF, enables DKIM signing in both, and corrects an old server that was still sending unsigned messages.

Then they raise the policy to quarantine at ten percent, then fifty, then one hundred, watching the reports at each step. After two months, the domain is at full enforcement. The logo team converts the symbol-only version to the required SVG format, registers the mark in the shop’s main market, requests a certificate and publishes the DNS record. A test message to a mailbox at a supporting provider shows the logo a few days later. The visible result is small, but the shop now blocks spoofed messages that use its exact domain, and the order confirmations carry a consistent identity.

Common Mistakes

• Trying to publish BIMI while DMARC is still at “none”.
• Forgetting a sending service, then moving to enforcement and losing legitimate mail.
• Using an ordinary SVG instead of the restricted profile.
• Using a wide logo that cannot be read in a small circle.
• Ordering a certificate before the trademark record and the company details match.
• Expecting BIMI to improve inbox placement directly.
• Changing the logo file after the certificate is issued without checking whether the certificate still matches.

Frequently Asked Questions

Do I need a certificate to use BIMI?

Not for every provider. Some display logos without a certificate if the domain has strong authentication and reputation, while others, including Gmail, require a mark certificate. Check the rules of the providers that matter to your audience.

Does BIMI improve deliverability?

Not directly. It depends on good authentication and reputation, and it can improve recognition once the message arrives. The work you do to qualify for it, however, tends to improve how receivers treat your mail.

Can I use BIMI with a subdomain?

Yes, a BIMI record can be published for the domain used as the visible sender, and receivers may fall back to the organisational domain if a record for the subdomain is missing. Keep your DMARC policy consistent across the domains involved.

What happens if my DMARC policy returns to none?

The logo will stop displaying, because the enforcement requirement is no longer met. Keep monitoring your reports after the setup, especially when you add a new sending service.

Does the logo have to be a registered trademark?

For a Verified Mark Certificate, yes. A Common Mark Certificate has different conditions, such as proof of use for a period. Both need the logo to match the file you publish.

How long does the setup take?

If authentication is already at enforcement, the logo and DNS steps take days, and the certificate adds days to weeks. If you start at “none”, expect a few months for a safe path to enforcement.

The Bottom Line

BIMI puts your logo beside your authenticated emails, but only after SPF, DKIM and a DMARC policy at enforcement are in place, the logo meets the SVG profile and, for many providers, a mark certificate is issued. The setup rewards patience: identify every sender, move to enforcement gradually, prepare a square logo, check the trademark and certificate rules, and test with the providers your customers actually use. Decide by weighing the visible benefit against cost and effort, and remember that the authentication work itself protects your domain from spoofing even if the logo never appears.