# What is BIMI? Your logo in the inbox, and what it takes

> BIMI is the DNS record that lets Gmail, Yahoo and Apple Mail show your logo next to your emails. What it needs, what VMC and CMC certificates are, and how to set it up.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/what-is-bimi

BIMI (Brand Indicators for Message Identification) is a DNS record that lets supporting inboxes, including Gmail, Yahoo and Apple Mail, show your logo next to emails from your domain. It works only for mail that passes DMARC, and only when your DMARC policy is `quarantine` or `reject`. Gmail and Apple Mail also require a mark certificate that proves your right to the logo.

This guide is for marketers and domain owners deciding whether BIMI is worth it, and for whoever will set it up. It covers what BIMI needs, which inboxes show the logo, the difference between a VMC and a CMC, the logo file rules, and the record to publish. BIMI is the last step of email authentication; the [SPF, DKIM and DMARC setup guide](https://getreport.app/guides/spf-dkim-dmarc-email-authentication) covers the steps before it.

## Quick answer

- **What it is:** a TXT record at `default._bimi.example.com` pointing to your logo, for example `v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem`.
- **Prerequisite:** DMARC at `p=quarantine` or `p=reject`, for the domain and its subdomains. `p=none` does not qualify.
- **Logo:** a square SVG in the SVG Tiny PS profile, served over HTTPS.
- **Certificate:** Gmail needs a VMC (registered trademark, blue checkmark) or a CMC (logo in public use for 12 months, no checkmark). Apple Mail accepts only a VMC. Yahoo can show logos without one.
- **Not supported:** Outlook and Microsoft 365 had not announced BIMI support as of September 2026.
- **Order:** [SPF](https://getreport.app/guides/spf-record), [DKIM](https://getreport.app/guides/what-is-dkim), DMARC at enforcement, then BIMI.

## What BIMI does, and what it does not

When a message arrives, a supporting mailbox provider checks that it passed DMARC, looks up the BIMI record for the From domain, fetches the logo (and the certificate, where required), validates them, and shows the logo in the inbox list and the opened message. Without BIMI, those inboxes show an initial or a generic avatar.

BIMI is a display feature, not a security control on its own. What protects your domain is the DMARC enforcement BIMI requires; the logo is the visible reward for getting there. BIMI does not move mail from spam to the inbox, and providers do not publish any claim that it improves delivery.

The specification is maintained by the BIMI Group and published as an IETF Internet-Draft; as of September 2026 it is not an RFC. The mailbox providers each decide whether and how to show logos.

## Which inboxes show BIMI logos?

| Provider | Shows BIMI logos | Certificate needed |
| --- | --- | --- |
| Gmail (web and apps, including Google Workspace) | Yes | VMC or CMC; a VMC also adds a blue checkmark |
| Apple Mail (iOS/iPadOS 16+, macOS 13+, iCloud.com) | Yes | VMC only |
| Yahoo Mail and AOL | Yes | Not required; logos from senders with good reputation can show without one |
| Outlook, Microsoft 365, Outlook.com | No support announced | Not applicable |

Support changes over time; check each provider's own documentation before you promise the marketing team a logo in a specific inbox.

## Requirement 1: DMARC at enforcement

BIMI only works when your DMARC record asks receivers to act on failing mail:

- The domain policy must be `p=quarantine` or `p=reject`.
- The subdomain policy must not be `none`: if you set `sp=`, use `quarantine` or `reject`.
- Google's BIMI setup page still asks for `pct=100`, a tag that RFC 9989 removed in May 2026. Leaving it out is equivalent to 100%; including `pct=100` does no harm.
- We would also remove the `t=y` testing flag before publishing BIMI, since it asks receivers to apply a policy one level softer than the one you publish.

If you are still at `p=none`, the [DMARC policy guide](https://getreport.app/guides/dmarc-policy-none-quarantine-reject) shows how to move up safely. That is most of the work of BIMI.

> **Check: DMARC policy.** p=none only collects reports; receivers still deliver mail that fails. Quarantine sends it to spam and reject refuses it, which is what actually protects your name.
>
> 1. Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.
> 2. To move in steps, add t=y while on quarantine: receivers then apply one level softer (none) until you remove it. The old pct tag was dropped in RFC 9989 (May 2026).

## Requirement 2: a logo in SVG Tiny PS

The logo must be an SVG file in the SVG Tiny Portable/Secure profile, a restricted form of SVG. Google's BIMI requirements list:

- `baseProfile="tiny-ps"` and `version="1.2"` on the root element.
- A `<title>` element, ideally your organisation's name.
- No scripts, animations, external links or images, and no `x=` or `y=` attributes on the root element.
- A square design with the logo centred, at least 96 × 96 pixels in absolute units.
- A solid background; transparent backgrounds may display unexpectedly.
- A file size of 32 KB or less (recommended).

Inboxes often crop the logo to a circle, so keep important parts away from the corners. A standard SVG export from a design tool is not Tiny PS; it needs converting and checking with a BIMI validator. If you get a certificate, the SVG must match the logo in it exactly, because the certificate embeds the logo.

Serve the file over HTTPS, from a URL that returns it directly without login or redirects to a different host.

## Requirement 3: a VMC or a CMC

A mark certificate proves that you have the right to use the logo. Two kinds exist:

| | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
| --- | --- | --- |
| Needs | A registered trademark for the logo, from a recognised trademark office | Proof the logo has been used publicly for at least 12 months |
| Gmail | Logo plus blue verified checkmark | Logo, no checkmark |
| Apple Mail | Logo | Not supported |
| Validation | Identity checks on your organisation by the certificate authority | Similar identity checks, without the trademark |

Both are issued by a small number of certificate authorities, such as DigiCert and Sectigo, and are paid for and renewed every year. The authority gives you a PEM file that contains the certificate chain and your logo; host it over HTTPS and point to it with the `a=` tag.

Yahoo does not require a certificate, so a BIMI record without `a=` can bring your logo to Yahoo and AOL users at no cost, while Gmail and Apple Mail ignore it.

## The BIMI record

Publish a TXT record at `default._bimi` on your domain:

```dns
default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
```

| Tag | Meaning |
| --- | --- |
| `v=BIMI1` | Version; must come first. |
| `l=` | HTTPS URL of the SVG Tiny PS logo. |
| `a=` | HTTPS URL of the PEM file for your VMC or CMC. Leave it empty or out if you have none. |

`default` is the selector. It covers all mail from the domain; other selectors exist for sending different logos from different streams, but the sender then has to name them in a `BIMI-Selector` header, and most setups never need that.

## How to set up BIMI, step by step

1. **Get DMARC to enforcement.** Quarantine or reject, with every real sender passing. This usually takes weeks, not hours.
2. **Prepare the logo.** Convert it to SVG Tiny PS, square, with a solid background, and validate it.
3. **Decide on a certificate.** Trademark registered: VMC. Not registered but in use for over a year: CMC (Gmail only). Neither: Yahoo only, for now.
4. **Host the files.** Upload the SVG and the PEM to HTTPS URLs on your domain.
5. **Publish the record** at `default._bimi` with `l=` and `a=`.
6. **Validate** with the check below and a BIMI inspector, then send yourself a message at Gmail and Yahoo. Logos can take a day or more to appear while providers cache them.

## How to check your BIMI record

> **Free tool:** [DMARC, SPF, DKIM and MX record checker](https://getreport.app/tools/email-dns-check): Free DMARC checker that also tests SPF, DKIM and MX. See what is missing or broken and get the exact DNS records to add. No sign-up, results in seconds.

The email and DNS health check looks for a BIMI record at `default._bimi.yourdomain` and, in the same run, shows the DMARC policy BIMI depends on. It confirms the record exists; it does not download or validate the logo or the certificate, so use a BIMI inspector for those.

> **Check: BIMI publishes a logo for your mail.** BIMI shows your logo in supporting inboxes, which lifts recognition and trust. It needs DMARC at quarantine or reject first, and Gmail and Apple Mail also need a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).
>
> 1. Reach p=quarantine or p=reject first, then publish default._bimi.yourdomain with v=BIMI1; l=https URL of an SVG Tiny PS logo.

From a terminal:

```bash
dig +short TXT default._bimi.example.com
```

## Why is my BIMI logo not showing?

Work down this list:

- **DMARC is at `p=none`,** or `sp=none`, or the record still has `t=y`.
- **The message failed DMARC.** A service sending without aligned DKIM gets no logo, even if everything else is right.
- **The SVG is not valid Tiny PS,** or does not match the logo in the certificate.
- **No certificate for Gmail or Apple Mail,** or a CMC used where Apple Mail expects a VMC.
- **The file URLs fail:** HTTP instead of HTTPS, a redirect, a login wall or an expired TLS certificate on the hosting domain.
- **Reputation or volume.** Providers may hold back logos for new or low-volume senders, and caching delays new logos.
- **The inbox does not support BIMI,** such as Outlook.

## Questions people ask

### What is BIMI?

BIMI (Brand Indicators for Message Identification) is a DNS record that tells supporting inboxes where to find your logo, so they can show it next to your emails. It works only for mail that passes DMARC with a policy of quarantine or reject. Gmail and Apple Mail also need a mark certificate; Yahoo can show the logo without one.

### Does Outlook support BIMI?

No. As of September 2026, Microsoft has not announced BIMI support for Outlook, Outlook.com or Microsoft 365, so recipients there see no BIMI logo. BIMI still works for your recipients at Gmail, Yahoo, AOL and Apple Mail, so it is worth setting up if many of your customers use those.

### What is the difference between a VMC and a CMC?

A Verified Mark Certificate (VMC) requires a registered trademark for your logo, and in Gmail it adds a blue checkmark next to your name. A Common Mark Certificate (CMC) only requires the logo to have been in public use for at least 12 months, and shows the logo without a checkmark. Apple Mail accepts only VMCs; Gmail accepts both.

### Can I use BIMI with DMARC p=none?

No. BIMI requires a DMARC policy of `p=quarantine` or `p=reject`, and a subdomain policy that is not `none`. A domain at `p=none` gives receivers no instruction to act on forged mail, so providers will not show a trusted logo for it. Move your policy up first, which is the bigger and more useful part of the work.

### Does BIMI improve email deliverability?

Not directly. BIMI changes how a delivered message looks, not whether it reaches the inbox, and no mailbox provider says it uses BIMI in filtering. The DMARC enforcement BIMI requires does protect your domain from forgery, which helps your reputation over time. Treat the logo as a brand benefit, not a deliverability fix.