BIMI (Brand Indicators for Message Identification) is an industry standard that lets domain owners publish a DNS TXT record pointing to a brand logo. Supporting email clients display that logo next to authenticated messages, giving recipients a visual trust signal.
BIMI is published as a TXT record at default._bimi.<domain>. The record contains a version tag, an l= field pointing to the logo URL, and an optional a= field pointing to a Verified Mark Certificate (VMC):
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/cert.pem"
The l= URL must point to an SVG file served over HTTPS. If you do not yet have a VMC, you can omit the a= field entirely, though most major providers will not display the logo without it. The default selector is the catch-all; the specification allows additional named selectors for per-subdomain or per-campaign logos.
BIMI requires that the sending domain have a DMARC policy set to quarantine or reject. A DMARC policy of none is not sufficient — email clients and providers use DMARC enforcement as the baseline signal that a domain's email authentication is mature enough to trust for logo display. Without a qualifying DMARC policy, providers will silently ignore the BIMI record even if it is syntactically correct.
DMARC enforcement in turn requires that your domain's outbound mail correctly passes either SPF or DKIM alignment. Getting BIMI working therefore means your full email authentication stack — SPF, DKIM, and DMARC — must already be in good shape.
A Verified Mark Certificate (VMC) is a certificate issued by a Mark Verifying Authority (MVA) that cryptographically binds a logo to a domain and confirms that the logo corresponds to a registered trademark. Major providers such as Gmail require a VMC before displaying BIMI logos.
The trademark requirement is a significant barrier: you must own a registered trademark for the logo in a jurisdiction recognized by the issuing MVA before a VMC can be obtained. The VMC is referenced in the BIMI record's a= field and is served as a PEM-encoded file over HTTPS. VMCs are issued by a small number of authorized CAs. A newer alternative, the Common Mark Certificate (CMC), verifies marks established by prior use rather than trademark registration, lowering this barrier — though provider acceptance of CMCs is still narrower than for VMCs.
BIMI logos must conform to the SVG Tiny Portable/Secure (SVG Tiny P/S) profile. This is a constrained subset of SVG that prohibits scripting, external references, animations, and certain filters. The restrictions ensure logos render safely and predictably across email clients without executing arbitrary code or fetching external resources.
Common reasons a logo is rejected at validation: using features outside the Tiny P/S subset (gradients, filters, embedded raster images in some implementations), a missing or incorrect viewBox attribute, or the file not being served with Content-Type: image/svg+xml.
BIMI is an industry initiative governed by the AuthIndicators Working Group, not an IETF-standardized protocol. Provider support varies: Gmail displays VMC-backed BIMI logos, Apple Mail supports BIMI with or without a VMC in some configurations, and Yahoo Mail has supported BIMI since the early rollout. Microsoft Outlook has not shipped general BIMI support, though Microsoft has signaled it is on the roadmap. Because it is not an RFC, implementations differ in which fields they require and how they validate logos.
Check BIMI with the DNS mail audit
Open DNS Lookup