BIMI - Brand Indicators for Message Identification
BIMI puts a logo next to authenticated messages from your domain in supporting mail clients. Receivers that trust your DMARC (Domain-based Message Authentication, Reporting, and Conformance) render the logo. Spoofed mail that fails DMARC never gets to carry it.
The pieces: a TXT record in DNS, a tightly constrained SVG served over HTTPS, and (for some clients) a paid certificate that vouches for your right to use the logo. The spec is a long-running IETF draft; Gmail, Yahoo, and Apple Mail implement a stable subset.
What it is
BIMI is a branding layer on top of DMARC. DMARC already proves a message really came from your domain. BIMI is the next step: now that the receiver trusts the sender, show them your logo.
The mechanism is deliberately narrow. No logos for domains that cannot authenticate. No logos for messages that fail DMARC alignment. The logo is a trust signal, not a brand placement.
Why bother
Three reasons.
- Trust signal for recipients. People recognise a logo faster than a From address. A visible logo is a clearer authenticity cue than the raw domain name.
- Forcing function for DMARC. BIMI requires DMARC at quarantine or reject. Marketing wants the logo; that gives security a lever to finish the DMARC rollout.
- Small deliverability lift. Inbox-provider anecdote, not a guarantee. Domains with BIMI tend to stay above the spam line for longer.
Prerequisites
- 1DMARC at quarantine or rejectrequired
Strict policy enforced on the domain. p=none is not enough. Alignment must pass.
- 2SVG Tiny PS logorequired
A very restricted SVG profile: no scripts, no external references, square aspect ratio. Most corporate logos need a redraw.
- 3BIMI record in DNSrequired
TXT record at default._bimi.example.com pointing to the logo URL (and optionally a cert).
- 4Verified Mark Certificate (VMC) or Common Mark Certificate (CMC)optional
Paid attestation of the logo, issued by Entrust or DigiCert. ~$1500/year. Required by Apple Mail and some Gmail views.
The SVG is the step that breaks most deployments. "SVG Tiny PS" is a small subset: no scripts, no external references, no CSS beyond inline presentation attributes, square aspect ratio, centred artwork. Most corporate logos need a redraw before they qualify.
The record
Once the prerequisites are in place, publish a TXT record at default._bimi.example.com:
identifies the record. Only BIMI1 is defined; every record carries it.
where the SVG lives. Must be HTTPS and must serve Content-Type: image/svg+xml.
URL of your VMC or CMC. Required by Apple Mail and some Gmail clients. Drop this tag entirely if you do not have one.
The default selector is what receivers use when the message does not carry a BIMI-Selector header. If you ship one logo, the default selector is all you need.
Who supports it
| Client | Requires certificate | Notes |
|---|---|---|
| Gmail (web, mobile) | Yes (VMC or CMC) | Since late 2023 Gmail requires a certificate for the round-avatar slot. Self-asserted records are silently ignored. |
| Yahoo Mail, AOL | No | First movers, accept self-asserted logos since 2020. |
| Apple Mail (iOS 16+, macOS Ventura+) | Yes (VMC only) | No CMC support, no self-asserted fallback. VMC strictly required. |
| Fastmail, La Poste, Seznam, Mail.ru, Onet.pl | No | Self-asserted renders. Details change often. |
| GMX, Web.de | No | Partial rendering for self-asserted logos. |
| Microsoft 365 / Outlook | not supported | No production support as of 2026. Roadmap item since 2022. |
| ProtonMail, Tutanota, Zoho Mail, iCloud (non-Apple-Mail) | not supported | No BIMI implementation. |
Practical path: self-assert first to cover Yahoo, Fastmail, and EU webmails at zero cost. Add a CMC to unlock Gmail, or a VMC to also unlock Apple Mail. See the next section for procurement.
The Apple side door: Branded Mail
Apple Business Connect shipped a parallel mechanism called Branded Mail with iOS 18.2 and macOS Sequoia 15.2 on 11 December 2024. Functionally it is a non-BIMI logo rendering path that Apple controls directly: no VMC, no trademark, just DMARC at quarantine or reject plus an Apple Business Connect verification. For senders whose goal is a verified logo in Apple Mail without the trademark prerequisite, Branded Mail is the cheap way in.
It is parallel to BIMI, not part of it. Domains can run both: BIMI for Gmail / Yahoo / Fastmail rendering, Branded Mail for Apple Mail. The visible result in Apple Mail is similar enough that end users do not distinguish.
What about personal avatars?
BIMI is domain-level: one logo per sending domain. The photo mail clients sometimes show next to individual human senders comes from a different stack entirely (Google Account photos, local Contacts, Gravatar, and others). The active BIMI draft adds an avp= tag with values brand (default) and personal that lets a receiver prefer a personal avatar over the brand logo, but no major mailbox provider honors it in production as of 2026. The separate post Getting your face into people's inboxes covers what does work today.
Buying a certificate
Only two Certificate Authorities are on the BIMI trust list. This is a closed list baked into the spec.
- DigiCert
digicert.com/tls-ssl/verified-mark-certificates - Entrust
entrust.com/products/digital-certificates/verified-mark-certificates
Both sell VMC and CMC. Pricing varies with resellers and multi-year discounts but typical list prices are roughly:
| Certificate | Annual cost | Rights proof required | Rendering coverage |
|---|---|---|---|
| Self-asserted (no cert) | $0 | None | Yahoo, Fastmail, EU webmails |
| CMC (Common Mark Certificate) | ~$1,000 | Logo in public use for 12+ months | Adds Gmail |
| VMC (Verified Mark Certificate) | ~$1,500 | Registered trademark for the exact logo | Adds Apple Mail on top of Gmail |
CMC was introduced by DigiCert in 2023 to unlock BIMI for the 80% of brands that never filed a trademark. Same cryptographic flow as VMC, lower bar for logo rights. Gmail accepts both identically.
Lead times differ significantly:
- CMC: days. The CA verifies the logo is in active use (website, social, product) and that DMARC is at quarantine or reject.
- VMC: weeks to months. Requires a registered trademark certificate in a major jurisdiction (USPTO, EUIPO, UKIPO, JPO, CIPO, IP Australia, KIPO). If the trademark is not already filed, add 6 to 12 months to register it before even starting the VMC process.
The procurement order that usually makes sense: self-assert today, buy CMC when transactional email volume justifies the $1,000, file a trademark in parallel, upgrade to VMC once the trademark issues.
In the wild
What established deployments look like today. You can verify any of these yourself with dig TXT default._bimi.<domain>.
| Domain | DMARC | Hosting | SVG location |
|---|---|---|---|
| apple.com | p=quarantine; sp=reject | self-hosted | www.apple.com/bimi/v2/apple.svg |
| cloudflare.com | p=reject | self-hosted | www.cloudflare.com/cloudflare_*.svg |
| cnn.com | p=reject | Valimail managed | amplify.valimail.com/bimi/time-warner/*.svg |
Two deployment patterns. Self-host the SVG and PEM on a subpath of your own domain (Apple, Cloudflare), which keeps the assets under your own TLS and revocation control. Or point at a managed provider (CNN via Valimail), which offloads the SVG Tiny PS conversion and certificate renewal.
Apple is worth studying because it proves p=quarantine on the organizational domain is sufficient for BIMI, as long as sp=reject protects subdomains. A hard reject on the apex is not strictly required by the spec, though most BIMI deployments go straight to reject anyway.
One small stylistic detail: Apple and Cloudflare both use versioned paths (/v2/, numeric suffix) on the SVG URL. Versioning the path makes logo rotations painless, since receivers and caches key off the full URL rather than the record.
Common mistakes
Receivers ignore the BIMI record. The logo does not render. DMARC must be at quarantine or reject, and sp= must not weaken the policy on subdomains.
The most common blocker. Illustrator and Figma exports almost always fail validation. Use a BIMI-specific converter, then check with a linter like the one at bimigroup.org.
Must be image/svg+xml. Some CDNs default to application/xml or text/plain. Receivers reject.
Since late 2023 Gmail requires a CMC or VMC. Self-asserted records are silently ignored. If Gmail coverage matters, a CMC (~$1,000/year, no trademark needed) is the cheapest path. For Apple Mail a VMC is still required.
BIMI published at the apex, marketing sends from news.example.com, and the subdomain's DMARC is weaker. Receivers check the sending subdomain, not the apex. Publish BIMI per-subdomain where needed.
Check whether your DMARC is strict enough to unlock BIMI, and whether your BIMI record resolves to a valid SVG: scan your domain.
