BIMI

BIMI (Brand Indicators for Message Identification) lets supporting mailbox providers display your verified brand logo with authenticated messages. Providers decide whether to show the logo and may apply certificate and sender-reputation requirements.

BIMI is a DNS standard that you configure at your DNS provider. It does not appear on the domain resource or affect domain verification. This page covers the prerequisites, record, logo format, and certificates that mailbox providers may require.

Prerequisites

BIMI builds on top of email authentication, so everything in DKIM, SPF & DMARC comes first:

A verified sending domain. Your domain's DKIM, return-path, and DMARC records must be published and verified; see Sending domains if you have not set one up yet.
DMARC at enforcement. This is the key gotcha: BIMI requires a DMARC policy of p=quarantine or p=reject, which is stricter than our send gate requires. We only require that a valid DMARC record exists, and our recommended starting value uses p=none, so a domain can be fully verified and sending while still not qualifying for BIMI. Mailbox providers also evaluate the policy at your organizational domain (the registrable apex, for example example.com). A p=quarantine policy on a subdomain does not count if the apex policy is p=none. An apex record with sp=none that weakens subdomain enforcement also disqualifies you.

Moving DMARC to enforcement

Do not move from p=none to p=reject without first identifying every legitimate sender. At enforcement, receivers can quarantine or reject mail that fails DMARC alignment. Use this rollout:

Stay on p=none and read your aggregate reports (rua) for a few weeks to inventory every source sending as your domain. Mail sent through your verified sending domain passes DKIM with alignment, so it is safe at any policy.
Fix or retire unauthenticated sources, then move to p=quarantine. You can use pct= to enforce on a fraction of failing mail during the rollout. BIMI requires pct=100.
Once the reports are clean at full quarantine, move to p=reject if you want the strongest policy. Both quarantine and reject satisfy BIMI. The DMARC policy generator can help you write the record for each stage.

The BIMI DNS record

BIMI is a single TXT record at the default._bimi selector under your domain:

Type	Host	Value
TXT	default._bimi.example.com	v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem

v=BIMI1: the version tag, always first.
l=: an HTTPS URL to your logo in SVG Tiny PS format (see Logo requirements).
a=: an HTTPS URL to your Verified Mark Certificate (see Verified Mark Certificates). Omit the tag or leave it empty (a=;) if you are publishing without a certificate; providers that require one do not show the logo.

Publish it like any other TXT record at your DNS provider, the same place you published your other verification records. Like DMARC, the record is looked up at your sending domain first, falling back to the organizational domain, so a single record at the apex covers subdomains that do not declare their own.

Before you publish, check the record. The BIMI record generator builds and validates it in the browser, and bird email tools validate-bimi does the same from the CLI. Both report parse errors and warnings such as a non-HTTPS URL.

Logo requirements

The l= URL must point to an SVG in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, a locked-down SVG subset that forbids scripts, external references, and animation. A regular SVG export from a design tool is usually rejected until converted; free SVG Tiny PS converters and validators are available from the BIMI Group and certificate authorities. Beyond the profile:

Square aspect ratio, with the logo centered. Clients render it in a circle or rounded square, so keep meaningful content away from the corners.
Solid, opaque background color; transparency renders unpredictably across clients.
Served over HTTPS from a publicly reachable URL, ideally small (under 32 KB is a common guideline).
The SVG's <title> element should contain your brand name.

Verified Mark Certificates (VMC)

A Verified Mark Certificate (VMC) attests that your organization has rights to a logo, typically through a registered trademark. A Common Mark Certificate (CMC) supports some logos that are not registered trademarks. The issuing authority validates your organization and mark, then provides a .pem certificate for the a= URL.

Whether you need one depends on the mailbox provider:

Gmail requires a VMC (or its sibling, the Common Mark Certificate). Without one, Gmail does not display your logo even if your record and DMARC policy are correct.
Yahoo Mail requires no certificate. It does require DMARC enforcement at the organizational domain. Yahoo also applies its own sender-reputation bar. New or low-volume senders may not get the logo immediately even with a valid record.
Other BIMI-aware clients fall somewhere in between; requiring a VMC is the trend.

If your audience is mostly Gmail, budget for the certificate. It is the larger cost and lead time in a BIMI rollout, since trademark validation takes time. You can publish the record with only l= first and add a= when the certificate is issued.

Verifying it works

BIMI never blocks anything else, so check it with the audit tooling and a real inbox instead:

Run bird email tools audit example.com from the CLI. It resolves your live DMARC, SPF, DKIM, BIMI, and MX records and returns severity-tagged findings, including whether your DMARC policy qualifies for BIMI.
Run your domain through a BIMI inspector (the BIMI Group and several email-tooling vendors offer free ones). These fetch and validate the SVG and verify the VMC, and tell you exactly which requirement is unmet.
Send a real message through your sending domain to a Gmail and a Yahoo mailbox and look for the logo. Allow for propagation and provider-side evaluation: the logo often appears within hours of a correct setup but can take longer, especially on Yahoo where reputation factors in.

If the logo does not appear, the cause is almost always one of these:

DMARC is not at enforcement on the organizational domain.
The SVG fails the Tiny PS profile.
Gmail requires a VMC you have not published yet.
Your sending reputation is not high enough.

Next steps

Set up or check your domain's verification records: Sending domains
Understand the authentication records BIMI builds on, including the DMARC policy upgrade: DKIM, SPF & DMARC