Defaults.Exposed › Fixes › BIMI (Brand Indicators for Message Identification)

How to fix BIMI (Brand Indicators for Message Identification)

BIMI is what puts your logo next to your emails in customers' inboxes — the little brand mark that shows up in Gmail, Yahoo, Apple Mail and Fastmail beside your name. It only works if your email is already properly authenticated, and in the two biggest inboxes it also needs a paid certificate that proves your logo is really yours. Done right, it lifts trust and open rates; done half-way, nothing appears at all.

Bottom line for your business: Without BIMI, every email you send arrives with the same anonymous grey initial that phishers and unknown senders get — you look identical to the impostors trying to spoof you. Real customers hesitate over your legitimate messages, open rates dip, and phishing look-alikes have less to compete against visually. With BIMI properly set up, your logo appears alongside every message in the biggest consumer inboxes: instant recognition, higher trust, measurably better engagement, and a visible signal that a spoofed copy can't reproduce without also passing your DMARC checks.

What this can cost you

• Your marketing emails land in the inbox next to phishing attempts that look identical to yours — same grey circle, same initial — and customers can't tell your genuine message from a spoof at a glance.
• You spend weeks setting BIMI up, publish the record, and nothing shows in Gmail or Apple Mail because DMARC is still at p=none — the logo silently never appears and nobody tells you why.
• You pay for the VMC certificate, publish everything correctly, and the logo still doesn't appear because the SVG was exported from Illustrator with hidden script tags or gradients that break the SVG Tiny 1.2 P/S profile Gmail requires.
• A competitor who did enable BIMI shows up with a crisp branded logo in the same inbox where you show up as a grey initial — a small trust gap that compounds across every campaign.
• You're spending on brand awareness, but every send to Gmail and Apple Mail — the two biggest consumer inboxes — is stripped of the one bit of branding a recipient sees before they even open the email.

Why it matters. Inbox recognition is one of the few branding surfaces you don't own outright — the mail providers do. BIMI is the standard they've agreed on for letting you display your logo there, and they only display it when your domain has already proven it can be trusted (through DMARC enforcement) and, in the two largest inboxes, when a certificate authority has independently verified you own the trademark on the logo. That combination is what makes BIMI a genuine trust signal rather than just decoration: a phisher can't fake it without also passing your DMARC and holding a certificate against your registered mark.

How to fix it, step by step

1. Get DMARC to enforcement first. Confirm your DMARC record is at p=quarantine or p=reject before starting; BIMI at p=none does nothing.
2. Prepare an SVG Tiny 1.2 P/S logo. Produce a square SVG that conforms to SVG Tiny 1.2 Portable/Secure — no scripts, no external references, no filters — and host it on your own domain over HTTPS.
3. Obtain a VMC (or accept limited coverage). Apply to DigiCert or Entrust for a Verified Mark Certificate against your registered trademark. Host the .pem file on your own domain. Without a VMC, Gmail and Apple Mail will not display the logo.
4. Publish the BIMI DNS record. At default._bimi.yourdomain.com add a TXT record: v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem
5. Send authenticated mail and wait. Send a DMARC-passing message from the domain and check with a BIMI validator; allow several days for Gmail and Apple Mail to begin displaying the logo.
6. Verify with a checker. Use a free BIMI inspector (bimigroup.org's tool, or MxToolbox) to confirm the record, SVG profile, and VMC all validate.

BIMI, in plain words

When someone opens their inbox, the first thing they see next to every message — before the subject line, before the preview text — is a little circle. For most senders, that circle is just a grey badge with the first letter of the sender’s name. It’s the same badge phishing attempts get. It’s the same badge unknown senders get. Visually, you’re indistinguishable from every impostor pretending to be you.

BIMI — Brand Indicators for Message Identification — is the standard that replaces that grey circle with your actual logo. When it’s working, customers scanning their inbox see your brand mark beside your messages in Gmail, Yahoo, Apple Mail (iOS 16 and macOS Ventura or newer) and Fastmail. It’s a small piece of real estate, but it’s one of the very few branding surfaces inside the inbox that you can influence at all.

Here’s the important part, and the reason BIMI is a genuine trust signal rather than a cosmetic one: the mail providers only display the logo when your domain has already proven it can be trusted. Specifically, your domain must publish a DMARC policy at quarantine or reject — meaning you’re actively telling the world to bin spoofed mail claiming to be you. And for Gmail and Apple Mail (the two inboxes most of your customers use), a certificate authority must have independently verified that the logo is really yours by checking it against a registered trademark. A phisher who wanted to fake your BIMI logo would first have to defeat your DMARC and hold a certificate against your legal mark. That’s the whole point.

This page covers what BIMI actually is, the honest costs (the certificate isn’t free), the sequence you have to follow (DMARC first, always), and the small technical trap that trips most first-time setups — the SVG profile.

What this can cost you

These are realistic, aggregate patterns — not any one named business.

• The trust gap in a crowded inbox. Your legitimate marketing email lands next to three phishing attempts spoofing your brand. Every one of them shows the same anonymous grey circle with your initial. Recipients hesitate; some report your genuine mail as suspicious, some just don’t open it. Your open rate quietly drops a few percentage points against sends where a logo would have appeared, and you never see the counterfactual.
• The competitor who did the work. A prospect scans their inbox and sees your competitor’s crisp branded logo beside their message, and your grey initial beside yours. It’s one glance, but it’s a glance repeated across every campaign, every transactional email, every quote and receipt. Recognition compounds; so does its absence.
• The silent BIMI failure. You publish the DNS record, upload the SVG, wait, and nothing appears in Gmail. The reason is almost always one of two things: DMARC is still at p=none (so BIMI simply doesn’t qualify), or the SVG file was exported from a design tool and quietly includes script tags, filters, or gradients that violate the SVG Tiny 1.2 P/S profile Gmail requires. There’s no error email. You just don’t get the logo, and unless you actively check, you don’t know why.
• The VMC bill for nothing. You commit to €1,500+ a year for a Verified Mark Certificate, publish everything, and still see no logo — because one of the underlying pieces (DMARC, SVG profile, certificate hosting) isn’t quite right. The cost is real; the benefit is zero until every layer validates.
• The recognition surface you’re leaving on the table. For domains that already run DMARC at enforcement and hold a registered trademark on their logo, BIMI is one of the highest-visibility branding wins available inside email — every recipient, every send, every provider that supports it. Skipping it means paying for brand awareness elsewhere while giving away free real estate here.

What it actually is

BIMI has four moving parts, and all four have to line up before your logo appears in the big inboxes. This is where most first-time setups stall — they get three of the four right and can’t work out why nothing shows.

1. DMARC at enforcement (the prerequisite). Your domain must publish a DMARC record with a policy of p=quarantine or p=reject. A policy of p=none — the common “monitoring only” starting point — does not qualify for BIMI at all. This isn’t optional and it isn’t negotiable: the mail providers will simply not display a logo for a domain that isn’t actively defending itself against spoofing.

2. The SVG logo (hosted on your domain). A square SVG file of your logo, conforming to the SVG Tiny 1.2 Portable/Secure profile (often written as SVG-P/S or SVG PS). This is a deliberately stripped-down flavour of SVG: no scripts, no external references, no filters, no animations, no XML entities. It exists specifically so mail providers can safely render it without security risk. Design-tool exports (Illustrator, Figma, Sketch) almost never conform out of the box — they include metadata, filters, or references that fail the check. You typically need to hand-clean the file or run it through a BIMI-aware conversion tool.

3. The Verified Mark Certificate — VMC (needed for Gmail and Apple Mail). A cryptographic certificate issued by a certificate authority — currently DigiCert or Entrust are the two accepted issuers — after they independently verify that the logo you’re publishing is a registered trademark you legally own. Typical cost: €1,500–1,800 per year. The certificate file (.pem) is hosted on your own domain over HTTPS. Without a VMC, Yahoo and Fastmail may still display your logo, but Gmail and Apple Mail — the two largest consumer inboxes — will not. There’s also a cheaper alternative called a Common Mark Certificate (CMC) that doesn’t require a registered trademark, but its acceptance is narrower and Gmail’s support for CMCs is still evolving — treat CMC as partial coverage, not a full substitute.

4. The BIMI DNS record (the pointer). A TXT record published at a specific hostname — usually default._bimi.yourdomain.com — that tells receiving mail servers where to find the SVG and the VMC. Its format is:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

l= points to the SVG. a= points to the VMC .pem file. Both URLs must be HTTPS and reachable, and they’re conventionally hosted on your own domain rather than a third party.

What “good” looks like, in one line: DMARC at p=quarantine or stricter, an SVG-P/S logo hosted on your domain, a valid VMC issued against your registered trademark and hosted on your domain, and a BIMI TXT record at default._bimi.yourdomain.com pointing to both — confirmed with a BIMI checker showing all four green.

How to fix it (paid — allow €1,500+/year and 4–8 weeks for a VMC)

Hand this section to whoever manages your domain, your DNS, and your email marketing. The DNS record and SVG are free; the Verified Mark Certificate is not. Do not start this work until your DMARC record is at p=quarantine or p=reject — BIMI at p=none does absolutely nothing.

The golden rule: DMARC enforcement first, VMC application in parallel with SVG preparation, DNS record last. Publishing the BIMI record before the SVG and VMC are ready just makes the check fail publicly.

Step 1 — Confirm DMARC is at enforcement.

• Check your existing DMARC record: dig TXT _dmarc.yourdomain.com (or use any DMARC checker).
• If it starts with v=DMARC1; p=none — stop. BIMI cannot work yet. Complete the DMARC enforcement journey first (fix SPF/DKIM alignment, work through reports, move to p=quarantine and then p=reject).
• If it’s already at p=quarantine or p=reject, proceed.

Step 2 — Prepare an SVG-P/S logo.

• Start with your logo as a square SVG (1:1 aspect ratio, ideally rendered at 96×96 or larger, minimum viewBox 0 0 1 1).
• Strip it to the SVG Tiny 1.2 Portable/Secure profile: remove <script>, <foreignObject>, <use xlink:href> referring to external files, filters, animations, embedded fonts, and any XML entities.
• Add the required attributes: <svg baseProfile="tiny-ps" version="1.2"> and a <title> element with your brand name.
• Validate with a BIMI SVG checker (bimigroup.org offers one) before going further. This is the single most common failure point — don’t skip validation.
• Host the file on your own domain over HTTPS, e.g. https://yourdomain.com/bimi/logo.svg.

Step 3 — Apply for a VMC (or decide to skip Gmail/Apple coverage).

• Confirm your logo is a registered trademark in a jurisdiction the issuers accept (EU, US, UK, Canada, Japan, Australia, and others). If it isn’t registered, that trademark work is a prerequisite — allow months, not weeks.
• Apply to DigiCert or Entrust for a Verified Mark Certificate. Expect 4–8 weeks and thorough identity verification. Cost typically €1,500–1,800/year.
• Once issued, you’ll receive a .pem file. Host it on your own domain over HTTPS, e.g. https://yourdomain.com/bimi/vmc.pem.
• Alternative: If you don’t hold a registered trademark, a Common Mark Certificate (CMC) from the same issuers is cheaper and skips the trademark requirement — but Gmail/Apple support is patchier. Yahoo and Fastmail will display the logo either way. Decide with eyes open.

Step 4 — Publish the BIMI DNS record.

• At your DNS provider (Cloudflare, Route 53, your registrar’s DNS, wherever your zone lives), add a TXT record:
  • Name / Host: default._bimi (your DNS provider will append your domain automatically)
  • Value: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem
• If you skipped the VMC deliberately, omit the a= part: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; — Yahoo/Fastmail will still display; Gmail/Apple will not.
• Allow 24–48 hours for DNS propagation.

Step 5 — Verify and wait.

• Use a free BIMI inspector (bimigroup.org’s tool, or MxToolbox’s BIMI checker) — it should show green on record, SVG profile, and VMC validation.
• Send an authenticated email from your domain to a Gmail address you control. Gmail typically starts displaying the logo within a few days after your first passing send — it’s not instantaneous per-recipient. Apple Mail (iOS 16+ / macOS Ventura+) is similar; Yahoo and Fastmail are usually quicker.
• If the logo doesn’t appear after a week, re-run the BIMI checker. Almost every silent failure traces back to (a) DMARC still at p=none, (b) SVG that fails the P/S profile, or (c) the VMC .pem file not being reachable at the URL in the record.

Common mistakes

• Trying BIMI at DMARC p=none. The single most common wasted effort: publishing the BIMI record and SVG while DMARC is still in monitoring mode. Nothing displays; nothing tells you why. Get to p=quarantine or p=reject first.
• Exporting the SVG straight from Illustrator or Figma. Design tools include metadata, filters, gradients, embedded fonts, or external references that all violate SVG Tiny 1.2 P/S. The file looks fine visually but silently fails the validator. Every design-tool export needs manual cleanup or a BIMI-aware conversion pass.
• Buying the VMC before securing the trademark. DigiCert and Entrust will not issue a VMC without a registered trademark on the logo. If you apply first and the trademark check fails, you’ve paid nothing (the application won’t complete) but you’ve lost the time. Confirm trademark status before starting the VMC application.
• Hosting the SVG or VMC somewhere other than your own domain. Best practice — and what Gmail and Apple Mail expect — is that both files live on the same organisational domain as the one publishing the BIMI record, served over HTTPS. Hosting on a random CDN or a third-party domain is a known way to have the logo silently skipped.
• Assuming BIMI replaces DMARC monitoring. BIMI is a display layer on top of DMARC. It does not defend against spoofing — DMARC does that. If your DMARC weakens (falls back to p=none, or reports show alignment failures you don’t fix), BIMI will stop displaying too. Keep monitoring DMARC after BIMI is live.
• Not planning for a logo change. VMCs are issued against a specific logo file. If you rebrand, you need a new certificate and a new SVG — plan the VMC re-issuance into any rebrand timeline.

Where this sits in your grade

BIMI counts toward your Email Security score, but it’s deliberately treated as an enhancement rather than a core control — the underlying protections (SPF, DKIM, and especially DMARC at enforcement) are what actually stop your domain being spoofed. BIMI only becomes possible once DMARC is at p=quarantine or p=reject, so a missing BIMI record on a domain that hasn’t reached DMARC enforcement is scored as informational: fix DMARC first, and BIMI becomes reachable. On a domain that has reached DMARC enforcement, BIMI represents a real branding and trust win that most similar businesses haven’t yet claimed — worth the certificate cost if your logo is trademarked and Gmail/Apple Mail are where your customers read your mail.

FAQ