Defaults.Exposed › Fixes › BIMI (Brand Indicators for Message Identification)

How to fix BIMI

Updated 17 October 2026, figures from the October 2026 census, snapshot 2026-10-12.

BIMI is what puts your logo next to your emails in customers' inboxes, the little brand mark that shows up in Gmail, Yahoo, Apple Mail and Fastmail beside your name. It only works if your email is already properly authenticated, and in the two biggest inboxes it also needs a paid certificate that proves your logo is yours. It lifts trust and open rates, but only when every part is in place; otherwise no logo appears at all.

The census does not read BIMI records. It does measure what BIMI needs first: 39,758,587 of the 332,492,319 domains carrying a grade publish a DMARC (Domain-based Message Authentication, Reporting and Conformance) policy at quarantine or reject.

Counted over the 332,492,319 graded and dead domains, from the per-domain overlap join. This is the DMARC enforcement count, not a BIMI count.

Without BIMI, every email you send arrives with the same anonymous grey initial that phishers and unknown senders get; you look identical to the impostors trying to spoof you. Customers hesitate over your legitimate messages, and open rates dip. With BIMI properly set up, your logo appears alongside every message in the biggest consumer inboxes. Customers recognise and trust your mail more, engagement improves, and a spoofed copy can't reproduce the logo without also passing your DMARC checks.

Why BIMI matters

Inbox recognition is one of the few branding surfaces you don't own outright; the mail providers do. BIMI is the standard they've agreed on for letting you display your logo there, and they only display it when your domain has already proven it can be trusted (through DMARC enforcement) and, in the two largest inboxes, when a certificate authority has independently verified you own the trademark on the logo. That combination is why the logo signals trust: a phisher can't fake it without also passing your DMARC and holding a certificate against your registered mark.

Fixing BIMI, in order

1. Get DMARC to enforcement first. Confirm your DMARC record is at p=quarantine or p=reject before starting; BIMI at p=none does nothing.
2. Prepare an SVG Tiny 1.2 P/S logo. Produce a square SVG that conforms to SVG Tiny 1.2 Portable/Secure (no scripts, no external references, no filters) and host it on your own domain over HTTPS (Hypertext Transfer Protocol Secure).
3. Obtain a VMC (or accept limited coverage). Apply to DigiCert or Entrust for a Verified Mark Certificate against your registered trademark. Host the .pem file on your own domain. Without a mark certificate, Gmail and Apple Mail will not display the logo; Gmail also accepts the cheaper CMC (Common Mark Certificate), and Apple Mail requires the VMC.
4. Publish the BIMI DNS (Domain Name System) record. At default._bimi.yourdomain.com add a TXT (Text) record: v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem
5. Send authenticated mail and wait. Send a DMARC-passing message from the domain and check with a BIMI validator; allow several days for Gmail and Apple Mail to begin displaying the logo.
6. Verify with a checker. Use a free BIMI inspector (bimigroup.org's tool, or MxToolbox) to confirm the record, SVG profile, and VMC all validate.

BIMI, in plain words

When someone opens their inbox, the first thing they see next to every message (before the subject line, before the preview text) is a little circle. For most senders, that circle is just a grey badge with the first letter of the sender’s name. Phishing attempts and unknown senders get the same badge, so visually you’re indistinguishable from every impostor pretending to be you.

BIMI (Brand Indicators for Message Identification) is the standard that replaces that grey circle with your actual logo. When it’s working, customers scanning their inbox see your brand mark beside your messages in Gmail, Yahoo, Apple Mail (iOS 16 and macOS Ventura or newer) and Fastmail. It’s a small piece of real estate, but it’s one of the very few branding surfaces inside the inbox that you can influence at all.

BIMI signals trust because the mail providers only display the logo when your domain has already proven it can be trusted. Specifically, your domain must publish a DMARC policy at quarantine or reject, meaning you’re actively telling the world to bin spoofed mail claiming to be you. And for Gmail and Apple Mail (the two inboxes most of your customers use), a certificate authority must have independently verified that the logo is yours by checking it against a registered trademark.

This page covers what BIMI is, the honest costs (the certificate isn’t free), the sequence you have to follow (DMARC first, always), and the small technical trap that trips most first-time setups: the SVG profile.

What this can cost you

These are realistic, aggregate patterns. None describes a single named business.

• Your legitimate marketing email lands next to three phishing attempts spoofing your brand. Every one of them shows the same anonymous grey circle with your initial. Recipients hesitate; some report your genuine mail as suspicious, some just don’t open it. Your open rate drops a few percentage points below what the same sends would get with a logo.
• A prospect scans their inbox and sees your competitor’s branded logo beside their message, and your grey initial beside yours. That comparison repeats with each campaign, transactional email, quote and receipt you send.
• You publish the DNS record, upload the SVG, wait, and nothing appears in Gmail. The reason is almost always one of two things: DMARC is still at p=none (so BIMI simply doesn’t qualify), or the SVG file was exported from a design tool and includes script tags, filters, or gradients that violate the SVG Tiny 1.2 P/S profile Gmail requires. There’s no error email; you have to check for yourself to find out why the logo is missing.
• You commit to €1,500+ a year for a Verified Mark Certificate, publish everything, and still see no logo, because one of the underlying pieces (DMARC, SVG profile, certificate hosting) isn’t quite right. You get nothing for the certificate until every layer validates.
• For domains that already run DMARC at enforcement and hold a registered trademark on their logo, BIMI is one of the most visible places to show your brand inside email, because the logo appears on each send to each recipient whose provider supports it.

The four parts that have to line up

BIMI has four moving parts, and all four have to line up before your logo appears in the big inboxes. This is where most first-time setups stall. They get three of the four right and can’t work out why nothing shows.

1. DMARC at enforcement (the prerequisite). Your domain must publish a DMARC record with a policy of p=quarantine or p=reject. A policy of p=none, the common “monitoring only” starting point, does not qualify for BIMI at all. The mail providers will not display a logo for a domain that isn’t actively defending itself against spoofing.

2. The SVG logo (hosted on your domain). A square SVG file of your logo, conforming to the SVG Tiny 1.2 Portable/Secure profile (often written as SVG-P/S or SVG PS). This is a deliberately stripped-down flavour of SVG: no scripts, no external references, no filters, no animations, no XML entities. It exists specifically so mail providers can safely render it without security risk. Design-tool exports (Illustrator, Figma, Sketch) almost never conform out of the box. They include metadata, filters, or references that fail the check. You typically need to hand-clean the file or run it through a BIMI-aware conversion tool.

3. The Verified Mark Certificate, or VMC (needed for Apple Mail; Gmail also accepts the cheaper CMC described below). A cryptographic certificate issued by a certificate authority (currently DigiCert or Entrust, the two accepted issuers) after they independently verify that the logo you’re publishing is a registered trademark you legally own. Typical cost: €1,500 to €1,800 per year. The certificate file (.pem) is hosted on your own domain over HTTPS. Without a VMC, Yahoo and Fastmail may still display your logo, but Gmail and Apple Mail, the two largest consumer inboxes, will not. There’s also a cheaper alternative called a Common Mark Certificate (CMC) that doesn’t require a registered trademark. Gmail accepts a CMC, but Apple Mail still requires a full VMC, so treat CMC as partial coverage.

4. The BIMI DNS record (the pointer). A TXT record published at a specific hostname, usually default._bimi.yourdomain.com, that tells receiving mail servers where to find the SVG and the VMC. Its format is:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

l= points to the SVG. a= points to the VMC .pem file. Both URLs must be HTTPS and reachable, and they’re conventionally hosted on your own domain rather than a third party.

What “good” looks like, in one line: DMARC at p=quarantine or stricter, an SVG-P/S logo hosted on your domain, a valid VMC issued against your registered trademark and hosted on your domain, and a BIMI TXT record at default._bimi.yourdomain.com pointing to both, confirmed with a BIMI checker showing all four green.

How to fix it (paid: allow €1,500+ a year and 4 to 8 weeks for a VMC)

Hand this section to whoever manages your domain, your DNS, and your email marketing. The DNS record and SVG are free; the Verified Mark Certificate is not. Do not start this work until your DMARC record is at p=quarantine or p=reject: BIMI at p=none does absolutely nothing.

Work in this order: DMARC enforcement first, the VMC application and SVG preparation in parallel, and the DNS record last. Publishing the BIMI record before the SVG and VMC are ready just makes the check fail publicly.

Step 1: Confirm DMARC is at enforcement.

• Check your existing DMARC record: dig TXT _dmarc.yourdomain.com (or use any DMARC checker).
• If it starts with v=DMARC1; p=none, stop. BIMI cannot work yet. Get DMARC to enforcement first (fix SPF/DKIM alignment, work through reports, move to p=quarantine and then p=reject).
• If it’s already at p=quarantine or p=reject, proceed.

Step 2: Prepare an SVG-P/S logo.

• Start with your logo as a square SVG (1:1 aspect ratio, ideally rendered at 96×96 or larger, minimum viewBox 0 0 1 1).
• Strip it to the SVG Tiny 1.2 Portable/Secure profile: remove <script>, <foreignObject>, <use xlink:href> referring to external files, filters, animations, embedded fonts, and any XML entities.
• Add the required attributes: <svg baseProfile="tiny-ps" version="1.2"> and a <title> element with your brand name.
• Validate with a BIMI SVG checker (bimigroup.org offers one) before going further. This is where most setups fail: do not skip validation.
• Host the file on your own domain over HTTPS, e.g. https://yourdomain.com/bimi/logo.svg.

Step 3: Apply for a VMC (or decide to skip Gmail/Apple coverage).

• Confirm your logo is a registered trademark in a jurisdiction the issuers accept (EU, US, UK, Canada, Japan, Australia, and others). If it isn’t registered, that trademark work is a prerequisite; allow months, not weeks.
• Apply to DigiCert or Entrust for a Verified Mark Certificate. Expect 4 to 8 weeks and thorough identity verification. Cost typically €1,500 to €1,800 a year.
• Once issued, you’ll receive a .pem file. Host it on your own domain over HTTPS, e.g. https://yourdomain.com/bimi/vmc.pem.
• Alternative: If you don’t hold a registered trademark, a Common Mark Certificate (CMC) from the same issuers is cheaper and skips the trademark requirement. Gmail accepts a CMC, but Apple Mail still requires a full VMC. Yahoo and Fastmail will display the logo either way. Decide with eyes open.

Step 4: Publish the BIMI DNS record.

• At your DNS provider (Cloudflare, Route 53, your registrar’s DNS, wherever your zone lives), add a TXT record:
  • Name / Host: default._bimi (your DNS provider will append your domain automatically)
  • Value: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem
• If you skipped the VMC deliberately, omit the a= part: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg;. Yahoo/Fastmail will still display; Gmail/Apple will not.
• Allow 24 to 48 hours for DNS propagation.

Step 5: Verify and wait.

• Use a free BIMI inspector (bimigroup.org’s tool, or MxToolbox’s BIMI checker). It should show green on record, SVG profile, and VMC validation.
• Send an authenticated email from your domain to a Gmail address you control. Gmail typically starts displaying the logo within a few days after your first passing send. It’s not instantaneous per-recipient. Apple Mail (iOS 16+ / macOS Ventura+) is similar; Yahoo and Fastmail are usually quicker.
• If the logo doesn’t appear after a week, re-run the BIMI checker. Almost every silent failure traces back to (a) DMARC still at p=none, (b) SVG that fails the P/S profile, or (c) the VMC .pem file not being reachable at the URL in the record.

Common mistakes

• Trying BIMI at DMARC p=none. The most common wasted effort: publishing the BIMI record and SVG while DMARC is still in monitoring mode. Nothing displays; nothing tells you why. Get to p=quarantine or p=reject first.
• Exporting the SVG straight from Illustrator or Figma. Design tools include metadata, filters, gradients, embedded fonts, or external references that all violate SVG Tiny 1.2 P/S. The file looks fine but fails the validator. Every design-tool export needs manual cleanup or a BIMI-aware conversion pass.
• Buying the VMC before securing the trademark. DigiCert and Entrust will not issue a VMC without a registered trademark on the logo. If you apply first and the trademark check fails, you’ve paid nothing (the application won’t complete) but you’ve lost the time. Confirm trademark status before starting the VMC application.
• Hosting the SVG or VMC somewhere other than your own domain. Best practice, and what Gmail and Apple Mail expect, is that both files live on the same organisational domain as the one publishing the BIMI record, served over HTTPS. Hosting on a random CDN (Content Delivery Network) or a third-party domain is a known way to have the logo silently skipped.
• Assuming BIMI replaces DMARC monitoring. BIMI is a display layer on top of DMARC. It does not defend against spoofing. DMARC does that. If your DMARC weakens (falls back to p=none, or reports show alignment failures you don’t fix), BIMI will stop displaying too. Keep monitoring DMARC after BIMI is live.
• Not planning for a logo change. VMCs are issued against a specific logo file. If you rebrand, you need a new certificate and a new SVG, so plan the VMC re-issuance into any rebrand timeline.

Where this sits in your grade

BIMI counts toward your Email Security score, but it’s deliberately treated as an enhancement rather than a core control. The underlying protections (SPF, DKIM, and especially DMARC at enforcement) are what stop your domain being spoofed. BIMI only becomes possible once DMARC is at p=quarantine or p=reject, so a missing BIMI record on a domain that hasn’t reached DMARC enforcement is scored as informational: fix DMARC first, and BIMI becomes reachable. On a domain that has reached DMARC enforcement, BIMI puts your logo beside your mail in the inboxes that support it. It is worth the certificate cost if your logo is trademarked and Gmail/Apple Mail are where your customers read your mail.

Questions people ask

Figures as of 12 October 2026, from the October 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.