BIMI Qualification Report: Who Can Show Their Logo in the Inbox? (2026)
Objavljeno · ažurirano
Figures as of 2026-07-29 · methodology v8. Aggregate census data; we never publish an individual domain’s status or grade. See how we grade.
Your logo, beside every email you send, in Gmail, Apple Mail and Yahoo. That is BIMI. It is the one marketing upgrade you cannot simply buy. The entry requirement is a security posture: your domain must enforce DMARC, the DNS policy that tells mailbox providers what to do with email that fails authentication. Once you enforce it, fakes get rejected by the providers that honour that policy, so the logo stays yours. And because the gate sits in public DNS, the census can measure exactly who is allowed through the door.
The answer: 32,642,390 domains. That is 11.83% of the 297 million domains we graded this edition. Everyone else is locked out of the inbox’s most visible trust signal, whether they know it or not.
What is BIMI, in one minute?
BIMI stands for Brand Indicators for Message Identification. It is a DNS record, published at default._bimi, that points to your logo in a standardised SVG format. When a participating mailbox provider receives your email, it checks two things. Does the message pass DMARC? And does your domain enforce DMARC? Only then does it show your logo beside the message instead of a grey initial.
The design is deliberate. The logo is a reward for making your domain hard to impersonate. Providers show it only while your domain is actively rejecting impersonation. If they showed it any sooner, a spoofer would inherit your logo along with your domain name, and the whole signal would be worthless.
That is why BIMI is a security story wearing a marketing costume. The logo is the carrot. Enforced DMARC is the real prize. New to the standard itself? Start with our full BIMI explainer — how the records, SVG format and certificates work. This page is the data companion: who qualifies, measured monthly.
Who qualifies for BIMI today? The ladder, measured
BIMI’s gate is DMARC at enforcement. In practice that means a policy of p=quarantine or p=reject. The strictest interpretations, including Gmail’s, favour p=reject or quarantine at full coverage. Here is the whole internet on that ladder, this edition:
| Rung | Domains | Share of graded |
|---|---|---|
| Graded in the census | 296,674,837 | 100% |
| Publish any DMARC record | 71,141,310 | — |
| Enforce DMARC (the BIMI gate) | 32,642,390 | 11.83% |
Enforce at p=reject (the cleanest pass) | 14,891,829 | — |
Enforce at p=quarantine | 17,731,304 | — |
| Fully aligned — SPF + DKIM + enforced DMARC together | 7,678,989 | 1 in 39 |
Read the ladder from the bottom up and BIMI’s real story appears. 14,891,829 domains sit at p=reject right now. They could publish a BIMI record this afternoon and be logo-eligible under the strictest reading. The 7,678,989 fully aligned domains are in the best position of all. SPF and DKIM are the two underlying checks that prove a message really came from your domain, and theirs already pass and align. For them, the logo is genuinely one DNS record away — plus, for Gmail, a certificate. More on that below.
How many domains actually display a logo?
Here we hold our hands up: the census does not yet measure default._bimi records. A BIMI lookup is a strong candidate for a future edition’s checks, and this page will carry that number the month we ship it. What we can measure precisely today is the qualification side: who clears the DMARC gate.
One thing we can say without a number. Every published industry observation points the same way: of the minority of domains that qualify, only a small fraction take the final step. The bottleneck is not capability. Most qualified domains simply do not know they are qualified.
Could your domain qualify for BIMI if you wanted it to?
The ladder has three rungs, and the answer changes depending on which you are on.
Already enforcing DMARC (11.83% of graded domains): You have done the hard part, possibly without realising it. What remains is design work and one DNS record: an SVG Tiny-PS version of your logo published at default._bimi. For Gmail’s display specifically, you also need a Verified Mark Certificate (VMC) — a trademarked logo and a four-figure annual fee. Apple Mail and Yahoo are more permissive.
Publishing DMARC at p=none (the majority of the 71,141,310 records): Monitor-only: reports flow in, nothing gets blocked. You are one policy edit from the gate, but make it honestly — read your DMARC reports, fix the legitimate senders that fail, then tighten. Rushed enforcement breaks real mail. (Why p=none is not protection.)
No DMARC at all (74.20% of graded domains): The full journey: SPF → DKIM → DMARC monitoring → enforcement. A net five million domains made that climb in a single month (the enforcement tracker). Budget about a quarter of calendar time, most of it waiting on reports, not working. Every step is a free DNS record. The DMARC pillar maps each rung with live data.
What this means for your business
The visible upgrade. In a crowded inbox, a verified logo is the difference between another grey circle and your brand on every message, seen before the email is even opened. If your competitors’ emails carry logos and yours do not, customers notice without knowing why. The reverse is also true.
The invisible upgrade is bigger. To earn the logo, you must enforce DMARC. Once you do, spoofed invoices and fake payroll emails wearing your exact domain get rejected by the mailbox providers that enforce your policy. Companies chase BIMI for the brand impression. They come out the other side with their strongest anti-impersonation control switched on. The carrot works.
The scarcity is the opportunity. Only 11.83% of graded domains are even eligible, and far fewer finish the job. BIMI is still an early-adopter signal. That will not last forever.
Quick answers
What do you need to qualify for BIMI?
DMARC at enforcement — a policy of p=quarantine or p=reject — with passing, aligned email authentication underneath it. As of 2026-07-29, 32,642,390 domains clear that bar. That is 11.83% of the 297 million domains graded in the defaults.exposed census.
Does BIMI require paying for a certificate? Only for some providers. Gmail’s logo display requires a Verified Mark Certificate tied to a trademarked logo. Yahoo and Apple Mail honour BIMI records more permissively. The DNS record itself is free.
Is BIMI worth it for a small business? Treat the logo as the bonus. The qualification is the real win: enforced DMARC protects your domain from impersonation whether or not you ever publish the logo record. As of 2026-07-29, only 1 in 39 graded domains have the fully aligned setup that makes BIMI trivial to add.
Where does your domain sit on the ladder? Run the free check at defaults.exposed — no signup, no sales call. It reads your SPF, DKIM and DMARC posture in seconds and tells you how far you are from the gate, and from the logo.