Do you actually need BIMI?

6 June 2026 · The DMARC Engine Team · 11 min read

BIMI looks fantastic in a screenshot. A neat round logo sitting next to your brand name in the inbox, the same way it shows in a chat app or a social feed. Vendors love to demo it, and more than one sales deck will tell you it is the missing piece of your email security. The honest answer is more careful than that. BIMI is genuinely valuable for a specific kind of sender, a waste of money and effort for plenty of others, and it is never a security control in its own right. This guide is meant to help you work out which group you are in before you spend anything.

What BIMI is, in plain terms

BIMI stands for Brand Indicators for Message Identification. It is a published standard that lets a mailbox provider display your brand's logo beside your messages, provided you have proven you are entitled to use that logo and that your email passes authentication. The mechanism is a single DNS TXT record at default._bimi.yourdomain.com that points to two things: a hosted logo file, and (for the providers that demand it) a certificate that vouches for your right to the logo.

A typical record looks like this:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

The l= tag is the URL of your logo. The a= tag is the URL of your certificate. That is the whole record. The complexity is not in the DNS; it is in everything that has to be true before the record does anything at all.

The single most important thing to understand is what BIMI does not do. It does not stop spoofing. It does not improve deliverability on its own. It does not authenticate your mail. All of that work is done by DMARC, SPF and DKIM. BIMI is a presentation layer that sits on top of email you have already secured. If your authentication is weak, BIMI changes nothing about your security posture; it simply will not show a logo. So the right mental model is that BIMI is a reward for having done DMARC properly, not a substitute for it.

The hard prerequisite: DMARC at enforcement

This is the part people skip past, and it is the part that decides whether BIMI is even on the table for you.

A logo will only display when your domain is at DMARC enforcement, meaning a published policy of p=quarantine or p=reject. A domain sitting on p=none will never show a BIMI logo, no matter how perfect your certificate and SVG are. Some providers additionally expect pct=100 (the policy applied to all mail, not a sampled fraction) and a meaningful percentage, and several are stricter about p=reject than p=quarantine.

That requirement exists for a sensible reason. The whole point of a verified logo is that it appears next to mail that genuinely came from you. If your domain still allowed unauthenticated mail to slip through, an attacker's spoof could inherit the trust of your logo, which would be worse than having no logo at all. So the standard insists you close the door first.

If you are not yet at enforcement, BIMI is premature. Reaching p=reject without breaking your legitimate mail is the real project, and it is a careful one: you publish p=none, collect aggregate reports, identify and authenticate every legitimate sending source (your mail platform, your CRM, your invoicing tool, your help desk), then step the policy up. Rushing it is how organisations end up silently quarantining their own newsletters or, worse, their own password resets. If you want to understand why p=none alone is a false comfort, p=none gives you a false sense of security covers it, and you can check your current policy in seconds with the DMARC checker. The requirements page explains what Gmail, Yahoo and Microsoft now expect from bulk senders, which is the same enforcement work BIMI depends on.

The practical takeaway: if reaching enforcement is still ahead of you, park BIMI. Do the authentication work, get to p=reject, and then decide about the logo from a position of strength.

The catch nobody mentions in the demo: the VMC

Here is where the cost appears.

For the two providers most people actually care about, Gmail and Apple Mail, a valid SVG logo is not enough. They require a Verified Mark Certificate, or VMC. A VMC is a special certificate, issued by one of a small number of approved certificate authorities, that cryptographically attests you own the logo you are trying to display. The certificate embeds your logo and ties it to a verified legal identity.

Three facts about VMCs matter for your decision:

• It usually requires a registered trademark. To get a standard VMC, the logo you want to show normally has to be a trademark you have registered with a recognised intellectual property office (for example the UK IPO, the EUIPO or the USPTO). If your logo is not a registered trademark, a standard VMC is off the table until it is, and trademark registration is itself a months-long, fee-bearing process.
• It costs a meaningful annual fee. A VMC is a paid certificate renewed every year, and the figure is in the hundreds of pounds per year per logo, not a token amount. Budget for it as a recurring line item, not a one-off.
• It involves real identity verification. The certificate authority verifies your organisation's legal existence and your control of the trademark before issuing. This is closer to an extended-validation process than to grabbing a free TLS certificate, and it takes time.

You can confirm whether a VMC is present and valid on a domain with the VMC checker. The certificate is the expensive, slow gate, and for many organisations it is the single fact that settles the whole question.

The CMC: a lighter path without a trademark

There is a newer option that softens the trademark requirement. A Common Mark Certificate, or CMC, allows certain logos that are not registered trademarks, such as a logo with a long track record of public use, to be certified. It exists precisely for organisations that have a recognisable mark but never formally registered it.

A CMC is still a paid certificate from a certificate authority, and it still involves verification, so it is not a free shortcut. Provider support for CMCs is also narrower than for VMCs, and it has been rolling out gradually rather than arriving everywhere at once, so check that the inboxes your audience actually uses will honour a CMC before you buy one. If you want to think through whether a CMC fits your case, the CMC simulator lets you model it, and BIMI without a VMC walks through what is and is not possible when you do not hold a registered trademark.

In short: the CMC widens who can play, but it does not make BIMI free or universally supported. Treat it as a second route to the same destination, with its own costs and its own coverage gaps.

The logo file: SVG Tiny PS, and why your normal export will fail

Even with the certificate sorted, the logo file itself has strict rules that trip up almost everyone on the first attempt. BIMI does not accept an ordinary SVG, a PNG or a JPEG. It requires a tightly restricted profile called SVG Tiny Portable/Secure, usually written SVG Tiny PS or SVG Tiny 1.2 PS.

The constraints that matter most:

• Square aspect ratio. The artwork must be square (a 1:1 viewBox), because providers render it in a circular or rounded-square avatar. A wide wordmark will be rejected or cropped to uselessness.
• A solid background colour. Transparency is not allowed; the file must declare a solid fill behind the mark.
• No scripts, no external references, no animation. The "Secure" in the name is literal. Embedded scripts, links to external resources, raster images and animation are all forbidden, which is exactly why a default export from a design tool fails: those exports routinely include metadata, external font references or editor-specific cruft that the profile bans.
• A title element and the right namespace. The file must declare the correct profile and include a <title>, among other structural requirements.

The good news is that this is the one part of the process that is purely technical and free to fix. Take your existing brand mark, simplify it to a square lockup with a solid background, and convert it. The BIMI SVG converter will turn a normal SVG into the Tiny PS profile, the BIMI logo validator tells you exactly which rules a file breaks, and the BIMI generator assembles the final DNS record once the pieces are ready. Get the logo passing validation early, because there is no point paying for a certificate around a file that will not render.

Who genuinely benefits

BIMI earns its keep when recognition in the inbox has real commercial value and you send enough mail for that recognition to compound. In practice that means:

• Consumer-facing brands and retailers. If your customers know your logo on sight, a verified mark next to every order confirmation, dispatch note and marketing email reinforces that recognition at the exact moment someone is scanning a crowded inbox. The logo helps your genuine mail stand out from the lookalikes.
• High-volume transactional and newsletter senders. Receipts, shipping updates, account notifications, subscription newsletters. When you send a lot of mail to a lot of people, a consistent verified logo builds familiarity and gives recipients a fast visual cue that the message is the real thing rather than a phishing attempt wearing your name.
• Organisations that already hold a registered trademark. If the trademark exists, the most painful prerequisite is already met, and the VMC becomes a straightforward purchase rather than a multi-month legal project. The marginal cost of adding BIMI is then low.
• Brands in heavily phished sectors. Banks, delivery companies, large public-facing institutions. These are the names attackers impersonate most, so a verified logo that only appears on authenticated mail is a meaningful, visible differentiator for recipients trying to spot the fake.

For these senders the logo is a genuine trust signal, the audience is large enough for it to matter, and the cost is easy to justify against the brand value at stake.

Who can comfortably skip it

Equally, there are whole categories of sender for whom BIMI is cosmetic effort better spent elsewhere:

• Small businesses and sole traders without a registered trademark and without the volume for inbox recognition to pay back the certificate cost.
• Internal-only or infrastructure domains that send to a known, fixed set of recipients who are not scanning a noisy inbox for your brand.
• B2B senders whose recipients do not visually shop their inbox. If your mail goes to a handful of named contacts who already know you, a logo changes nothing about whether they open it.
• Anyone who does not hold, and does not want to pay to register, a trademark or qualify for a CMC. The prerequisite cost simply outweighs the cosmetic benefit.

None of this means these organisations should neglect email authentication. They absolutely should reach p=reject, because that is what stops their domain being spoofed, and they get every bit of that security benefit whether or not a logo ever appears. BIMI is the cherry; DMARC enforcement is the cake. Skipping the cherry costs you nothing real.

If you decide to do it: the order of operations

Assuming you have weighed it up and BIMI is worth it for you, here is the sequence that avoids paying for things out of order.

1. Reach DMARC enforcement first. Get your domain to p=quarantine or, better, p=reject with pct=100, having confirmed every legitimate source is authenticated and aligned. Verify with the DMARC checker. Nothing downstream works until this is true.
2. Prepare and validate the logo. Produce a square, solid-background SVG Tiny PS file. Run it through the logo validator until it passes cleanly, using the SVG converter to fix profile issues. Host it at a stable HTTPS URL.
3. Sort out your trademark position. If you hold a registered trademark, you can pursue a standard VMC. If you do not, decide whether to register one (a long-term project) or whether a CMC covers your case; model it with the CMC simulator.
4. Obtain the certificate. Apply for a VMC or CMC from an approved certificate authority, complete the identity and trademark verification, and host the resulting .pem file at an HTTPS URL.
5. Publish the BIMI record. Build the default._bimi TXT record with the BIMI generator, pointing l= at your logo and a= at your certificate, then publish it in DNS.
6. Verify end to end. Confirm the record resolves and the certificate is valid with the BIMI checker and VMC checker, then send test mail to Gmail and Apple Mail accounts and look for the logo. Rendering can take time to propagate, so do not panic if it is not instant.

The BIMI product page covers the hosted side, and because BIMI lives or dies on the underlying authentication, it is worth reading it alongside the DMARC product page.

Keeping it working

A VMC expires annually and must be renewed, or your logo quietly vanishes from inboxes. Your DMARC policy can also drift: a new sending tool added without proper SPF or DKIM alignment can start failing, your reports can change, and a botched DNS edit can break the l= or a= URLs. Because the cost of BIMI silently breaking is your most visible brand asset disappearing without anyone noticing, this is exactly the kind of thing worth watching automatically. Continuous monitoring with change alerts will tell you the moment a record breaks or a certificate is about to lapse, which matters far more for BIMI than for most DNS records precisely because the failure mode is invisible until a customer mentions it.

If you want the bigger context on why enforcement is now table stakes rather than a nice-to-have, the DMARC mandate, one year on is a useful companion read.

The honest bottom line

BIMI is worth real money for recognisable consumer brands that send at volume, hold a trademark (or qualify for a CMC), and already run DMARC at enforcement. For them it is a finishing touch that turns hard-won authentication into a visible trust signal in the inbox. For nearly everyone else it is a cosmetic extra with a recurring certificate bill attached, and the time and money go further elsewhere.

Whichever camp you are in, the prerequisite never changes: reach p=reject safely, with every legitimate sender authenticated and aligned, so attackers cannot spoof you. That is the part that protects you. If, having done it, you have a trademark and a genuine reason to want your logo in front of recipients, BIMI is a worthwhile next step, and the free BIMI tools will take the file and the record off your plate. If reaching enforcement without an email outage is the real worry, that is the work we do for you: we host your DMARC, SPF, DKIM and MTA-STS, stage your domain from monitoring to enforcement safely, and host your BIMI record too if it turns out to be worth it. Start with the authentication, and let the logo be the reward at the end.