What is BIMI and is it worth it?

13 May 2026 · 11 min read

What is BIMI, and is it worth it?

Open your inbox and look at the sender column. Most messages sit next to a grey circle with a single initial in it, or a generic placeholder. But a handful, often from large banks, retailers and household-name brands, show a small, crisp logo right beside the sender name. That logo is not decoration the sender uploaded somewhere. It is the visible tip of a chain of email authentication that the sending domain has had to earn, and the standard that puts it there is called BIMI.

BIMI stands for Brand Indicators for Message Identification. It is a way for a domain owner to publish their logo in DNS so that participating mailbox providers can display it next to authenticated mail. The promise is appealing: a brand logo in the inbox, more trust, better recognition, perhaps a nudge to open rates. The reality is more nuanced, because BIMI is the last brick in a wall, not the first. You cannot bolt it on to an unprotected domain, and for some senders the work and cost it demands outweigh what it gives back.

This article explains exactly what BIMI shows and how it works, the hard prerequisite that DMARC must already be at enforcement before any logo appears, the certificate requirement that catches most people out, what it costs in money and effort, and an honest view of who actually benefits. By the end you should be able to decide whether BIMI is a sensible next step for your domain or a distraction from more important work.

What BIMI actually shows, and where

BIMI does one narrow thing: it lets a mailbox provider display your brand logo next to messages that have already passed authentication. It is purely a visual indicator. It does not authenticate anything itself, it does not change deliverability rules, and it does not protect a single message on its own. Every ounce of the security that makes BIMI possible comes from the layers underneath it.

The logo appears in the places a mailbox provider chooses to show it, which today typically means:

• The avatar slot next to the sender in the message list, where you would otherwise see a coloured initial or a placeholder.
• The larger avatar shown at the top of an opened message in some clients.
• In a few providers, a verified-mark variant where a small tick or shield accompanies the logo to signal that it was backed by a paid certificate.

Support is not universal, and it has grown unevenly. Gmail displays BIMI logos for senders that meet its requirements, and shows a blue verified checkmark for those that hold a Verified Mark Certificate. Apple Mail displays BIMI logos in recent versions of iOS, iPadOS and macOS. Yahoo and AOL were early adopters through the Verizon Media inboxes. Fastmail and a number of others participate. Microsoft's Outlook and Exchange Online have historically not displayed BIMI logos in the same way, which matters enormously if your audience is heavily corporate and sitting on Microsoft 365.

That patchy support is the first honest caveat. Even a perfect BIMI deployment will show your logo to some recipients and not others, and the split depends entirely on which mailbox provider each person uses. You are buying a logo for part of your audience, not all of it.

The non-negotiable prerequisite: DMARC at enforcement

Here is the single fact that decides whether BIMI is even on the table for you. BIMI requires your domain to be at DMARC enforcement. That means your published DMARC policy must be p=quarantine or p=reject, applied to the full mail stream. A domain sitting at p=none, the monitoring-only policy, will never show a BIMI logo, no matter how perfect the logo file or how valid the certificate.

The reasoning is sound. BIMI exists to make a logo a trustworthy signal. If receivers showed your logo on mail that had not been verified as genuinely yours, a spoofer could ride on your brand recognition: send a phishing message that fails authentication, and still have your logo sitting reassuringly beside it. By insisting on enforcement, BIMI guarantees that only mail which actually aligned to your domain, and which receivers were already willing to deliver under a strict policy, can ever carry the mark.

Most providers want a genuine enforcement posture, not a technicality. Many will refuse to show a logo if your record uses a low pct value to sample only a fraction of mail, and Gmail's documentation has called for full coverage. In practice you should treat the requirement as: a real quarantine or reject policy, covering all of your mail, with no sampling escape hatch. If you want to understand the difference between the three policy levels, the none, quarantine and reject explainer walks through exactly what each one tells receivers to do.

This prerequisite reframes the whole question of whether BIMI is worth it. Getting to p=reject safely is the genuinely valuable work, because that is what actually stops people spoofing your domain. BIMI is a reward you can collect once that work is done. If your domain is still at p=none, your effort belongs on the road to enforcement first, not on logo files. The honest path is: monitor with reports, fix your legitimate senders so they align, raise the policy step by step, and only then look at BIMI. You can see where your domain sits today with the DMARC checker, and trace the full route in the requirements guide.

If your domain is not yet at enforcement, that is the project to prioritise. Taking a domain from p=none to p=reject without breaking legitimate mail is precisely the done-for-you service DMARC Engine provides, and BIMI becomes a simple follow-on step once you are there.

How a BIMI record works

Assuming DMARC enforcement is in place, BIMI itself is published as a DNS TXT record at a predictable location: the label default._bimi prefixed to your domain. For example.com, the record lives at default._bimi.example.com. The default part is a selector, mirroring the way DKIM uses selectors, so a domain can in principle publish more than one logo for different mail streams, though most publish a single default.

A typical BIMI record looks like this:

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

There are three tags, and only the first two are part of the core syntax:

• v=BIMI1 is the version tag. It must come first and be spelled exactly, just like the version tag in DMARC and SPF. Receivers ignore the record if it is missing or malformed.
• l= is the location of the logo file. It points to an HTTPS URL where your logo lives as an SVG image. This tag is what makes the logo appear in providers that do not require a certificate.
• a= is the location of the assertion certificate, the Verified Mark Certificate or Common Mark Certificate. It points to an HTTPS URL serving the certificate file (a .pem). This tag is optional in the raw syntax but, as we will see, effectively mandatory for the major providers.

You can inspect any domain's published BIMI record, check the selector, and see whether the logo and certificate URLs resolve with the free BIMI checker. It is the quickest way to confirm a deployment is wired up correctly before you wait to see whether a logo turns up in real inboxes.

The logo file is fussier than you expect

BIMI does not accept just any image. The logo must be supplied in a tightly constrained profile of SVG, specifically SVG Portable/Secure (SVG P/S), also written SVG Tiny 1.2 with portable and secure restrictions. This is not the same as the SVG your designer exports from a standard tool, and getting it wrong is one of the most common reasons a technically valid BIMI record still shows no logo.

The constraints exist for security and consistency. The SVG must not contain scripts, external references, animation, or anything that could be used to track recipients or execute code. Practical requirements include:

• A square aspect ratio. Logos that are wider than they are tall, like many wordmark lockups, do not fit the circular or square avatar slot and must be reworked into a square mark.
• A solid background, not transparency, because the logo sits in a coloured avatar circle.
• A defined title element naming the brand.
• No raster images embedded inside the SVG; it must be true vector artwork.
• A small file size, well within a few kilobytes.

Many brands discover that their existing logo, designed for a website header or a letterhead, simply will not work as a BIMI mark. A horizontal logo with the company name spelled out beside an icon usually has to be cut down to just the icon, or a square version commissioned. That is a design exercise, not a technical one, and it is worth doing properly because this small square becomes the face of your mail in the inbox.

A further wrinkle for the verified-mark route: the logo you use for BIMI must generally be a registered trademark. The certificate authorities that issue Verified Mark Certificates verify your right to the logo against trademark registries in supported jurisdictions. If your mark is not registered, you cannot get a VMC, and without a VMC the largest providers will not show your logo. We will come to that next.

The certificate requirement, and what it costs

This is the part that turns BIMI from a free afternoon's work into a real budget line. The major mailbox providers do not show a logo on the strength of the l= tag alone. They require a cryptographic certificate that attests you are entitled to the logo. There are two kinds:

• A Verified Mark Certificate (VMC) attests to a registered trademark. It is issued only against a logo you have trademarked in a supported jurisdiction. Gmail's blue verified checkmark is tied to a VMC.
• A Common Mark Certificate (CMC) is a newer, more relaxed option that does not require a registered trademark and can cover things like government insignia or logos that have been in prior use. CMCs broaden access but are not honoured everywhere a VMC is, and the verified checkmark experience is generally reserved for VMCs.

Both are issued by a small number of approved certificate authorities, historically DigiCert and Entrust. They are not free TLS certificates. A VMC typically costs in the region of one thousand US dollars or more per year, sometimes higher depending on the authority and the number of domains, and it renews annually. The CMC is usually cheaper but still a paid, recurring product.

Getting one is also a process, not a click. You will typically need to:

1. Hold a registered trademark for the logo (for a VMC), which itself can take many months and its own fees if you do not already have one.
2. Produce the logo in the strict SVG P/S profile described above.
3. Apply through a certificate authority, which verifies your trademark and your control of the domain.
4. Host the issued .pem certificate at an HTTPS URL and reference it in your BIMI record's a= tag.

So the true cost of a fully working BIMI deployment, the kind that lights up the logo and the checkmark in Gmail, is the certificate fee, the annual renewal, the trademark (if you do not have one), and the design work for the SVG. That is a meaningful commitment, and it is why BIMI is far more common among large consumer brands than among small businesses.

So, is BIMI worth it? An honest assessment

There is no universal answer, so weigh it against your own situation rather than the marketing.

BIMI is worth it when:

• You are a recognised consumer-facing brand whose logo carries real trust in the inbox: a bank, a retailer, a well-known service, a brand people would hesitate over if the logo were absent.
• You send high volumes of marketing or transactional mail to consumer mailboxes (Gmail, Apple Mail, Yahoo), where the supported providers and your audience overlap heavily.
• You already hold a registered trademark, so the VMC route does not add a multi-month legal project.
• You are already at, or committed to reaching, DMARC enforcement, so BIMI is genuinely just the final step rather than the reason for the whole project.

BIMI is usually not worth it when:

• Your audience is mostly corporate and on Microsoft 365 or Exchange, where the logo may not be shown at all, leaving you paying for a certificate that few recipients ever see.
• You are a small business with no registered trademark and no appetite for the cost, where the time and money would buy more security elsewhere.
• Your domain is still at p=none. In that case BIMI is not an option yet, and chasing it distracts from the enforcement work that actually protects you.

The most important point to keep in proportion is this: BIMI is a cosmetic and trust layer, not a security control. The thing that stops criminals spoofing your domain is DMARC at enforcement, backed by correct SPF and DKIM. That protection is real, it is free to deploy in DNS, and it works whether or not a logo ever appears. BIMI adds a recognisable badge on top of that protection for the recipients whose providers support it. It is a genuine benefit for the right sender, but it is the cherry, not the cake.

There is also a softer, strategic argument worth naming honestly. Pursuing BIMI gives an organisation a concrete, visible reason to finally get its DMARC house in order. Plenty of brands have reached p=reject precisely because marketing wanted the logo and that gave the security team the mandate to do the underlying work. If a logo is what unlocks the budget and attention to reach enforcement, the security win is real regardless of how many inboxes end up showing the mark.

A sensible order of operations

If BIMI appeals, resist the temptation to start with the logo. The order that actually works is:

1. Get authentication right. Publish correct SPF and DKIM for every legitimate sender. Confirm with the SPF checker and DKIM checker that your mail aligns.
2. Reach DMARC enforcement. Move from p=none to p=quarantine and then p=reject, using aggregate reports to confirm you are not breaking real mail along the way. This is the load-bearing step, and where ongoing monitoring keeps you safe as senders change.
3. Prepare the logo. Produce a square SVG P/S file from a registered trademark, with a solid background and a title element.
4. Obtain a certificate. Apply for a VMC (or CMC) through an approved authority and host the resulting .pem over HTTPS.
5. Publish the BIMI record. Add the default._bimi TXT record with v=BIMI1, your l= logo URL and your a= certificate URL, then verify it with the BIMI checker.

Done in that order, BIMI is a clean finishing touch on a domain that is already properly defended. Done out of order, it is frustration: a logo that never appears because the policy underneath it was never at enforcement.

The practical takeaway

BIMI puts your brand logo beside your authenticated mail in supporting inboxes, but only after your domain has reached DMARC enforcement and, for the major providers, only with a paid Verified Mark or Common Mark Certificate backing it. For a recognised consumer brand with a registered trademark and an audience on Gmail, Apple Mail and Yahoo, it is a worthwhile, relatively modest finishing step. For a small business at p=none with no trademark and a Microsoft-heavy audience, the cost and effort rarely pay off, and the same energy spent reaching enforcement protects the domain far more.

Whatever you decide, start by finding out where your domain stands. Check your current DMARC posture and any existing BIMI record with the free BIMI checker and the DMARC checker. If the underlying work of reaching p=reject safely is the real blocker, that is exactly what the done-for-you DMARC service is built to handle, and once you are at enforcement, switching the logo on is the easy part.