How Do I Set Up BIMI? Step-by-Step Guide

24 June 2026 · DMARC Engine · 7 min read

BIMI (Brand Indicators for Message Identification) displays your verified brand logo next to authenticated messages in supporting mailboxes such as Gmail, Apple Mail, Yahoo and Fastmail. Setting it up is mostly a sequence of prerequisites: you cannot publish a working BIMI record until your domain is at enforced DMARC and your logo is in exactly the right format. This guide walks through the whole process in order, with a worked example and the checks that confirm it is live.

The short answer

To set up BIMI you need to, in this order:

Get your domain to an enforced DMARC policy (p=quarantine or p=reject, with pct=100 if pct is present).
Produce a square logo in SVG Tiny PS format, hosted over HTTPS.
Optionally (and for Gmail/Apple, effectively mandatory) obtain a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).
Publish a default._bimi TXT record pointing at the logo and the certificate.
Verify the record and confirm the logo renders in Gmail and Apple Mail.

The slowest parts are reaching enforcement and getting a VMC issued; the DNS record itself takes minutes. Plan for weeks, not hours.

Step 1: Confirm your DMARC is enforced

BIMI's single hard prerequisite is an enforced DMARC policy on the domain that sends your mail. Mailbox providers will not show a logo for a domain sitting at p=none, because none only monitors: it proves nothing about whether unauthenticated mail is being rejected.

You need a DMARC record at the organisational domain (and ideally each sending subdomain) with:

p=quarantine or p=reject
if pct is specified, it must be pct=100 (most providers ignore BIMI when fewer than 100% of failing messages are subject to the policy)
sp= consistent with the above if you publish a subdomain policy

A compliant record looks like:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; sp=reject; adkim=s; aspf=s

Do not jump straight to p=reject to satisfy BIMI. Moving to enforcement without first reading your aggregate reports is the fastest way to block legitimate mail. Work through monitoring and ramp the policy gradually. The enforcement journey explains the safe path, and DMARC Engine can ramp pct and policy for you automatically once your sources are aligned. Confirm the current state with the DMARC checker before going further.

If your domain is still at p=none, stop here. BIMI will not work and no amount of logo or certificate effort changes that.

Step 2: Prepare the logo in SVG Tiny PS

BIMI does not accept PNG, JPEG or ordinary SVG. The image must be SVG Tiny Portable/Secure (SVG Tiny PS), a restricted profile of SVG Tiny 1.2 with security-related elements stripped out. The key requirements are:

Square aspect ratio (1:1). The logo is shown in a circle or rounded square, so centre it with comfortable padding.
Root attribute baseProfile="tiny-ps" on the <svg> element.
A <title> element describing the logo.
No scripts, no external references, no animation, no <image> raster embeds, no interactivity.
A single fill colour background is strongly recommended (avoid transparency, which renders inconsistently).
Keep the file small; well under the few-kilobyte range is normal.

A trimmed example of a valid root looks like:

<svg xmlns="http://www.w3.org/2000/svg" baseProfile="tiny-ps"
     version="1.2" viewBox="0 0 400 400">
  <title>Your Brand</title>
  <rect width="400" height="400" fill="#0b5fff"/>
  <path fill="#ffffff" d="M120 120h160v160h-160z"/>
</svg>

Host the finished file at a stable HTTPS URL (for example https://yourdomain.com/bimi/logo.svg). The URL must be reachable publicly, served with a sensible content type, and should not redirect.

A note on certificates and the logo

If you are getting a VMC (Step 3), the logo in your certificate and the logo at the BIMI URL must be identical. Finalise the artwork before you order the certificate, because any later change to the logo means re-issuing the VMC.

Step 3: Decide on a VMC (or CMC)

A Verified Mark Certificate is a certificate that cryptographically binds your logo to your domain and proves the mark is a registered trademark. It is issued by a small number of certificate authorities after they verify your trademark and organisation.

Where it matters:

Gmail and Apple Mail will not display a BIMI logo without a valid VMC or CMC. For the largest audiences, the certificate is in practice required, not optional.
Some other providers historically showed logos with no certificate, but support is shrinking. Do not build your plan around certificate-free display.

Two flavours exist:

VMC: for logos backed by a registered trademark.
CMC (Common Mark Certificate): for logos that are not trademark-registered (for example government or some established marks), accepted by a subset of providers.

The certificate is delivered as a .pem file containing the logo and the verification chain. Host it over HTTPS alongside (or near) your SVG. If you want the logo to display before a certificate is issued, or for providers that do not require one, see BIMI without a VMC, but treat that as a partial result, not the finished setup.

Step 4: Publish the default._bimi TXT record

BIMI is published as a TXT record at the special host default._bimi under your domain. The selector is default unless you deliberately use a different one (advanced, per-stream use).

Create a TXT record:

Name / host: default._bimi
Type: TXT
Value: the BIMI record

A record with a VMC looks like this:

default._bimi  IN  TXT  "v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem"

The tags are:

v=BIMI1: version, always first.
l=: the HTTPS URL of the SVG Tiny PS logo.
a=: the HTTPS URL of the VMC/CMC .pem. Leave the value empty (a=) only if you are intentionally going certificate-free.

For a subdomain that sends mail, publish the record at default._bimi.subdomain.yourdomain.com. If a subdomain has no record, providers fall back to the organisational domain's BIMI record only when DMARC alignment allows it. When in doubt, publish per sending domain.

DMARC Engine can host and serve the default._bimi record, the logo and the certificate for you as part of hosted email authentication, which avoids hand-editing DNS for each domain.

Step 5: Verify it is working

Two layers of verification: the record, then the rendered logo.

Check the record and assets

Query the TXT record: dig +short TXT default._bimi.yourdomain.com should return your v=BIMI1; l=...; a=... string on one line.
Open the l= URL in a browser. The SVG should load over HTTPS with no redirect or certificate warning.
Open the a= URL. The .pem should download.
Run the domain through a BIMI inspector or the BIMI checker to confirm the logo, certificate and DMARC enforcement all validate together.

Check the rendered logo

Send a genuine email from the domain to a test inbox at each provider you care about. DNS and provider caches mean the logo can take from minutes to a day or more to appear after everything is correct, so do not panic on the first send.

Gmail: open the message in the Gmail web app; a verified logo shows as the circular sender avatar. Hover or open details to see the verified mark.
Apple Mail: on a current iOS/macOS version, the logo appears as the contact image next to authenticated mail.

Common problems

Still on p=none. The most common cause of "nothing shows". Reach enforcement first.
pct below 100. Remove pct or set it to 100; partial enforcement disqualifies many providers.
Wrong logo format. A normal SVG, a PNG renamed to .svg, or a missing baseProfile="tiny-ps" all fail silently. Re-export specifically to SVG Tiny PS.
Non-square or padded artwork. Logos that are not 1:1 get cropped awkwardly in the circular badge.
Logo and VMC mismatch. Even a one-pixel difference between the certificate's embedded logo and the hosted SVG breaks validation.
No VMC for Gmail/Apple. Without a valid certificate, those clients simply will not display anything.
Asset not reachable. HTTP-only URLs, redirects, self-signed TLS or a 404 on the l=/a= URL all block display.
Caching. After fixing any of the above, allow time for DNS TTLs and provider re-evaluation before retesting.

For a deeper diagnostic walkthrough when the record looks correct but the badge is absent, see why is my BIMI logo not showing.

Next steps

Work the prerequisites in order: enforce DMARC, then produce an SVG Tiny PS square logo, then obtain a VMC if you are targeting Gmail and Apple, then publish default._bimi and verify. The DNS is the easy part; the time goes into safe DMARC enforcement and certificate issuance.

Confirm enforcement with the DMARC checker and follow the enforcement journey.
Let DMARC Engine host and serve your BIMI record, logo and certificate via hosted email authentication and BIMI.
Validate the finished setup with the BIMI checker before you announce it to stakeholders.

How do I set up BIMI?