Hosted BIMI & VMC

BIMI puts your verified brand logo next to your messages in supporting inboxes. Open Gmail or Apple Mail and you see a small circular avatar beside the sender name. For most companies that is a generic coloured initial. For a brand that has done the work, it is the actual logo, the same mark customers recognise on a website or a shopfront. BIMI is the reward you collect after you finish email authentication, not a trick that gets you there faster.

What BIMI actually is

BIMI stands for Brand Indicators for Message Identification. It is a standard that lets a mailbox provider look up your brand logo and display it alongside authenticated mail. The mechanism is simple on the surface: you publish a small DNS record, you host an image, and in some cases you attach a certificate that proves you own the trademark for that image. The inbox does the rest.

The point is recognition. A person scanning a crowded inbox spots a familiar logo faster than they read a sender name, and a recognised logo signals that the message is genuine before a single word is read. BIMI turns authentication, which is invisible plumbing, into something a customer can actually see.

Why it matters

BIMI is a visible reward for getting authentication right. The logo only appears when your mail passes DMARC with alignment, which means the inbox has confirmed the message really came from your domain. Spoofers cannot borrow it. An attacker sending a fake invoice from accounts@yourcompany.com through some random server will never trigger your logo, because their mail fails DMARC and the avatar slot stays a plain initial. Over time customers start to associate the logo with legitimacy, which makes the fakes look more obviously wrong.

Senders who adopt BIMI generally report better engagement with their mail: higher open rates and stronger brand recall. We will not quote you an exact percentage, because the lift depends heavily on your audience, your existing brand recognition and what you send. What is consistent is the direction. A recognised logo in the inbox earns more attention than a grey circle, and that attention is worth something to any team that sends marketing or transactional mail at scale.

The prerequisite nobody can skip

This is the part that catches people out. BIMI requires DMARC to be enforced. A record of v=DMARC1; p=none does not qualify, no matter how clean your reports look. The policy has to be p=quarantine or p=reject, and your legitimate mail has to actually pass alignment under that policy without being filtered.

That is deliberate. The whole value of BIMI rests on the inbox trusting that mail from your domain is genuinely yours. If you were still on p=none, anyone could spoof you, and showing your logo on spoofed mail would do the opposite of building trust. So the standard insists you close the door first.

In practice this means most domains are not ready for BIMI on day one. The majority of organisations that publish DMARC are stuck at p=none, watching aggregate reports but never blocking anything. BIMI gives those teams a concrete reason to push through to enforcement. If you have been treating p=reject as optional, the promise of your logo in every customer's inbox is often what makes the case internally. See how to reach enforcement for the staged path, and our DMARC page for the fundamentals.

The records and the assets

BIMI itself is small. You publish one TXT record and you host one image, plus a certificate if you want the logo to appear in the inboxes that demand one.

The DNS record

The record lives at default._bimi.yourdomain (the selector is usually default) and looks like this:

v=BIMI1; l=https://yourdomain/bimi/logo.svg; a=https://yourdomain/bimi/vmc.pem

The l= tag points to your logo file. The a= tag points to your Verified Mark Certificate. If you leave a= empty, some inboxes will still show the logo and others will not, which we cover below.

The logo file

The image is not an ordinary SVG. It must be SVG Tiny Portable/Secure, a tightly restricted profile of SVG Tiny 1.2 that strips out scripts, external references and anything that could carry a payload. It has to be square, it needs a solid background rather than transparency, and it should be a clean, simple mark that reads well at the size of a small circle. A detailed illustration that works on a billboard often looks like a smudge at avatar size, so brands frequently produce a simplified version specifically for BIMI.

What a VMC is and why it costs money

A Verified Mark Certificate is the document that proves the logo is legitimately yours. It is issued by a certificate authority after that authority verifies two things: that you control the domain, and that you own a registered trademark for the exact logo you want to display. The certificate binds the logo to your trademark and to your organisation, so an inbox can trust that the mark belongs to you and not to an impersonator who copied your branding.

Three consequences follow from that:

• You need a registered trademark. Not a pending application in most cases, but a registered mark for the logo itself, in a jurisdiction the certificate authority recognises. If your logo is not trademarked, the VMC route is closed until it is.
• There is an annual cost. A VMC is a paid certificate that you renew each year, separate from anything DMARC Engine charges. Budget for it as an ongoing line item, not a one-off.
• The logo and the trademark must match. The mark on the certificate has to be the mark you registered. You cannot register one logo and display a redesigned one.

Where the logo actually appears

BIMI support is not universal, and the rules differ by provider. The main three to plan around are Gmail, Apple Mail and Yahoo.

The practical takeaway is that if you want the broadest display, including Gmail and Apple Mail, you will need a certificate. A record and a logo with no a= tag may get you partial coverage in some inboxes, but the big mailbox providers expect the VMC. Treat the certificate as the price of full coverage, not an optional extra.

The SVG constraints in detail

The logo file fails more BIMI rollouts than any other single thing, so it is worth being precise about what the profile demands.

• Profile: SVG Tiny 1.2, in the Portable/Secure (PS) variant. The file must declare the right base profile and version, and contain no scripting, no animation, no external links and no embedded raster images beyond what the profile allows.
• Shape: square aspect ratio, because the inbox crops it into a circle or rounded square. A wide horizontal wordmark gets clipped badly, so most brands use the icon or monogram rather than the full lockup.
• Background: a solid fill, not transparent. Transparency tends to render as black or white in ways you cannot control.
• Title: the file should include a <title> element naming the brand.
• Size: keep the file small and the geometry simple. The mark is displayed tiny, and complex paths add weight without adding clarity.

If your design team exports a logo straight from a vector tool, it almost never passes the profile on the first try. Cleaning it up to SVG Tiny PS is a specific, fiddly task, and a VMC will not be issued against an image that does not validate.

How DMARC Engine helps

We treat BIMI as the last step of an authentication programme, and we support the whole path to it rather than just the final record.

• Enforcement readiness. Before you spend a penny on a certificate, we confirm your DMARC is genuinely enforced and that your real mail passes under p=quarantine or p=reject. There is no point buying a VMC if your logo will never display because legitimate mail is still failing alignment.
• Hosting the record and the logo. We host your _bimi record and serve the logo from a stable URL, so you do not have to manage another DNS entry or a separate file host. When the record needs to change, it changes in one place.
• Guidance through the VMC process. The certificate application asks for trademark details, domain control proof and a validated logo file. We guide you through what each certificate authority needs and help you get the SVG into a state that validates, so the application does not stall on a malformed image.

The result is that BIMI stops being a research project and becomes a checklist you can actually complete. You can review what each tier includes and the introductory pricing on our pricing section.

A short checklist to BIMI

1. Reach DMARC enforcement. Move your policy to p=quarantine or p=reject and confirm legitimate mail passes alignment. This is the non-negotiable foundation.
2. Register the trademark. Secure a registered trademark for the exact logo you intend to display, or plan to use a CMC if a registered mark is not available to you.
3. Produce the SVG. Create a square SVG Tiny PS file with a solid background and a brand title, simplified for small-size display.
4. Obtain the certificate. Apply for a VMC (or CMC) from a certificate authority, providing domain control and trademark proof. Budget for the annual renewal.
5. Publish the record. Add the _bimi TXT record with l= for the logo and a= for the certificate, then test in a real inbox.
6. Monitor and maintain. Keep DMARC enforced, renew the certificate on time and update the logo only when you can update the trademark and certificate to match.

The bottom line

BIMI is the payoff at the end of an authentication programme, not a shortcut to it. The logo only earns its place because the inbox already trusts your mail, and that trust comes from DMARC enforcement, a validated logo and a certificate that ties the mark to your organisation. Done in the wrong order it is wasted money. Done in the right order it turns work that customers never saw into something they recognise every time you land in their inbox. If you are not certain where your domain stands today, start with a free scan, get to enforcement, and let the logo be the reward for finishing.