BIMI (Brand Indicators for Message Identification)

BIMI lets a domain owner publish a brand logo in DNS that participating mailbox providers display next to authenticated messages in the inbox. It is not an authentication protocol itself — it is a reward for full authentication: a domain only qualifies once DMARC is at enforcement, which is why BIMI is often the business driver that funds a DMARC enforcement rollout. Each mailbox provider independently decides whether and how to display the logo.

Prerequisites: DMARC at enforcement

Before a BIMI record will be honored:

• SPF, DKIM, and DMARC deployed with proper alignment on the sending domain.
• DMARC policy at enforcement on the Organizational Domain and its subdomains:
  • p=quarantine; sp=quarantine or stronger, or
  • p=reject; sp=reject.
• Not permitted: p=none, sp=none, or any pct value below 100.

Mail must actually pass DMARC — the logo is only displayed on authenticated messages, and providers additionally gate display on the sending domain's reputation.

The BIMI DNS record

A TXT record published at the default selector under the _bimi label:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

Tag	Meaning	Notes
v	Version	BIMI1; must be first
l	HTTPS URL of the SVG Tiny PS logo file	Required for logo display
a	HTTPS URL of the evidence document (VMC/CMC certificate, PEM format)	Optional in the spec, but required in practice by providers that demand certificates (e.g., Gmail)

A record with l= but no a= is a self-asserted BIMI record; self-asserted records have limited support across mailbox providers (see table below). Selectors other than default are possible (declared via a BIMI-Selector header on the message) to serve different logos per mail stream.

SVG logo requirements (SVG Tiny PS)

The logo must conform to the SVG Portable/Secure (SVG Tiny PS) profile, based on W3C SVG Tiny 1.2:

Requirement	Value
version attribute on <svg>	1.2
baseProfile attribute on <svg>	tiny-ps
<title> element	Required — should reflect the company name
<desc> element	Recommended (accessibility)
External links/references	Forbidden (other than declared XML namespaces)
Scripts, animation, interactive elements	Forbidden
x= / y= attributes on the <svg> root	Forbidden
File size	≤ 32 KB
Aspect ratio	Square
Background	Solid color recommended — transparent backgrounds render inconsistently across clients
Composition	Center the logo; clients crop to a circle or rounded square

Standard design-tool SVG exports do not comply out of the box: Adobe Illustrator can export SVG Tiny 1.2, but manual edits are typically needed to set baseProfile="tiny-ps" and strip errant x/y attributes. The BIMI Group publishes reference files and conversion tools.

Certificates: VMC and CMC

Mark certificates are issued by Mark Verifying Authorities to vouch for the association between a logo and a domain. Two BIMI-qualified Certification Authorities issue them: DigiCert and Entrust. The certificate embeds the SVG logo and is referenced from the record's a= tag as a PEM file. Certificates carry a subject:markType field (OID 1.3.6.1.4.1.53087.1.13) identifying the validation method used.

	Verified Mark Certificate (VMC)	Common Mark Certificate (CMC)
Logo basis	Registered trademark (supported jurisdictions listed in the BIMI Group VMC Guidelines) or a government-recognized mark	Prior-use mark (no trademark needed) or a modified registered mark (variant of an owned trademark, e.g., seasonal versions)
Evidence required	Trademark registration; organization validation	Logo publicly displayed for at least 12 months on a website you control, with historical proof (e.g., archive.org) plus current live display
Gmail display	Logo plus blue verified checkmark	Logo only — no checkmark
Common prerequisites	DMARC at enforcement (p=quarantine/p=reject, no sp=none, no pct<100), SVG Tiny PS logo, published BIMI record	Same

Certificates are "highly recommended" rather than universally mandatory: Gmail requires a VMC or CMC and ignores self-asserted records, while Yahoo, Fastmail, and LaPoste display self-asserted logos.

Provider support (BIMI Group adoption list, May 2025)

Status	Providers
Supports BIMI	Apple, Google (Gmail), Yahoo Inc., Fastmail, Zoho Mail, Comcast, Cloudmark (Proofpoint), La Poste, WEB.DE, GMX, KDDI, NTT docomo, Onet Poczta, Zone, Zoner
Considering / planning	Yahoo Japan, Seznam.cz, mail.com, BT, AT Mail, Nifty, Qualitia
Does not support	Microsoft (Outlook.com / Microsoft 365 use their own brand-logo mechanisms instead)

Display criteria beyond the published requirements (domain reputation, sending history, volume) vary by provider and are at each provider's discretion — publishing a valid record and certificate makes a domain eligible, not guaranteed, to have its logo shown.

Implementation checklist

1. Bring all mail streams to aligned SPF/DKIM and move DMARC to enforcement — p=quarantine/p=reject with subdomain coverage and full application (see DMARC Deployment in Depth).
2. Produce an SVG Tiny PS logo meeting the table above; validate it with the BIMI Group's tools.
3. Obtain a VMC (trademarked logo) or CMC (12-month prior use) from DigiCert or Entrust — required for Gmail; skip only if the target providers accept self-asserted records.
4. Host the SVG (and PEM, if certified) at stable HTTPS URLs.
5. Publish the default._bimi TXT record.
6. Verify with a BIMI record checker and by mailing seed accounts at supporting providers; expect providers to apply their own reputation gating before displaying the logo.

Related

• DMARC — the authentication foundation BIMI builds on
• DMARC Deployment in Depth — reaching the enforcement policy BIMI requires