BIMI email requirements: DMARC, VMC, CMC, and setup

BIMI (Brand Indicators for Message Identification) is the standard that puts your logo next to your name in supporting inboxes. It's the most visible authentication payoff: customers literally see proof your mail is real. The catch is that it requires a strict DMARC posture and, for the major receivers, a paid certificate.

For the prerequisite work, use the authentication hub to connect BIMI readiness with DMARC enforcement, SPF/DKIM alignment, and sender inventory.

Where you'll see BIMI

Prerequisites

1. DMARC at `p=quarantine` or `p=reject` with pct=100. Aggregate reports must be flowing.
2. A trademarked logo. Generic icons (a circle, a letter mark you don't own) won't pass VMC issuance.
3. An SVG file following the SVG Tiny PS profile. Roughly: square aspect, no scripts, no external refs, file under 32KB.
4. Public HTTPS hosting for the SVG and (if you have one) the VMC PEM file.

Preparing the SVG

BIMI is picky about SVGs. The format is SVG Tiny 1.2 Portable/Secure (SVG Tiny PS), which strips anything that could fetch external resources or execute scripts. The fastest path is exporting from your design tool, then running through bimi-svg-converter or hand-editing.

• `viewBox` must be square (e.g. 0 0 100 100).
• Width and height attributes must be set, equal, and use the same units as the viewBox.
• Root element needs baseProfile="tiny-ps".
• Title element required: <title>Your Brand</title> directly inside <svg>.
• No <script>, <a>, <image>, <foreignObject>, or external xlink:href.
• Solid background recommended (transparent renders inconsistently in clients).

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg"
     baseProfile="tiny-ps"
     version="1.2"
     viewBox="0 0 100 100"
     width="100"
     height="100">
  <title>Example Brand</title>
  <rect width="100" height="100" fill="#0a0a0a"/>
  <path d="M30 70 L50 30 L70 70 Z" fill="#ffffff"/>
</svg>

Publishing the BIMI record

BIMI lives at default._bimi.<domain> as a TXT record. The l= tag points to your SVG; the a= tag points to your VMC (PEM file).

The VMC question

A Verified Mark Certificate is a PKI certificate that ties your trademarked logo to your domain. Two issuers: Entrust and DigiCert. Pricing is around $1,500/year. To get one you need a registered trademark for the exact logo (text marks generally don't qualify; figurative marks do).

• Without a VMC: Fastmail will show your logo. Gmail, Apple, Yahoo will not.
• With a VMC: All major BIMI-supporting clients display the logo.
• Trademark requirement: Common marks (a basic geometric shape) usually fail review. Distinctive figurative marks pass.

Verifying

1. Use the BIMI Group's inspector at bimigroup.org/bimi-generator to validate the SVG and record syntax.
2. Send a test to a Fastmail or BIMI-supporting account. The logo should appear within minutes.
3. Send to Gmail (with a VMC). The logo appears in the avatar circle next to the From name.

Additional guidance: BIMI Setup Guide: Get Your Logo in the Inbox (Requirements, VMC, Cost)

BIMI (Brand Indicators for Message Identification) displays your brand logo next to authenticated emails in supporting inboxes like Gmail and Yahoo. Setting it up requires DMARC enforced at p=quarantine or p=reject, a square SVG Tiny PS logo, a _bimi DNS TXT record, and — for Gmail and Apple Mail — a Verified Mark Certificate (VMC) tied to a registered trademark, which costs roughly $1,000–1,500 per year.

That logo slot is the most valuable free real estate in email. Here's exactly how to claim it, what it costs, and where people get stuck.

What does BIMI actually do?

BIMI lets your domain declare: "here is my official logo, and I've proven my identity strongly enough that you should show it." When a supporting mailbox provider receives a message from your domain, it:

1. Checks that the message passes DMARC alignment with an enforced policy.
2. Fetches your _bimi DNS record.
3. Retrieves and validates the SVG logo (and the VMC, if required).
4. Renders the logo in the message list and sometimes in the open-message view.

The visual effect: instead of a generic initial circle, recipients see your brand mark next to your from-name in Gmail, Yahoo Mail, and a handful of other clients. In Gmail, a VMC-backed logo also earns a blue verification checkmark — the same one Google shows for verified senders.

The anti-phishing angle is the real design goal. A phisher spoofing your domain can't display your logo, because they can't publish a valid VMC-bound BIMI record on your domain or pass your DMARC policy. BIMI is authentication with a visible payoff.

Prerequisites checklist: DMARC comes first

BIMI is gated on DMARC enforcement. Not "DMARC exists" — DMARC enforced. Your policy record must be at p=quarantine or p=reject. A domain parked at p=none (monitoring mode) will not qualify, no matter how perfect the rest of the setup is.

The checklist:

• SPF and DKIM passing and aligned. At least one must align with your visible From domain for DMARC to pass. Both aligned is the standard to aim for.
• DMARC policy at `p=quarantine` or `p=reject`. No pct=50 games at the start — mailbox providers expect the policy to apply to essentially all mail. Gmail's docs say 100%.
• Subdomain policy handled. This is the gotcha that breaks more BIMI deployments than anything else. If your main policy is p=reject but your record contains sp=none (or omits sp while you send from subdomains with their own unenforced DMARC records), mail from subdomains fails the enforcement requirement. Your subdomains need to inherit or declare an enforced policy. See why the DMARC `sp` tag matters more than people think for the full subdomain policy breakdown.
• A registered trademark (for VMC). More on this below.
• A logo you can produce as SVG Tiny PS. Also below.

If your DMARC is still at p=none, fix that first — the DMARC rollout from none to reject playbook walks the staged enforcement path. You can run WillItInbox's free DMARC checker against your domain right now to see exactly where your record stands before you spend a dollar on certificates.

BIMI logo requirements: the SVG specs that trip people up

BIMI logos aren't regular image files. The spec requires a specific profile:

• Format: SVG Tiny Portable/Secure (SVG Tiny PS), a restricted SVG 1.2 subset. No scripts, no external references, no animation, no interactive elements.
• Shape: square aspect ratio, ideally a viewBox="0 0 [n] [n]" with equal dimensions. The logo renders in a circle in most clients, so keep critical content centered with padding — corners get visually cropped.
• Content nuance: the spec itself doesn't forbid text, but trademark offices and VMC issuers validate that the mark in the logo matches the registered trademark. If your registered mark is a wordmark, the SVG must show that wordmark. If it's a device mark (icon only), the SVG should be the icon. Don't freestyle.
• Hosting: the logo must be served over HTTPS from a domain you control. Use a stable URL — https://yourdomain.com/bimi/logo.svg. CDNs are fine. Redirects and flaky hosts cause silent failures.
• Background: solid backgrounds render far better than transparent ones in dark-mode inboxes. Most brands use their primary brand color as a full-bleed square background.

Practical tip: take your existing vector logo, strip everything except a single <g> of paths, and validate against the SVG Tiny PS profile. The BIMI working group maintains an open-source conversion/validation tool; VMC issuers will also reject malformed files during certificate issuance, which is an expensive way to find out your SVG is wrong.

VMC certificates: cost, trademark requirement, and the Gmail CMC alternative

A Verified Mark Certificate (VMC) is a digital certificate that cryptographically binds your logo to your domain, issued after the certificate authority validates your registered trademark. It's the trust anchor Gmail and Apple Mail require before showing your logo.

What a VMC costs

Two CAs dominate issuance: DigiCert and Entrust. Industry pricing lands at roughly $1,000–1,500 per year per mark depending on the CA and term length — treat that as a ballpark, since pricing shifts and multi-year discounts exist. On top of the VMC itself, you need:

• A registered trademark in a VMC-eligible trademark office (USPTO, EUIPO, UK IPO, and a growing list of others). A pending application doesn't count for most issuers. If you're not registered yet, that process takes months and its own legal fees.
• The logo artwork exactly matching the registered mark.

So the real total cost of the Gmail-checkmark path is VMC fee plus trademark registration plus your time. For established brands it's a rounding error. For a startup without a registered mark, it's a genuine barrier.

The CMC alternative

Gmail introduced support for Common Mark Certificates (CMC) as a lower-friction option. A CMC verifies logo use and history without requiring a formally registered trademark — validation leans on demonstrated, consistent use of the mark for at least a year rather than a trademark filing. CMC-backed logos display in Gmail but without the blue verification checkmark that VMC earns. Yahoo doesn't require any certificate at all — it displays BIMI logos based on its own assessment of the sender.

The pragmatic path for smaller senders: BIMI record with a self-asserted logo (no certificate) for Yahoo, plus a CMC for Gmail coverage, upgrading to VMC when the trademark registration clears.

Where is BIMI supported? Provider support matrix

Support has broadened steadily. As of mid-2026, hedged at "check each provider's docs for current detail":

The Microsoft gap matters if your list is corporate-heavy — your logo simply won't show there. The payoff is concentrated in consumer mailboxes, where Gmail and Yahoo together represent the majority of most B2C lists.

The BIMI DNS record, line by line

The record lives at default._bimi.yourdomain.com as a TXT record. A minimal self-asserted version:

default._bimi.yourdomain.com.  IN  TXT  "v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a="

The same record with a VMC (what you want for Gmail):

default._bimi.yourdomain.com.  IN  TXT  "v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem"

Breaking it down:

• `default` is the selector. Multiple selectors let different business units or sending streams carry different logos, referenced by a BIMI-Selector header in the message. Start with default.
• `v=BIMI1` — version tag, required, must come first.
• `l=` — HTTPS URL of the SVG logo. Required.
• `a=` — HTTPS URL of the PEM-encoded certificate chain (VMC or CMC). Empty (a=) means self-asserted: no certificate, which limits you to Yahoo and Fastmail.

One record per selector. Keep it on a single line in your DNS provider's interface — some providers mangle long TXT records if you split them incorrectly. After publishing, query it directly to confirm:

dig TXT default._bimi.yourdomain.com +short

If you get NXDOMAIN or a truncated answer, fix the record before touching anything else. A malformed BIMI record fails silently — no bounce, no error, just no logo.

Verification and troubleshooting

BIMI has no feedback loop. Mail delivers fine either way; the logo just appears or it doesn't. That makes structured verification essential.

The verification sequence

1. DMARC enforcement check. Query _dmarc.yourdomain.com and confirm p=quarantine or p=reject, and audit your sp tag and subdomain records. The DMARC checker flags enforcement gaps and subdomain exposure in one pass.
2. Record syntax check. Fetch the _bimi record and confirm v=BIMI1 first, valid HTTPS URLs, and a reachable l= URL returning Content-Type: image/svg+xml with HTTP 200.
3. SVG validation. Parse the logo against SVG Tiny PS. Common failures: scripts, xlink:href references, CSS classes instead of inline styles, non-square viewBox.
4. Certificate check. openssl x509 -in vmc.pem -text -noout — confirm the chain is complete, unexpired, and the PEM file includes intermediates.
5. End-to-end send test. Send a real message to Gmail and Yahoo seed addresses and look at the rendered UI, not just headers.

The top five failure causes

• DMARC not enforced (including sp=none undermining subdomain enforcement) — cause #1 by a wide margin.
• Sending mail from a subdomain whose DMARC record is weaker than the parent.
• SVG not conforming to Tiny PS — usually CSS or scripts left in by the design team's export.
• Logo URL redirecting or serving wrong content type.
• VMC chain incomplete or expired. VMCs renew annually; an expired certificate quietly drops your Gmail logo.

Also know that reputation is a hidden gate. Gmail won't show even a perfect VMC-backed logo for a domain with poor reputation. If your logo is missing and everything validates, check Google Postmaster Tools data and your domain reputation trajectory — the logo slot follows the same reputation scoring that governs the rest of your placement.

Is BIMI worth it? The marketing value case

The honest answer: BIMI is a trust and brand-recognition play, not a direct deliverability lever. Publishing a BIMI record does not move you out of spam. But the display effect is real:

• Recognition in a crowded list view. A logo next to your from-name is the fastest pattern-match a recipient gets. Early adopters and the BIMI working group have reported open-rate lifts in the low double digits in some studies; treat those as directional rather than guaranteed, since study methodologies vary.
• Phishing resistance made visible. Every message displaying your checkmarked logo trains customers to distrust the ones without it.
• Compounding with enforcement. You needed DMARC enforcement anyway — Gmail permanently rejects unauthenticated bulk mail with 550 5.7.26, so p=reject was already on your roadmap. BIMI is the dividend on work you had to do regardless.

My recommendation: if you send consumer-facing mail at any meaningful volume and you already own a registered trademark, BIMI is one of the highest-ROI brand moves in email. If you don't own a trademark, the self-asserted record for Yahoo costs you thirty minutes and is still worth doing.

Keep it working: monitoring drift

BIMI setups rot. VMCs expire annually. Designers overwrite the logo file. Someone edits the DMARC record during an ESP migration and drops enforcement to p=none "temporarily." Each of these silently kills your logo.

WillItInbox's DMARC and domain monitoring watches your DMARC, SPF, DKIM, and BIMI records for drift and alerts you when a policy weakens, a record disappears, or a certificate expiry is approaching — so you find out before your customers stop seeing the logo. Pair it with regular review of your DMARC aggregate reports and you have the full picture: who's sending, whether they authenticate, and whether your brand indicators are still live.

Verify the prerequisite policy with the DMARC checker and monitor legitimate sender alignment before enforcement changes.