All Glossary Terms

Glossary

BIMI (Brand Indicators for Message Identification)

Show your verified brand logo in Gmail and other inboxes next to every authenticated email you send

BIMI (Brand Indicators for Message Identification) is an email standard that lets domain owners display a verified brand logo directly in the recipient's inbox. To qualify, the domain must pass DMARC authentication with a policy of p=quarantine or p=reject. Major providers such as Gmail also require a Verified Mark Certificate (VMC) to confirm the logo is a registered trademark.

What is BIMI?

BIMI, or Brand Indicators for Message Identification, is an email specification developed by the AuthIndicators Working Group. It allows domain owners to link a verified brand logo to their email, which is then displayed directly in the recipient's inbox beside authenticated messages in supporting mail clients such as Gmail, Apple Mail, Yahoo Mail, and Fastmail.

BIMI serves both a security and a marketing purpose. From a security perspective, a verified logo gives recipients a visual signal that the message came from a legitimate, authenticated source — making it immediately harder for phishing emails spoofing the brand to go unnoticed. From a marketing perspective, it increases brand visibility and recognition in the inbox before the recipient even opens the email, with studies showing measurable increases in open rates.

For BIMI to work, the sending domain must have a DMARC policy of at least "p=quarantine" or "p=reject." This prerequisite means that implementing BIMI inherently requires strong email authentication across the full SPF → DKIM → DMARC stack, raising the bar for spoofing across the board.

BIMI Record Format and Tags

A BIMI record is a DNS TXT record published at the selector subdomain of the sending domain. The default selector record lives at "default._bimi.yourdomain.com". The record syntax follows this pattern:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/cert.pem

The three core tags are: "v=" which must be "BIMI1" and identifies the record version; "l=" which is the HTTPS URL of the brand logo in SVG Tiny PS format (an empty l= value signals BIMI is intentionally disabled for that selector); and "a=" which is the optional HTTPS URL of the Verified Mark Certificate (VMC) PEM file.

Additional selectors beyond the default are supported — for example, a domain could publish "marketing._bimi.example.com" for its marketing subdomain with a different logo. Receiving mail clients look up the selector specified in the BIMI-Selector header of the incoming message, falling back to the "default" selector when none is specified.

Email Authentication Prerequisites for BIMI

BIMI sits at the top of the email authentication stack — it requires the layer below it (DMARC) to be fully operational, which in turn requires SPF and DKIM.

SPF (Sender Policy Framework) authorises the sending mail servers for your domain by publishing a list of permitted IP addresses in DNS. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each outgoing message, allowing receivers to verify the message was not tampered with in transit. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM together, enforces alignment between the authenticated domain and the visible From address, and instructs receivers what to do with failing mail.

For BIMI specifically: your DMARC record must have "p=quarantine" or "p=reject" — a "p=none" monitoring-only policy is insufficient. SPF and DKIM must pass with alignment for BIMI to activate. Gmail additionally requires a VMC, which itself requires your logo to be a registered trademark in the relevant jurisdiction. You can use the BIMI Checker at nslookup.net/tools/bimi-checker to confirm your authentication chain is complete before applying for a VMC.

How Does BIMI Work?

When a supporting mail client receives a message, it first checks DMARC alignment. If the message passes, the client looks up the BIMI TXT record at the selector subdomain of the From domain. If a valid logo URL is found, the client fetches the SVG and displays it alongside the sender's name in the inbox view.

For providers that require a VMC (notably Gmail), the client also fetches the certificate at the "a=" URL and verifies its chain of trust back to an accredited Certificate Authority. The VMC contains a cryptographic binding between the domain, the logo, and the registered trademark, providing proof that the displayed logo is the genuine brand mark of the domain's verified owner.

Not all mail clients require a VMC — Yahoo Mail, Fastmail, and several others display BIMI logos based on the DNS record and DMARC alignment alone. Google Gmail currently requires a VMC for logo display, which means a BIMI implementation without a VMC will show logos in Yahoo and Fastmail but not in Gmail.

How to Implement BIMI Step by Step

Step 1 — Verify your authentication stack. Use the SPF Checker at nslookup.net/tools/spf-checker and the DMARC Lookup at nslookup.net/tools/dmarc-checker to confirm both records are valid. Confirm your DMARC policy is "p=quarantine" or "p=reject" with at least several weeks of aggregate report review to rule out legitimate mail failures.

Step 2 — Prepare your logo. Create or convert your brand logo to the SVG Tiny PS profile. The logo must be square (1:1 aspect ratio), must not reference external resources, must not include animations or scripts, and must be served from an HTTPS URL that returns the correct Content-Type header.

Step 3 — Obtain a VMC (if targeting Gmail). Contact an accredited mark verifier — currently DigiCert or Entrust — and complete the trademark verification process. This requires a registered trademark in the relevant jurisdiction. The cost ranges from a few hundred to several hundred dollars annually.

Step 4 — Publish the BIMI DNS record. Add a TXT record at "default._bimi.yourdomain.com" with the v=, l=, and a= tags. DNS propagation typically completes within 24–48 hours.

Step 5 — Validate. Use the BIMI Checker at nslookup.net/tools/bimi-checker to confirm the record resolves correctly, the logo URL is reachable and parses as valid SVG Tiny PS, the DMARC prerequisite is met, and the VMC certificate chain is valid.

How to Check Your BIMI Record

You can validate your BIMI DNS record using the BIMI Checker at nslookup.net/tools/bimi-checker. Enter your domain and the tool will look up the BIMI TXT record at "default._bimi.yourdomain.com", verify the SVG logo URL is reachable and correctly formatted, check that your DMARC policy meets the minimum "p=quarantine" or "p=reject" requirement, and flag any issues with the VMC certificate URL.

If your logo is not appearing in Gmail specifically, the most common causes are: no VMC present or VMC failed certificate chain verification, DMARC policy still at "p=none", logo SVG failing the Tiny PS profile validation, or the logo URL not returning an HTTPS response with the correct Content-Type. The BIMI Checker will surface all of these issues with specific error messages.

Related Tool

BIMI Checker

Try the Tool →

Frequently Asked Questions

Do I need a Verified Mark Certificate (VMC) for BIMI?
A VMC is required by Gmail and some other major providers to display BIMI logos. A VMC is issued by an accredited Certification Authority (currently DigiCert or Entrust) after verifying that your logo is a registered trademark. Other mail clients such as Yahoo Mail and Fastmail may display BIMI logos based solely on the DNS record and DMARC alignment without requiring a VMC, but Gmail — which handles a significant share of business email — requires one.
What logo format does BIMI require?
BIMI requires logos in SVG (Scalable Vector Graphics) format, specifically the SVG Tiny PS (Portable Secure) profile. The logo must be square (1:1 ratio), must not include animations, scripts, or external references, and must be served over HTTPS with the correct Content-Type. Standard SVG files exported from design tools typically need to be converted and sanitised to the SVG Tiny PS profile before they pass BIMI validation.
What happens to BIMI if my DMARC policy drops to p=none?
If your DMARC policy is downgraded to "p=none" — for example during troubleshooting or after a record change — BIMI logos will stop appearing in the inbox because the authentication prerequisite is no longer met. Mail clients check the DMARC policy at the time they process each incoming message. Restoring "p=quarantine" or "p=reject" will re-enable logo display once the DNS change has propagated.
How long does it take for a BIMI logo to appear in Gmail after publishing the record?
After publishing the BIMI DNS record and VMC, Gmail typically begins showing the logo within a few days to a few weeks. The delay depends on how frequently Gmail recrawls the BIMI record and VMC URL, and how much mail volume the domain sends — higher-volume senders are generally re-evaluated sooner. DNS propagation itself completes within 24–48 hours and does not account for the Gmail display delay.
Can subdomains use BIMI?
Yes. A subdomain can publish its own BIMI record at "default._bimi.subdomain.yourdomain.com" with a separate logo and VMC. The subdomain must also have its own DMARC-passing authentication. If no BIMI record exists at the subdomain level, mail clients may not fall back to the parent domain's BIMI record — each sending domain or subdomain needs its own BIMI configuration.
Does BIMI improve email deliverability?
BIMI itself does not directly improve deliverability, but the email authentication requirements it demands — specifically a strict DMARC policy — tend to correlate with better sender reputation. The visual branding it provides can improve open rates and recipient trust. Some providers use BIMI compliance as a positive signal when assessing sender reputation.
Which email clients support BIMI?
As of 2025, BIMI is supported by Gmail (VMC required), Yahoo Mail, Apple Mail (VMC required), Fastmail, La Poste, and several other providers. Microsoft Outlook has announced support but rollout has been gradual. Coverage is expanding as the standard matures.
Where exactly is the BIMI record published in DNS?
The default BIMI record is published as a TXT record at "default._bimi.yourdomain.com". The "default" portion is the selector name — additional selectors can be published at other subdomains such as "marketing._bimi.yourdomain.com". Receiving mail clients look up the selector name specified in the BIMI-Selector header of the incoming message, or fall back to "default" when no selector is specified.