BIMI Implementation: Boost Brand Recognition in Email

A technical guide to implementing Brand Indicators for Message Identification (BIMI) to display your logo in subscribers' inboxes, including prerequisites and setup.

6 min read Published 5 Apr 2025 SpamBarometer Team

Brand Indicators for Message Identification (BIMI) is a standard, built on top of email authentication, that allows companies to display their verified brand logo next to emails in subscribers' inboxes. Implementing BIMI can significantly boost brand recognition, increase trust, and improve email engagement. This comprehensive guide will walk you through the prerequisites, setup process, and best practices for successfully implementing BIMI in your email marketing strategy.

Understanding BIMI: What It Is and How It Works

BIMI is a visual indicator that appears next to an email sender's name in the inbox, providing an instantly recognizable logo to help recipients identify legitimate emails from trusted brands. When an email is received, the recipient's email client checks for a BIMI record in the sender's DNS and displays the verified logo if all authentication checks pass.

Good to know: BIMI logos are shown by major mailbox providers including Gmail, Yahoo, Apple Mail and Fastmail. Each provider sets its own rules, and display is never guaranteed even when your setup is correct.

The following diagram illustrates the basic flow of how BIMI works to display a brand's logo in the inbox:

An email arrives, the receiver checks that it passes DMARC under a quarantine or reject policy, looks up the BIMI record, then fetches the logo and certificate. If everything checks out the logo is shown; otherwise the email is delivered without it.
How a mailbox provider decides whether to show your BIMI logo
  1. The sender publishes a BIMI record in their DNS, specifying the location of their verified logo.
  2. The sender sends an email to the recipient.
  3. The receiving mailbox provider checks that the message passes DMARC (under a quarantine or reject policy) and looks up the sender's BIMI record.
  4. If all checks pass and the provider supports BIMI, it displays the verified brand logo next to the sender's name in the inbox.

Prerequisites for Implementing BIMI

Before you can set up BIMI for your domain, there are several prerequisites you must have in place:

1. Authenticated Email with SPF, DKIM, and DMARC

Your domain must have properly configured SPF, DKIM, and DMARC records to prove ownership and prevent spoofing. Your DMARC policy must be set to quarantine or reject (with pct=100 if you use the pct tag) to be eligible for BIMI. A p=none policy does not qualify.

2. SVG Logo Meeting BIMI Guidelines

You need a square SVG logo in the SVG Tiny Portable/Secure (SVG Tiny PS) profile that BIMI requires. The logo should be clear and recognizable at small sizes, and should match the mark on your certificate if you use one.

3. Verified Mark Certificate (VMC)

A Verified Mark Certificate is a digital certificate (not a website SSL certificate) that proves your organization owns the logo, normally as a registered trademark. Gmail requires either a VMC or a Common Mark Certificate (CMC) before it shows a logo. Apple Mail's BIMI documentation refers to VMCs, so a VMC gives the widest support. Certificates are issued by authorised Mark Verifying Authorities such as DigiCert, Sectigo and GlobalSign.

Step-by-Step Guide to Setting Up BIMI

Once you have the prerequisites in place, follow these steps to set up BIMI for your domain:

Design a square SVG logo that adheres to the BIMI guidelines: save it in the SVG Tiny PS profile, include a <title> element, use a solid background, avoid scripts and external references, and keep the file small (the BIMI Group recommends 32KB or less). Check your record and logo with the BIMI Group's BIMI Inspector.

Important: Your logo must be in SVG format to be compatible with BIMI. Other image formats like PNG or JPG will not work.

Apply for a Verified Mark Certificate (or a Common Mark Certificate, if your logo is not a registered trademark and you only need Gmail support) from an authorised issuer. You'll need to provide proof of your organization's identity and, for a VMC, a registered trademark for the logo. The issuer validates this information and issues the certificate as an X.509 file in PEM format, with your SVG logo embedded in it.

Issuers include DigiCert (digicert.com/verified-mark-certificates), Sectigo and GlobalSign. Check the BIMI Group website for the current list of authorised issuers.

Host your BIMI-compliant SVG logo on a public HTTPS URL. This can be on your own web server or a third-party hosting service. Ensure the URL is publicly accessible and served over HTTPS with a valid TLS certificate.

Pro Tip: Use a content delivery network (CDN) to host your logo for faster loading times and improved availability.

Create a BIMI record for your domain and publish it in DNS. The BIMI record specifies the location of your SVG logo and the Verified Mark Certificate. It should look something like this:

default._bimi.[yourdomain.com]. IN TXT "v=BIMI1; l=https://[yourlogo.url]/logo.svg; a=https://[yourvmc.url]/vmc.pem;"

Replace [yourdomain.com], [yourlogo.url], and [yourvmc.url] with your actual domain name, logo URL, and VMC URL respectively.

Once your BIMI record is published, test and validate your setup using a BIMI checker such as the BIMI Group's BIMI Inspector. Send test emails to supported providers like Gmail to ensure your logo appears correctly in the inbox.

Note: It may take some time for your BIMI record to propagate and for email clients to start displaying your logo. Be patient and continue testing over the course of a few days.

This diagram summarizes the key steps in the BIMI setup process:

Checklist for BIMI setup: SPF and DKIM passing, DMARC at quarantine or reject, a square SVG logo, a Verified Mark Certificate, the logo hosted over HTTPS, the BIMI record published, and a test send.
What to have in place before your logo can appear

Best Practices for Effective BIMI Implementation

To get the most out of BIMI, follow these best practices:

Keep Your Logo Simple and Recognizable

Use a clean, bold design that is easily identifiable at small sizes. Avoid intricate details or text that may not be legible in the inbox.

Maintain Consistent Branding

Use the same logo across all your authenticated email channels to build brand recognition and trust with subscribers.

Monitor and Enforce Your DMARC Policy

Regularly check your DMARC reports and maintain a quarantine or reject policy to protect your domain from unauthorized use and ensure BIMI eligibility.

Keep Your Certificates Up to Date

Renew your Verified Mark Certificate (or CMC) and the TLS certificate on your logo host before they expire to avoid any disruptions in your BIMI display.

Troubleshooting Common BIMI Issues

If you encounter problems with your BIMI setup, here are some common issues and solutions:

If your logo isn't showing up in the inbox, check the following:

  • Ensure your BIMI record is formatted correctly and properly published in DNS.
  • Verify your SVG logo meets all the BIMI guidelines and is accessible at the specified URL.
  • Check that your VMC or CMC is valid, unexpired and properly hosted. Gmail will not show a logo without one.
  • Confirm your DMARC policy is set to quarantine or reject.

If your BIMI record is invalid, check for these common mistakes:

  • Missing or incorrect tag values (v=BIMI1, l=, a=)
  • Invalid or inaccessible logo URL
  • Invalid or inaccessible certificate URL
  • Syntax errors in the record format

Use the BIMI Group's generator and inspector to create and check a properly formatted record.

BIMI depends on DMARC, so most failures come back to it. Check that:

  • Your DMARC record is published at _dmarc.yourdomain.com and has a policy of quarantine or reject, not none.
  • If you use the pct tag, it is set to 100.
  • Your messages actually pass DMARC: SPF or DKIM must pass and align with the domain in the visible From address. Review your DMARC aggregate reports to find sending sources that fail.
  • The domain in your From address matches the domain where your BIMI record is published.

Conclusion

BIMI rewards domains that already have strong authentication. Get SPF, DKIM and an enforced DMARC policy working first, then add a compliant SVG logo, a certificate where your target mailbox providers require one, and a BIMI record. Once it is live, keep monitoring DMARC reports and renew your certificates on time so your logo keeps appearing.

Check your own email in a minute. Send one email to a test address and see your SPF, DKIM, DMARC and spam score.
Test your email
Was this guide helpful?

Topics: Deliverability, Authentication, Best Practices, Technical