What Is BIMI? Record Setup & DNS Examples [2026]

What Is BIMI (Brand Indicators for Message Identification)?

BIMI (Brand Indicators for Message Identification) is an email protocol that lets you display your brand’s logo next to your emails in the recipient’s inbox. Instead of seeing a generic avatar, initials, or blank space, recipients see your verified brand logo.

BIMI email builds trust and brand recognition. When a recipient sees your logo consistently appear in their inbox, they can quickly identify legitimate emails from your organization and differentiate them from phishing attempts.

BIMI works by publishing a DNS record that points email providers to your logo. When a supporting email client receives mail from your domain, it checks your BIMI record, retrieves the logo, and displays it alongside the email.

BIMI is specified in an individual IETF Internet-Draft, draft-brand-indicators-for-message-identification-15, not an RFC. The AuthIndicators Working Group, an industry coalition of email providers, certificate authorities, and email security vendors, develops it and the mark certificate guidelines.

What Is a BIMI Record?

A BIMI record is a DNS TXT record published at default._bimi.yourdomain.com that tells email providers where to find your brand logo and optional Verified Mark Certificate.

The record contains three key tags:

• v=BIMI1 — the version tag (currently BIMI1)
• l= — the URL where your logo is hosted (must be HTTPS)
• a= — the URL to your Verified Mark Certificate or Common Mark Certificate (optional in the spec, but Gmail needs one)

Unlike SPF or DKIM records, the BIMI record does not perform authentication. It is purely informational. Email providers only display your logo if your domain passes DMARC authentication first.

How BIMI Works in Email

BIMI follows a strict prerequisite chain. Here is how the process works step by step:

1. Your domain must pass DMARC authentication with p=quarantine or p=reject (not p=none)
2. The receiving email provider checks your BIMI DNS record at default._bimi.yourdomain.com
3. If found, the provider retrieves the logo file from the URL in the l= tag
4. The provider validates the logo format (must be SVG Tiny 1.2 Portable/Secure profile)
5. If the provider requires a mark certificate, it validates the certificate from the a= tag
6. If all checks pass, the email client displays your logo in the inbox

If any step fails, the logo will not display. The email still delivers normally; BIMI only affects visual presentation.

BIMI does not work without DMARC enforcement. You cannot skip to p=quarantine or p=reject just for BIMI. Your domain must genuinely enforce DMARC policies to protect recipients from spoofing.

What Is a Verified Mark Certificate (VMC)?

A Verified Mark Certificate (VMC) is a digital certificate that proves you own the trademark for your logo. It is issued by Mark Verifying Authorities (MVAs): the BIMI Group’s issuer list names DigiCert, GlobalSign, and SSL.com. Other certificate authorities and resellers, such as Sectigo, also sell VMCs and CMCs.

Entrust previously issued VMCs, but VMCs issued from Entrust roots after November 15, 2024 are not trusted by Apple. If your domain still uses an Entrust-issued VMC, replace it with one from an MVA on the BIMI Group’s current list.

VMCs are priced per year and need a registered trademark. They require:

• A registered trademark for your logo (filed with a national trademark office)
• Proof of domain control
• DMARC enforcement at p=quarantine or p=reject
• A valid SVG logo that meets BIMI specifications

While the BIMI specification makes certificates optional, Gmail requires a VMC or a Common Mark Certificate (CMC), and for Apple Mail you should plan on a VMC. Without a certificate, Gmail will not display your logo even if your BIMI record is perfectly configured.

Yahoo Mail and Fastmail support BIMI without requiring a certificate. If your primary recipients use these providers, you can display your logo without purchasing one.

For organizations with many Gmail or Apple Mail users, a certificate is effectively mandatory for BIMI to function.

Common Mark Certificates (CMC)

A Common Mark Certificate (CMC) is the alternative for a logo that is not a registered trademark. Gmail accepts it in place of a VMC, though Google’s BIMI help recommends a VMC where you can get one. In Gmail the blue checkmark appears only for senders verified with a VMC, so a CMC shows your logo without it. For Apple Mail, plan on a VMC, not a CMC.

BIMI DNS Record Format

A BIMI DNS record follows this format:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

The record is published as a TXT record at default._bimi.yourdomain.com. The subdomain selector default is the standard, though the BIMI spec technically allows custom selectors.

Tag Breakdown

DNS Record Details

• Record type: TXT
• Hostname: default._bimi.yourdomain.com
• TTL: 3600 (1 hour) is standard, though you can use shorter TTLs during testing
• Value: The full BIMI record string

If you send email from subdomains (e.g., news.yourdomain.com), you can publish a separate BIMI record for each one, but you don’t have to. If a subdomain has none, receivers fall back to the record at the organizational domain for the same selector (BIMI draft section 7.2). Publish a subdomain record only when that subdomain needs a different logo or certificate.

How to Set Up BIMI

Setting up BIMI requires completing prerequisites before publishing your DNS record. For the VMC-vs-CMC decision and a troubleshooting table, follow the step-by-step BIMI setup walkthrough (and why 28% of records break).

Step 1: Enforce DMARC

You must have DMARC configured at p=quarantine or p=reject. BIMI will not work with p=none.

This means your domain must also have working SPF and DKIM records, since DMARC relies on both.

If you are currently at p=none, you need to monitor your DMARC reports, identify legitimate sending sources, and ensure they pass SPF or DKIM alignment before moving to enforcement.

Step 2: Prepare Your Logo

Your logo must be in SVG Tiny 1.2 Portable/Secure (PS) profile format. This is not standard SVG. Most logo files need to be converted and simplified.

Requirements:

• Format: SVG Tiny 1.2 PS (not SVG 1.1 or SVG 2.0)
• Aspect ratio: Square (1:1)
• Background: Solid color (transparency is not allowed)
• File size: 32 KB or smaller (recommended maximum)
• No embedded images, JavaScript, or external references

The SVG Tiny PS profile is highly restrictive. It disallows filters, gradients, animations, and many advanced SVG features. Most logos require significant rework to meet the spec.

Step 3: Obtain a Verified Mark Certificate (if needed)

If your recipients primarily use Gmail or Apple Mail, you need a mark certificate: Gmail accepts a VMC or a CMC, and for Apple Mail you should plan on a VMC.

The VMC application process:

1. Register your logo as a trademark (US, EU, or other recognized jurisdiction); a CMC does not need one
2. Contact a Mark Verifying Authority (DigiCert, GlobalSign, and SSL.com) or a reseller to start the application
3. Provide proof of trademark registration and domain ownership
4. Submit your SVG logo for validation
5. Wait for certificate issuance (typically 2-4 weeks)
6. Download the PEM-encoded certificate file

VMCs are valid for one year. You must renew annually and maintain your trademark registration.

Step 4: Host Your Logo and VMC

Upload your SVG logo and VMC certificate to a publicly accessible HTTPS URL. The server must:

• Support HTTPS (TLS 1.2 or higher)
• Respond with correct MIME types (image/svg+xml for logo, application/x-pem-file for VMC)
• Allow access from email provider IP ranges (do not block user agents)

Common hosting locations:

• https://yourdomain.com/bimi/logo.svg
• https://yourdomain.com/bimi/vmc.pem

Some organizations use CDNs for logo hosting. Ensure the CDN does not add caching headers that interfere with email provider retrieval.

Step 5: Publish Your BIMI DNS Record

Add a TXT record at default._bimi.yourdomain.com with your BIMI record:

v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem

Wait for DNS propagation (typically 15 minutes to 1 hour depending on your TTL).

Step 6: Test and Validate

Send test emails to Gmail, Apple Mail, Yahoo, and other supporting providers. Check if your logo appears.

Use a BIMI checker to verify your record for syntax errors, logo format issues, and VMC problems.

Note that it can take 24-48 hours for email providers to cache your logo after first publication. Be patient during initial testing.

How to Generate a BIMI Record

A BIMI record generator tool simplifies the process of creating a correctly formatted DNS record.

To generate your record:

1. Enter your domain name
2. Provide the HTTPS URL to your SVG logo
3. Optionally provide the HTTPS URL to your VMC or CMC (if you have one)
4. The tool outputs a formatted BIMI DNS record

Use the BIMI record generator to create a correctly formatted record for your domain.

Generators validate the format but cannot check if your logo meets SVG Tiny PS requirements or if your VMC is valid. You still need to test those separately.

BIMI Record Examples

Here are real-world BIMI record examples for different configurations.

Example 1: BIMI with VMC (Gmail-compatible)

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

This record points to both a logo and a Verified Mark Certificate. It will work with Gmail, Apple Mail, Yahoo, and Fastmail.

Example 2: BIMI without VMC (Yahoo/Fastmail only)

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg"

This record omits the a= tag. It will work with Yahoo and Fastmail. Gmail needs a mark certificate, and for Apple Mail you should plan on a VMC.

Example 3: BIMI for subdomain

default._bimi.news.example.com. IN TXT "v=BIMI1; l=https://news.example.com/bimi/logo.svg; a=https://news.example.com/bimi/vmc.pem"

Subdomains can have their own BIMI record. Without one, receivers fall back to default._bimi.example.com at the organizational domain (BIMI draft section 7.2), so this record is only needed when news.example.com should show a different logo or certificate.

Example 4: Using a CDN for logo hosting

default._bimi.example.com. IN TXT "v=BIMI1; l=https://cdn.example.com/assets/bimi-logo.svg; a=https://cdn.example.com/assets/vmc.pem"

You can host your logo on a CDN as long as the URL is HTTPS and publicly accessible.

BIMI and DMARC

BIMI only works if your domain passes DMARC authentication at enforcement policy. This is the most common reason BIMI fails.

DMARC Prerequisites

Your DMARC record must specify:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

or

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

The policy (p=) must be quarantine or reject. BIMI will not work with p=none, even if your BIMI record is perfect. For every condition the policy must meet — including the pct and sp= tags — and how to read a bimi=skipped header, see BIMI DMARC requirements.

Why This Requirement Exists

BIMI is designed to reward domains that enforce strong email authentication. Email providers do not want to display logos for domains that allow spoofing.

If your domain is at p=none, you need to:

1. Review your DMARC aggregate reports to identify all legitimate email sources
2. Ensure those sources pass SPF or DKIM alignment
3. Move to p=quarantine for a monitoring period (30-90 days)
4. Finally move to p=reject once you are confident in your configuration

Only after reaching enforcement can you implement BIMI. There is no shortcut.

Which Email Clients Support BIMI?

BIMI adoption is growing but not universal. Here is the current support matrix.

Gmail BIMI Support

Gmail is the largest email provider supporting BIMI. It displays logos for both personal Gmail accounts and Google Workspace users.

Gmail requires a VMC or CMC and DMARC enforcement. Logo display typically takes 24-48 hours after initial BIMI record publication while Gmail caches your logo.

Apple Mail BIMI Support

Apple Mail supports BIMI on iOS 16, iPadOS 16, macOS Ventura 13 or later, and iCloud.com (see Apple Support). Apple’s page says BIMI includes using DMARC and names VMCs among the BIMI Evidence Documents it works with, but it states no certificate requirement and does not mention CMCs. The enforcement bar comes from the BIMI draft (section 7.1), so plan on enforcement and on a VMC.

Yahoo and AOL BIMI Support

Yahoo Mail (including Yahoo-hosted domains) and AOL Mail support BIMI without requiring a certificate. This makes them the easiest platforms for BIMI testing.

If you have not yet obtained a VMC, you can still display your logo to Yahoo and AOL users by publishing a BIMI record with just the l= tag.

Microsoft Outlook and Exchange Online

Microsoft has announced no BIMI support and no date. BIMI does not work in Outlook.com, Outlook desktop clients, or Microsoft 365 mailboxes.

BIMI Logo Requirements

BIMI logos have strict technical requirements. Most standard logos do not meet the spec and need conversion.

Format: SVG Tiny 1.2 Portable/Secure Profile

Your logo must be SVG Tiny 1.2 PS (Portable/Secure) profile. This is a restrictive subset of SVG designed for email security.

Allowed elements:

• Basic shapes: <rect>, <circle>, <ellipse>, <line>, <polyline>, <polygon>, <path>
• Text: <text>, <tspan>
• Grouping: <g>, <defs>, <use>
• Basic styling: fill, stroke, stroke-width, opacity

Disallowed elements:

• Embedded images (<image>)
• External references (linked CSS, fonts, images)
• Animations (<animate>, <animateTransform>)
• Filters, gradients (limited support)
• JavaScript or event handlers
• Foreign objects

Most logo files need significant simplification to meet this spec. Hire a designer familiar with SVG Tiny PS or use conversion tools that understand the profile restrictions.

Aspect Ratio: Square

Your logo must be square (1:1 aspect ratio). Non-square logos will be rejected or cropped by email providers.

The viewBox attribute should be something like viewBox="0 0 100 100" with equal width and height.

If your logo is naturally rectangular, you need to add padding or redesign it to fit a square canvas.

Background: Solid Color

BIMI logos cannot have transparent backgrounds. You must fill the background with a solid color.

Most brands choose white or their primary brand color. The background color should ensure good contrast with the logo foreground.

File Size

The core BIMI draft sets no hard limit: it points to recommended maximum sizes and lets receivers decline larger logos (section 7.6). Google’s help says the SVG should be 32 KB or smaller, so treat 32 KB as the recommended maximum and keep your SVG under it.

SVG Tiny PS files are typically small since they exclude complex features. If your file exceeds 32 KB, simplify paths or reduce the number of elements.

Validation

Use SVG Tiny PS validators to check your logo before publishing. Common validators include:

• DMARCguard’s BIMI logo validator
• BIMI Group’s official validator
• DigiCert’s BIMI logo inspector
• Third-party BIMI validation tools

These tools catch common issues like embedded images, external references, non-square aspect ratios, and transparency.

How Much Does BIMI Cost?

BIMI itself is free. Publishing a BIMI DNS record costs nothing beyond your standard DNS hosting.

However, Verified Mark Certificates (VMCs) are not free.

VMC Costs

VMCs are priced per year. DigiCert’s 12-month list price for a VMC is $1,416. Sectigo, a seller that is not on the BIMI Group’s MVA list, advertises VMCs from $1,350 per year on a multi-year subscription. A CMC, which Gmail also accepts, is advertised from $990 a year at Sectigo. Other issuers, such as GlobalSign and SSL.com, set their own prices.

VMCs are valid for one year. You must renew annually to continue displaying your logo in Gmail and Apple Mail.

Trademark Costs

To obtain a VMC, you need a registered trademark for your logo.

Trademark filing fees vary by jurisdiction:

• US trademark (USPTO): $250-$350 per class
• EU trademark (EUIPO): €850 per trademark
• UK trademark (UKIPO): £170 per class

Trademark registration typically takes 6-12 months. Budget for legal fees if you use a trademark attorney to file.

Logo Design and Conversion

If your existing logo does not meet SVG Tiny PS requirements, you may need to hire a designer to create a BIMI-compliant version; ask for a quote, since the cost depends on how complex the logo is. For a free starting point, Red Sift’s BIMI Maker prepares a BIMI SVG from your logo.

Total First-Year Cost

For a typical organization deploying BIMI with a VMC:

• Trademark filing: $250-$850
• VMC certificate: $1,416 per year at DigiCert’s list price

Add the two together, plus any logo conversion quote, for your first-year budget. Later years cost only the VMC renewal.

Free BIMI (Without VMC)

If your recipients primarily use Yahoo or Fastmail, you can implement BIMI without a certificate at zero cost. This option works for organizations that do not need Gmail or Apple Mail logo display.

Troubleshooting: BIMI Record Not Found

If your BIMI logo is not displaying, the most common issue is a missing or incorrectly formatted DNS record.

Check DNS Propagation

Use a DNS lookup tool to query default._bimi.yourdomain.com TXT record. Verify the record exists and matches your intended format.

Common DNS issues:

• Record published at wrong subdomain (e.g., _bimi.yourdomain.com instead of default._bimi.yourdomain.com)
• Typo in record value (missing semicolon, incorrect tag name)
• DNS not propagated yet (wait 1 hour after publication)

Verify DMARC Enforcement

BIMI requires DMARC p=quarantine or p=reject. Check your DMARC record at _dmarc.yourdomain.com and confirm the policy is not p=none.

If your DMARC record shows p=none, BIMI will not work even if everything else is correct.

Validate Logo Format

Use a BIMI validator to check your SVG logo. Common logo issues:

• Not SVG Tiny 1.2 PS profile
• Non-square aspect ratio
• Transparent background (must be solid color)
• Embedded images or external references
• File size exceeds email provider limits

Check VMC Certificate

If you have a VMC or CMC, verify the PEM file is accessible at the URL in your a= tag. The certificate must:

• Be issued by a Mark Verifying Authority the mailbox provider trusts (the BIMI Group lists DigiCert, GlobalSign, and SSL.com)
• Match the logo in the l= tag
• Not be expired
• Be served over HTTPS with correct MIME type

Wait for Cache

Email providers cache BIMI logos. After making changes, it can take 24-48 hours for updates to appear in recipient inboxes.

During testing, send emails to multiple accounts and check each provider separately. Gmail, Apple Mail, Yahoo, and Fastmail may have different cache timings.

Common Error: “BIMI record not found or configured without default selector”

This error means the email provider found a BIMI record at a non-default selector or could not find a record at the default selector.

Fix: Ensure your record is published at default._bimi.yourdomain.com, not at _bimi.yourdomain.com or a custom selector.

Frequently Asked Questions

What is a BIMI record?

A BIMI record is a DNS TXT record at default._bimi.yourdomain.com that tells email providers where to find your brand logo. It contains version (v=BIMI1), logo URL (l=), and optionally a Verified Mark Certificate URL (a=).

How do I generate a BIMI record?

Generate a BIMI record by creating a DNS TXT record with the format v=BIMI1; l=https://yourdomain.com/logo.svg. Your logo must be SVG Tiny 1.2 Portable/Secure profile. Use a BIMI record generator tool to validate the format before publishing.

What does a BIMI record look like?

A BIMI record looks like: v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem. The v= tag specifies version, l= points to your logo, and a= points to your Verified Mark Certificate or Common Mark Certificate (optional in the spec, but Gmail needs one).

Does Gmail use BIMI?

Yes. Gmail supports BIMI but requires a mark certificate (a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC)) to display logos; only a VMC adds the blue checkmark. You must also have DMARC enforcement at p=quarantine or p=reject. Without a VMC or CMC, Gmail will not show your logo even if your BIMI record is correct.

Is BIMI free?

BIMI itself is free to implement. You can publish a BIMI record at no cost. However, the mark certificate Gmail requires (a VMC or a CMC) is a paid annual certificate from a certificate authority, and for Apple Mail you should plan on a VMC. Yahoo and Fastmail need no certificate.

Does Apple Mail use BIMI?

Yes, on iOS 16, iPadOS 16, macOS Ventura 13 or later, and iCloud.com. Apple’s documentation names Verified Mark Certificates (VMCs) and other BIMI Evidence Documents but states no certificate requirement, so plan on a VMC. Per the BIMI draft, you must have DMARC enforcement (p=quarantine or p=reject) as a prerequisite.

What is a Verified Mark Certificate (VMC)?

A VMC is a digital certificate that proves you own the trademark for your logo. It is issued by Mark Verifying Authorities such as DigiCert, GlobalSign and SSL.com. Gmail accepts a VMC or a Common Mark Certificate (CMC) and shows the blue checkmark only for a VMC; plan on a VMC for Apple Mail; Yahoo and Fastmail need no certificate.

Related Protocols

• DMARC — BIMI requires DMARC enforcement at p=quarantine or p=reject as a mandatory prerequisite
• SPF — Must pass for DMARC alignment, which BIMI depends on
• DKIM — Must pass for DMARC alignment, which BIMI depends on