BIMI requirements explained
BIMI (Brand Indicators for Message Identification) lets a mailbox provider show your logo next to messages that pass DMARC. To qualify, you need a DMARC policy at enforcement (quarantine at 100% or reject) on your domain and its organizational domain, a logo in the SVG Tiny Portable/Secure profile, and a TXT record at default._bimi.<domain>. Gmail and Apple Mail also want a mark certificate (a VMC or a CMC) that proves the logo is yours; Yahoo does not. Meeting the requirements makes you eligible, not guaranteed: each provider decides whether to show the logo.
The BIMI record
BIMI is defined in an IETF Internet-Draft, draft-brand-indicators-for-message-identification (revision 15, October 2026). It is an individual draft, not a published standard, so details can still change. Section 4.4 makes default the standard selector, so the record for example.com lives at default._bimi.example.com:
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"Section 4.3 defines the tags; these are the main ones:
| Tag | Required | What it holds |
|---|---|---|
v= | Yes | BIMI1, and it must be the first tag. Anything else makes receivers ignore the record. |
l= | Yes | One HTTPS URL of the logo file. |
a= | No | An HTTPS URL of the evidence document, usually the certificate's PEM file. Empty or absent means no evidence. |
avp= | No | Avatar preference: brand (the default) or personal. |
A record with both l= and a= empty (v=BIMI1; l=; a=) is an explicit refusal to take part (section 4.3.1), which is useful for a subdomain that should never show a logo. Google's Set up BIMI page also shows a record with an empty l= and only a= pointing to the PEM file, and it says a record that points only to an SVG file is not supported in Gmail.
To use a selector other than default, the draft's section 5.1 adds a BIMI-Selector header to the message (section 4.4 also describes local-part selectors, set with the lps= tag). Section 5.5 says receivers should ignore that header unless the DMARC-aligned DKIM signature covers it.
Write the record with the BIMI generator and test what you published with the BIMI checker.
DMARC at enforcement
BIMI does not authenticate anything itself. It builds on DMARC: the message has to pass DMARC, which means SPF or DKIM passes for a domain aligned with the visible From: address. The draft then asks for a strict policy:
- Policy.
p=quarantinewithpct=100, orp=reject(sections 1 and 2). - Organizational domain and subdomains. The enforcing policy must cover the organizational domain and its subdomains, and a published subdomain policy (
sp=) must not benone. - Receiver checks. Section 7.1 tells receivers to skip BIMI when the policy is
p=none, whensp=noneapplies, or when aquarantinepolicy has apctbelow 100.
The providers say the same in their own words. Google requires quarantine or reject with pct at 100 in Set up BIMI. Yahoo's BIMI page asks for quarantine or reject, and the BIMI Group implementation guide shows p= and sp= both at quarantine or reject.
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com"The organizational domain is the part that catches people out. If you send from news.example.com with its own p=reject, but example.com itself still has p=none, the logo does not qualify. To move a whole domain to enforcement without blocking your own mail, read the reports first; see moving DMARC from none to reject and reading DMARC aggregate reports. The DMARC checker shows what your domain publishes today.
The logo: SVG Tiny PS
Section 4.3.2 of the BIMI draft accepts only SVG (or compressed SVGZ) for the logo and leaves the finer rules to a separate document, the SVG Tiny Portable/Secure profile, draft-svg-tiny-ps-abrotman (revision 13). A normal SVG export from a design tool almost never passes as is. The profile asks for:
- The right root element.
version="1.2"andbaseProfile="tiny-ps"on the<svg>element (section 2.1). - A title. One non-empty
<title>, ideally 64 characters or fewer. A<desc>is optional (section 2.1). - Nothing active or external. No scripts, animation, links, interactivity or embedded
imageelements (section 2.3). - No
xoryon the root element. Some design tools add them by default (section 6.2). - A small file. 32 KB or less uncompressed (section 2.4).
Google adds display advice: a square logo, centered, on a solid background, at least 96 pixels wide and high in absolute units, and it recommends including a <desc> element.
Mark certificates: VMC and CMC
A mark certificate is the evidence behind a=: a document from a Mark Verifying Authority saying it checked your right to the logo. The BIMI draft (section 3.5) names two kinds, and the BIMI Group's certificate types page maps each to the industry's Mark Certificate requirements:
| Item | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
|---|---|---|
| The logo must be | A registered trademark, or a government mark | A prior use mark (a history of use without registration), or a modified version of a registered trademark |
| Trademark needed | Yes, from an office the certificate issuers recognize | No |
| In Gmail | Logo, plus a checkmark next to the sender | Google's alternative when the logo is not trademarked; it mentions the checkmark only for VMCs |
Google warns that registering a trademark can take 6 to 12 months, so start early if you want a VMC. The BIMI Group FAQ adds that mark certificates have a maximum validity of 398 days, so plan for a yearly renewal and fee, and that each mailbox provider chooses which certificate types it accepts. A record without any certificate is called self-asserted; the BIMI Group lists Yahoo, Fastmail and La Poste among the few providers that accept it.
Which mailbox providers show BIMI logos
The BIMI Group's support list includes Apple, Google, Yahoo, Comcast, Fastmail, La Poste, Zoho Mail and several others. Microsoft does not appear on it. Three providers publish their own rules:
| Provider | Certificate | DMARC | Other conditions |
|---|---|---|---|
| Gmail | VMC or CMC; an SVG-only record is not supported | quarantine or reject, pct=100 | The logo can take up to 48 hours to appear after you publish |
| Yahoo | Not required; a VMC, if present, counts toward eligibility | quarantine or reject | Bulk mail only, with enough reputation and engagement; prefers BIMI and DMARC on the organizational domain |
| Apple Mail | A VMC or another evidence document, verified by the recipient's mail provider | A strong DMARC deployment (no level stated) | iOS 16, iPadOS 16, macOS Ventura 13 or later, and iCloud.com |
Apple's display depends on two parties. Its developer page on BIMI says the recipient's mail provider must be on the BIMI Group's list, be verified by Apple, check the evidence document and add the headers that record those checks. Its support article adds that if either the sender or that provider falls short, no logo appears.
Apple also runs a separate program, Branded Mail in Apple Business. There you register the brand, Apple approves the brand and logo (review can take up to seven business days), and your mail must meet DMARC requirements and be signed with DKIM; SPF alone is not supported. That page does not mention BIMI, so treat it as a separate route, not a replacement for the DNS record.
Rollout steps
- Authenticate everything. Make sure every service that sends as your domain passes SPF or DKIM with alignment. The DKIM checker confirms a selector is published.
- Reach enforcement. Move DMARC to
quarantineat 100% orreject, on the organizational domain and withsp=notnone. - Prepare the logo. Convert it to SVG Tiny PS and validate it against the profile.
- Choose the evidence. A VMC if the logo is a registered trademark, a CMC if it is not, or no certificate if Yahoo is your only target.
- Publish. Host the SVG and PEM files on HTTPS URLs, then publish
default._bimiwithl=anda=. - Check and wait. Test the record with the BIMI checker, then allow time for providers to pick it up.
- Maintain. Renew the certificate before it expires, and update both files and the certificate when the logo changes.
Common mistakes
p=quarantinewithpctbelow 100, orsp=noneleft over from an early DMARC rollout.- Enforcement on the sending subdomain only, while the organizational domain stays at
p=none. - An SVG straight from a design tool: wrong
baseProfile,xandyon the root, an embedded bitmap or a missing<title>. - Logo or certificate on a plain HTTP URL. Section 4.3 of the draft requires HTTPS.
- Expecting a logo on low-volume or poorly engaged mail. Yahoo makes reputation a precondition, and every provider keeps the final say.
Questions
Does BIMI improve deliverability?
None of the provider pages cited here promise better inbox placement. BIMI is a display feature that depends on DMARC at enforcement, and the work it requires (alignment, enforcement, a clean sender reputation) is what protects your mail. Yahoo treats reputation as a condition for the logo, not a result of it.
Do I need a registered trademark?
Only for a VMC. A CMC covers logos with a history of use but no registration, and Yahoo shows logos without any certificate. For Gmail you need one of the two certificates; for the checkmark, a VMC.
My record checks out but no logo appears. Why?
Display is each provider's decision. Gmail can take up to 48 hours, Yahoo needs enough volume and engagement, and Apple Mail shows the logo only when the recipient's mail provider supports BIMI and verified your certificate. Check the DMARC policy of the organizational domain too.
Try it
Look up your current record with the BIMI checker, and confirm your policy is at enforcement with the DMARC checker. The free email checker tests single addresses on your list.
Related
- BIMI generator and DMARC generator.
- Glossary: SPF, DKIM and DMARC.
- 550 5.7.26: Gmail's bounce for unauthenticated mail and DMARC failures.
Related guides
- Moving DMARC from p=none to p=reject
- How to read DMARC aggregate reports
- Gmail and Yahoo sender requirements
- DKIM selectors and key rotation
- MTA-STS and TLS reporting explained
- All guides
Sources
- IETF: Brand Indicators for Message Identification (BIMI), draft 15: record tags, selectors, DMARC requirements, receiver checks and certificate types.
- IETF: SVG Tiny Portable/Secure, draft 13: the logo profile rules.
- Google: Set up BIMI: Gmail's DMARC, certificate, logo and timing requirements.
- Yahoo: BIMI: Yahoo's conditions for showing logos.
- Apple: Prepare your email server for BIMI support in Apple Mail: requirements for mail providers.
- Apple: About BIMI support in Apple Mail: supported systems.
- Apple: Intro to Branded Mail in Apple Business: the separate Branded Mail program.
- BIMI Group: Implementation Guide: rollout steps and DMARC examples.
- BIMI Group: Understanding BIMI Certificate Types: VMC and CMC mark types, self-asserted support.
- BIMI Group: FAQs for Marketers and ESPs: certificate validity and provider choice.
- BIMI Group: BIMI Support by Mailbox Provider: the list of supporting providers.
How we wrote this: drafted by the email-validation.org team with the help of AI writing tools, from our product documentation and the sources linked in the text.