# BIMI Requirements: DMARC, SVG Logo, VMC and CMC

URL: https://email-validation.org/guides/bimi-requirements/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

BIMI (Brand Indicators for Message Identification) lets a mailbox provider show your logo next to messages that pass
DMARC. To qualify, you need a DMARC policy at enforcement (`quarantine` at 100% or `reject`) on your domain and its
organizational domain, a logo in the SVG Tiny Portable/Secure profile, and a TXT record at `default._bimi.<domain>`.
Gmail and Apple Mail also want a mark certificate (a VMC or a CMC) that proves the logo is yours; Yahoo does not.
Meeting the requirements makes you eligible, not guaranteed: each provider decides whether to show the logo.

## The BIMI record

BIMI is defined in an IETF Internet-Draft,
[draft-brand-indicators-for-message-identification](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/)
(revision 15, October 2026). It is an individual draft, not a published standard, so details can still change.
Section 4.4 makes `default` the standard selector, so the record for `example.com` lives at
`default._bimi.example.com`:

```text
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"
```

Section 4.3 defines the tags; these are the main ones:

| Tag | Required | What it holds |
|---|---|---|
| `v=` | Yes | `BIMI1`, and it must be the first tag. Anything else makes receivers ignore the record. |
| `l=` | Yes | One HTTPS URL of the logo file. |
| `a=` | No | An HTTPS URL of the evidence document, usually the certificate's PEM file. Empty or absent means no evidence. |
| `avp=` | No | Avatar preference: `brand` (the default) or `personal`. |

A record with both `l=` and `a=` empty (`v=BIMI1; l=; a=`) is an explicit refusal to take part (section 4.3.1),
which is useful for a subdomain that should never show a logo. Google's
[Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi) page also shows a record with an
empty `l=` and only `a=` pointing to the PEM file, and it says a record that points only to an SVG file is not
supported in Gmail.

To use a selector other than `default`, the draft's section 5.1 adds a `BIMI-Selector` header to the message
(section 4.4 also describes local-part selectors, set with the `lps=` tag).
Section 5.5 says receivers should ignore that header unless the DMARC-aligned DKIM signature covers it.

Write the record with the [BIMI generator](https://email-validation.org/tools/bimi-generator/) and test what you published with the
[BIMI checker](https://email-validation.org/tools/bimi-checker/).

## DMARC at enforcement

BIMI does not authenticate anything itself. It builds on [DMARC](https://email-validation.org/glossary/#spf-dkim-dmarc): the message has to pass
DMARC, which means SPF or DKIM passes for a domain aligned with the visible From: address. The draft then asks for a
strict policy:

- **Policy.** `p=quarantine` with `pct=100`, or `p=reject` (sections 1 and 2).
- **Organizational domain and subdomains.** The enforcing policy must cover the organizational domain and its
  subdomains, and a published subdomain policy (`sp=`) must not be `none`.
- **Receiver checks.** Section 7.1 tells receivers to skip BIMI when the policy is `p=none`, when `sp=none` applies,
  or when a `quarantine` policy has a `pct` below 100.

The providers say the same in their own words. Google requires `quarantine` or `reject` with `pct` at 100 in
[Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi). Yahoo's
[BIMI page](https://senders.yahooinc.com/bimi/) asks for `quarantine` or `reject`, and the
[BIMI Group implementation guide](https://bimigroup.org/implementation-guide/) shows `p=` and `sp=` both at
`quarantine` or `reject`.

```text
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com"
```

The organizational domain is the part that catches people out. If you send from `news.example.com` with its own
`p=reject`, but `example.com` itself still has `p=none`, the logo does not qualify. To move a whole domain to
enforcement without blocking your own mail, read the reports first; see
[moving DMARC from none to reject](https://email-validation.org/guides/dmarc-none-to-reject/) and
[reading DMARC aggregate reports](https://email-validation.org/guides/dmarc-aggregate-reports/). The [DMARC checker](https://email-validation.org/tools/dmarc-checker/)
shows what your domain publishes today.

## The logo: SVG Tiny PS

Section 4.3.2 of the BIMI draft accepts only SVG (or compressed SVGZ) for the logo and leaves the finer rules to a
separate document, the SVG Tiny Portable/Secure profile,
[draft-svg-tiny-ps-abrotman](https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/) (revision 13). A normal
SVG export from a design tool almost never passes as is. The profile asks for:

- **The right root element.** `version="1.2"` and `baseProfile="tiny-ps"` on the `<svg>` element (section 2.1).
- **A title.** One non-empty `<title>`, ideally 64 characters or fewer. A `<desc>` is optional (section 2.1).
- **Nothing active or external.** No scripts, animation, links, interactivity or embedded `image` elements
  (section 2.3).
- **No `x` or `y` on the root element.** Some design tools add them by default (section 6.2).
- **A small file.** 32 KB or less uncompressed (section 2.4).

Google adds display advice: a square logo, centered, on a solid background, at least 96 pixels wide and high in
absolute units, and it recommends including a `<desc>` element.

## Mark certificates: VMC and CMC

A mark certificate is the evidence behind `a=`: a document from a Mark Verifying Authority saying it checked your
right to the logo. The BIMI draft (section 3.5) names two kinds, and the
[BIMI Group's certificate types page](https://bimigroup.org/understanding-bimi-certificate-types/) maps each to the
industry's Mark Certificate requirements:

| | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
|---|---|---|
| The logo must be | A registered trademark, or a government mark | A prior use mark (a history of use without registration), or a modified version of a registered trademark |
| Trademark needed | Yes, from an office the certificate issuers recognize | No |
| In Gmail | Logo, plus a checkmark next to the sender | Google's alternative when the logo is not trademarked; it mentions the checkmark only for VMCs |

Google warns that registering a trademark can take 6 to 12 months, so start early if you want a VMC. The
[BIMI Group FAQ](https://bimigroup.org/faqs-for-senders-esps/) adds that mark certificates have a maximum validity
of 398 days, so plan for a yearly renewal and fee, and that each mailbox provider chooses which certificate types it
accepts. A record without any certificate is called self-asserted; the BIMI Group lists Yahoo, Fastmail and La Poste
among the few providers that accept it.

## Which mailbox providers show BIMI logos

The [BIMI Group's support list](https://bimigroup.org/bimi-infographic/) includes Apple, Google, Yahoo, Comcast,
Fastmail, La Poste, Zoho Mail and several others. Microsoft does not appear on it. Three providers publish their own
rules:

| Provider | Certificate | DMARC | Other conditions |
|---|---|---|---|
| Gmail | VMC or CMC; an SVG-only record is not supported | `quarantine` or `reject`, `pct=100` | The logo can take up to 48 hours to appear after you publish |
| Yahoo | Not required; a VMC, if present, counts toward eligibility | `quarantine` or `reject` | Bulk mail only, with enough reputation and engagement; prefers BIMI and DMARC on the organizational domain |
| Apple Mail | A VMC or another evidence document, verified by the recipient's mail provider | A strong DMARC deployment (no level stated) | iOS 16, iPadOS 16, macOS Ventura 13 or later, and iCloud.com |

Apple's display depends on two parties. Its [developer page on BIMI](https://developer.apple.com/support/bimi/) says
the recipient's mail provider must be on the BIMI Group's list, be verified by Apple, check the evidence document
and add the headers that record those checks. Its
[support article](https://support.apple.com/en-us/108340) adds that if either the sender or that provider falls short,
no logo appears.

Apple also runs a separate program, [Branded Mail in Apple Business](https://support.apple.com/guide/business/abcb761b19d2/web).
There you register the brand, Apple approves the brand and logo (review can take
up to seven business days), and your mail must meet DMARC requirements and be signed with DKIM; SPF alone is not
supported. That page does not mention BIMI, so treat it as a separate route, not a replacement for the DNS record.

## Rollout steps

1. **Authenticate everything.** Make sure every service that sends as your domain passes SPF or DKIM with alignment.
   The [DKIM checker](https://email-validation.org/tools/dkim-checker/) confirms a selector is published.
2. **Reach enforcement.** Move DMARC to `quarantine` at 100% or `reject`, on the organizational domain and with
   `sp=` not `none`.
3. **Prepare the logo.** Convert it to SVG Tiny PS and validate it against the profile.
4. **Choose the evidence.** A VMC if the logo is a registered trademark, a CMC if it is not, or no certificate if
   Yahoo is your only target.
5. **Publish.** Host the SVG and PEM files on HTTPS URLs, then publish `default._bimi` with `l=` and `a=`.
6. **Check and wait.** Test the record with the [BIMI checker](https://email-validation.org/tools/bimi-checker/), then allow time for providers
   to pick it up.
7. **Maintain.** Renew the certificate before it expires, and update both files and the certificate when the logo
   changes.

## Common mistakes

- **`p=quarantine` with `pct` below 100**, or `sp=none` left over from an early DMARC rollout.
- **Enforcement on the sending subdomain only**, while the organizational domain stays at `p=none`.
- **An SVG straight from a design tool:** wrong `baseProfile`, `x` and `y` on the root, an embedded bitmap or a
  missing `<title>`.
- **Logo or certificate on a plain HTTP URL.** Section 4.3 of the draft requires HTTPS.
- **Expecting a logo on low-volume or poorly engaged mail.** Yahoo makes reputation a precondition, and every
  provider keeps the final say.

## Questions

### Does BIMI improve deliverability?

None of the provider pages cited here promise better inbox placement. BIMI is a display feature that depends on
DMARC at enforcement, and the work it requires (alignment, enforcement, a clean
[sender reputation](https://email-validation.org/glossary/#sender-reputation)) is what protects your mail. Yahoo treats reputation as a
condition for the logo, not a result of it.

### Do I need a registered trademark?

Only for a VMC. A CMC covers logos with a history of use but no registration, and Yahoo shows logos without any
certificate. For Gmail you need one of the two certificates; for the checkmark, a VMC.

### My record checks out but no logo appears. Why?

Display is each provider's decision. Gmail can take up to 48 hours, Yahoo needs enough volume and engagement, and
Apple Mail shows the logo only when the recipient's mail provider supports BIMI and verified your certificate.
Check the DMARC policy of the organizational domain too.

## Try it

Look up your current record with the [BIMI checker](https://email-validation.org/tools/bimi-checker/), and confirm your policy is at enforcement
with the [DMARC checker](https://email-validation.org/tools/dmarc-checker/). The [free email checker](https://email-validation.org/email-checker/) tests single addresses on
your list.

## Related

- [BIMI generator](https://email-validation.org/tools/bimi-generator/) and [DMARC generator](https://email-validation.org/tools/dmarc-generator/).
- [Glossary: SPF, DKIM and DMARC](https://email-validation.org/glossary/#spf-dkim-dmarc).
- [550 5.7.26](https://email-validation.org/bounce-codes/550-5-7-26/): Gmail's bounce for unauthenticated mail and DMARC failures.

## Related guides

- [Moving DMARC from p=none to p=reject](https://email-validation.org/guides/dmarc-none-to-reject/)
- [How to read DMARC aggregate reports](https://email-validation.org/guides/dmarc-aggregate-reports/)
- [Gmail and Yahoo sender requirements](https://email-validation.org/guides/gmail-yahoo-sender-requirements/)
- [DKIM selectors and key rotation](https://email-validation.org/guides/dkim-selectors-key-rotation/)
- [MTA-STS and TLS reporting explained](https://email-validation.org/guides/mta-sts-tls-rpt/)
- [All guides](https://email-validation.org/guides/)

## Sources

- [IETF: Brand Indicators for Message Identification (BIMI), draft 15](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/):
  record tags, selectors, DMARC requirements, receiver checks and certificate types.
- [IETF: SVG Tiny Portable/Secure, draft 13](https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/): the logo
  profile rules.
- [Google: Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi): Gmail's DMARC, certificate,
  logo and timing requirements.
- [Yahoo: BIMI](https://senders.yahooinc.com/bimi/): Yahoo's conditions for showing logos.
- [Apple: Prepare your email server for BIMI support in Apple Mail](https://developer.apple.com/support/bimi/):
  requirements for mail providers.
- [Apple: About BIMI support in Apple Mail](https://support.apple.com/en-us/108340): supported systems.
- [Apple: Intro to Branded Mail in Apple Business](https://support.apple.com/guide/business/abcb761b19d2/web): the
  separate Branded Mail program.
- [BIMI Group: Implementation Guide](https://bimigroup.org/implementation-guide/): rollout steps and DMARC examples.
- [BIMI Group: Understanding BIMI Certificate Types](https://bimigroup.org/understanding-bimi-certificate-types/):
  VMC and CMC mark types, self-asserted support.
- [BIMI Group: FAQs for Marketers and ESPs](https://bimigroup.org/faqs-for-senders-esps/): certificate validity and
  provider choice.
- [BIMI Group: BIMI Support by Mailbox Provider](https://bimigroup.org/bimi-infographic/): the list of supporting
  providers.

## Get up to 500 free credits. No card needed.

New accounts get 500 free credits (100 when you sign up with a free email provider such as Gmail, Outlook or Yahoo, or another personal mailbox such as a paid one like Fastmail or one from your internet provider). Try it on your own list before you buy. [Create your account](https://email-validation.org/signin/?new=1) or [open the free email checker](https://email-validation.org/email-checker/).