/ Glossary — Authentication
What is BIMI?
Brand Indicators for Message Identification — the record that puts your verified logo beside your messages in supporting inboxes. The visible reward for completing DMARC. Here's how it works.
/ Definition
BIMI, or Brand Indicators for Message Identification, is a DNS record that lets your verified logo appear beside your messages in supporting inboxes. When a provider receives a message that passed authentication under an enforced policy, it reads your BIMI record, fetches your logo, and displays it next to your name — a visible trust signal that the message is provably from you.
The catch is the prerequisite: BIMI does nothing until your domain has DMARC at an enforced policy of quarantine or reject. It also needs a logo in a specific SVG profile and, for the verified checkmark in Gmail and Apple Mail, a certificate. Senders with BIMI report open-rate lifts of up to 39%. Check your BIMI readiness with our BIMI generator.
/ In practice
How BIMI works
BIMI is published as a TXT record at default._bimi.yourdomain.com with two main tags: l= points to your logo, and a= points to your certificate. When a supporting provider receives an authenticated, aligned message, it confirms DMARC enforcement, reads the record, validates the certificate if present, and displays the logo. Because the logo only shows when the full authentication chain holds, a displayed BIMI logo is meaningful — it can't be faked without controlling your authenticated domain.
VMC, CMC, and the logo
Two things outside DNS make BIMI work. The logo must be in the SVG Tiny PS profile — square, solid-background, no scripts or animation — which a normal design-tool export almost never satisfies without conversion. The certificate comes in two forms: a Verified Mark Certificate (VMC, roughly $1,500/year, requires a registered trademark) unlocks Gmail, Yahoo, and Apple Mail, while a Common Mark Certificate (CMC) needs no trademark but currently centers on Gmail. The honest framing is that BIMI is the reward for the DMARC work you should do anyway.
/ The logo and where it shows
Getting the SVG Tiny PS logo right
The logo requirement trips up more BIMI deployments than anything except the DMARC prerequisite. BIMI requires the SVG Tiny Portable/Secure profile — a deliberately restricted form of SVG that must be square, have a solid background rather than transparency, include a title element, and exclude scripts, external references, and animation. These constraints exist for security and consistent rendering, but they mean a logo exported from a typical design tool almost never conforms without conversion. A logo that doesn't meet the profile simply won't display, even with a perfect record and certificate, so validating the file is a necessary step our BIMI generator helps with.
Where BIMI displays today
BIMI support has grown but isn't universal, and where your logo appears depends on the certificate you hold. Gmail displays BIMI logos and shows a verified checkmark for senders with a valid certificate. Apple Mail supports BIMI with a certificate on recent versions. Yahoo and several other providers display BIMI logos as well. The pattern is that the logo plus a Verified Mark Certificate gives the widest, checkmark-bearing reach, while some providers will show a logo from the record alone. Because support and requirements shift, the durable takeaway is that BIMI rewards the senders who have completed DMARC enforcement and maintain it — the logo follows the authentication work. The practical sequence is therefore fixed: reach enforced DMARC, convert and host a conforming logo, obtain the certificate that matches your reach goals, and only then publish the BIMI record — doing them out of order just means publishing a record that sits inert until the prerequisites catch up. Treating the order as fixed saves the frustration of a published record that does nothing because a prerequisite further up the chain hasn't been met yet.
The logo is the reward. Enforced DMARC is the work.
BIMI pays off only after your domain reaches enforced DMARC with every source aligned. We get you there cleanly, then help you light up the logo. Bring us your domain.
Book infrastructure reviewRelated capabilities