What Is BIMI and Why It Matters for Email Trust

Do not index

BIMI is a mailbox-side trust signal that displays a sender's verified brand logo next to authenticated email, but only after the sender enforces DMARC and publishes a compliant BIMI DNS record. The standard emerged formally in 2019, and BIMI DNS records grew from 7,562 domains in May 2024 to 9,661 in January 2025, a 28% increase according to data cited by Google's BIMI guidance.

A security lead may see phishing messages spoofing the company domain while the marketing team sees ordinary sender avatars and flat engagement. SPF, DKIM, and DMARC can authenticate legitimate mail behind the scenes, but recipients usually don't see those checks. BIMI makes the result visible by allowing participating mailbox providers to fetch and display a brand logo beside authenticated messages.

That visibility matters, but BIMI isn't a magic deliverability switch. It won't repair poor list hygiene, weak sender reputation, spam complaints, or misaligned authentication. It adds a recognizable identity signal after the receiving mailbox has already validated the sender.

Table of Contents

What Is BIMI in Email and Why It Exists How BIMI Works Inside the Authentication Stack BIMI Prerequisites You Need Before a Logo Renders DMARC must enforce authentication The logo must use the right SVG profile DNS must point to the approved asset Certificate selection changes the outcome Mailbox Provider Support and the VMC Question Implementing BIMI From DMARC to DNS Publication Confirm SPF and DKIM alignment Enforce DMARC before publishing the logo Prepare the asset and publish BIMI Business Benefits of BIMI for Inbox Trust and Engagement Common Mistakes and the Operational Fragility of BIMI DMARC drift silently removes eligibility Certificates and providers can change SVG files fail more often than teams expect BIMI Checklist and Next Steps for Senders

What Is BIMI in Email and Why It Exists

BIMI, or Brand Indicators for Message Identification, is an email specification that connects authenticated email with a sender's approved brand logo. After the receiving mailbox validates the required authentication conditions, it can retrieve the sender's SVG logo and render it beside the From name or sender identity.

The standard was developed through the BIMI Working Group and emerged as a formal email standard in 2019. Its first Internet draft appeared in October 2021, reflecting a shift from invisible authentication alone toward visible identity in the inbox. The BIMI specification background describes that relationship between DMARC-based authentication and brand logo display.

The important distinction is operational:

SPF, DKIM, and DMARC help the mailbox decide whether a message is authenticated and aligned.

BIMI gives the mailbox a verified visual identity to display after those checks succeed.

The logo isn't proof by itself. A visible mark depends on the authenticated domain, the BIMI DNS record, the logo format, and provider-specific rules.

This creates a useful trust boundary. A spoofed message may imitate a company's name, colors, or writing style, but it won't normally qualify to display the legitimate BIMI logo unless the receiving system accepts its authentication and identity evidence.

BIMI therefore belongs at the end of the authentication chain, not at the start of a branding project. A sender that publishes a logo before enforcing DMARC has skipped the prerequisite that makes the logo meaningful. If the authentication foundation fails, the inbox won't render the brand indicator, and the sender remains exposed to impersonation and inconsistent inbox placement.

How BIMI Works Inside the Authentication Stack

BIMI has four connected layers. Each one acts as a gate.

SPF checks the sending infrastructure. The domain owner publishes which sending systems are authorized to send mail for the domain. The receiving mailbox compares the connecting sender with that policy.

DKIM adds a cryptographic signature. The sending system signs selected headers and message content, while the receiving mailbox retrieves the public key from DNS and verifies that the signature is valid. A failed or missing signature weakens the authentication chain and can break DMARC alignment.

DMARC applies policy and alignment. DMARC evaluates whether SPF or DKIM passes in alignment with the visible From domain. It also tells the receiving mailbox how to handle messages that fail, using a policy such as monitoring, quarantine, or rejection.

BIMI supplies the visual identity. BIMI normally requires an enforcement-level DMARC policy, meaning p=quarantine or p=reject, generally applied at full policy coverage. Once the message passes the required checks, the receiver queries default._bimi.example.com for the BIMI TXT record.

The receiver can then retrieve the logo from the HTTPS location in that record. The artwork must use the required SVG Tiny Portable/Secure format. Where the mailbox provider requires certificate-backed verification, the receiver also validates the certificate before rendering the logo.

The process is easier to understand alongside a broader Ecommerce Boost deliverability guide covering the relationship between SPF, DKIM, and DMARC. For teams that need the complete foundation, how email authentication works provides the relevant protocol context.

A simplified message path looks like this:

The sender transmits a message using an authorized system.

The receiving mailbox checks SPF and DKIM.

DMARC evaluates authentication and domain alignment.

The mailbox retrieves the BIMI record.

The mailbox validates the logo and certificate requirements.

The provider displays the logo if its own policy permits rendering.

If any gate fails, the logo may disappear even when the email still reaches the inbox. That outcome doesn't necessarily mean BIMI is broken. It usually means the receiver found a problem with alignment, policy enforcement, certificate eligibility, DNS visibility, logo syntax, or provider support.

BIMI Prerequisites You Need Before a Logo Renders

BIMI requires more than a logo file and a TXT record. Four conditions determine whether a mailbox can render the mark.

DMARC must enforce authentication

The sending domain needs DMARC at p=quarantine or p=reject, with SPF or DKIM passing in alignment with the visible From domain. A policy that only monitors with p=none doesn't meet the enforcement requirement used for BIMI eligibility.

Subdomain handling matters too. A parent-domain policy might not produce the expected result for a separate sending subdomain, especially when that subdomain publishes its own DMARC policy or uses different sending systems.

The logo must use the right SVG profile

The brand mark must be an SVG Tiny Portable/Secure file. It should be hosted over HTTPS and served with an appropriate SVG content type. Unsupported scripts, external references, and incompatible design elements can prevent validation.

The BIMI Group's VMC requirements also connect the certificate workflow with a registered trademark in a supported jurisdiction. A standard marketing logo exported from design software isn't automatically compliant.

DNS must point to the approved asset

The sender publishes a TXT record at:

default._bimi.example.com

A typical record uses this structure:

v=BIMI1; l=https://brand.example.com/logo.svg; a=https://brand.example.com/certificate.pem

The l= value points to the SVG logo. The a= value points to certificate evidence when the provider and certificate workflow require it. Self-asserted deployments may omit the certificate location, but that doesn't guarantee broad mailbox rendering.

Certificate selection changes the outcome

A Verified Mark Certificate, or VMC, binds the logo to a registered trademark and is generally required by Gmail for BIMI rendering. A Common Mark Certificate, or CMC, can support some brands without the same trademark path, but provider support and visible trust features are narrower.

Prerequisite	What It Does	Common Failure
Enforced DMARC	Establishes authenticated domain identity	`p=none`, partial coverage, or failed alignment
SVG Tiny PS logo	Gives the mailbox a valid visual asset	Unsupported SVG elements, scripts, or invalid structure
BIMI TXT record	Tells the mailbox where to find the logo	Wrong selector, syntax error, inaccessible HTTPS URL
VMC or CMC	Provides certificate-backed brand evidence where required	Unsupported certificate type, missing trademark evidence, or expired certificate

The Google BIMI setup guidance confirms that the logo must be submitted in SVG format and that senders may need a VMC or CMC from an approved certificate authority. The practical recommendation is simple: validate every prerequisite before treating a missing logo as a provider problem.

Mailbox Provider Support and the VMC Question

BIMI support is fragmented. A brand can complete the technical setup correctly and still receive different outcomes across inboxes because each provider applies its own rendering and certificate rules.

Provider	VMC Required	CMC Accepted	Renders Logo	Notes
Gmail	Generally yes	Support depends on provider policy	Yes, when requirements are met	Certificate-backed verification is a major requirement
Yahoo Mail	Not generally required	Provider-dependent	Yes	Self-asserted BIMI can provide a lower-barrier path
Fastmail	Not generally required	Provider-dependent	Yes	Rendering can work without the same VMC dependency
Apple Mail	Provider-specific	Provider-specific	Support varies	Validation should be tested on the actual recipient path
Microsoft Outlook	No standard rendering for normal inbound mail	No standard rendering for normal inbound mail	No standard BIMI logo rendering	Standard BIMI logos aren't currently rendered for normal inbound mail

Support has expanded across major mailbox ecosystems, including Gmail, Yahoo, Apple Mail, Fastmail, La Poste, GMX, and Web.de, but support doesn't mean identical behavior. A brand must test the specific mailbox mix rather than assume universal coverage.

The certificate choice follows the audience. A consumer brand with substantial Gmail traffic should plan around a VMC-backed deployment. A sender whose audience is concentrated in Yahoo Mail or Fastmail may obtain practical value from self-asserted BIMI without the same certificate dependency.

CMC is useful when a brand lacks the trademark path required for a VMC, but it shouldn't be presented as an equivalent substitute. The narrower provider support and reduced trust signaling can make it unsuitable for brands seeking broad recognition or the strongest Gmail experience.

Independent tracking reported 20,227 BIMI certificates globally on July 2, 2026, up 54% year over year, with VMCs representing 90.8% of issuances and CMCs 9.2%. The same BIMI adoption research reported concentration across 109 countries, with the top five accounting for 66.6% of issuance volume. The market is growing, but it isn't universal. BIMI is worth prioritizing when the audience uses supporting providers and the brand can maintain the required evidence.

Implementing BIMI From DMARC to DNS Publication

A successful rollout follows the authentication sequence, not the visual branding sequence.

Confirm SPF and DKIM alignment

The sending team should inventory every legitimate source, including marketing systems, transactional relays, customer relationship platforms, and internal applications. SPF can authorize infrastructure, while DKIM should sign messages with a domain aligned to the visible From domain.

For example, a BIMI-ready message header might contain:

From: Brand <offers@example.com>

DKIM-Signature: d=example.com; s=selector1; ...

Authentication-Results: spf=pass; dkim=pass; dmarc=pass

A failing example looks like this:

Authentication-Results: spf=fail; dkim=none; dmarc=fail

A valid message still needs the receiving provider to apply its own BIMI rules. Authentication passes don't force a mailbox to display a logo.

Enforce DMARC before publishing the logo

The sender should move from monitoring to p=quarantine, review aggregate reports, correct legitimate sending sources, and then progress toward p=reject. BIMI eligibility depends on enforcement, so publishing the logo first creates false confidence.

A representative DMARC record is:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com

Once legitimate traffic aligns consistently, the policy can become:

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@example.com

The pct=100 setting applies the policy across the full message stream. Teams should use a dmarc checker and aggregate reporting to identify sources that would otherwise be blocked or disqualified.

Prepare the asset and publish BIMI

The logo should be converted into a compliant SVG Tiny Portable/Secure file, hosted at an HTTPS URL, and served as image/svg+xml. The BIMI record then points to that asset:

default._bimi.example.com TXT "v=BIMI1; l=https://brand.example.com/logo.svg; a=https://brand.example.com/vmc.pem"

A self-asserted or CMC path may omit a=, depending on the provider and certificate arrangement:

default._bimi.example.com TXT "v=BIMI1; l=https://brand.example.com/logo.svg"

DNS changes can take time to appear consistently. After publication, teams should query the authoritative DNS response, inspect the SVG over HTTPS, confirm the certificate chain where applicable, and send controlled tests to supported inboxes. A missing logo may reflect caching, provider policy, a malformed asset, or a failed authentication result.

The deployment shouldn't be treated as an instant switch. Certificate processing, DNS visibility, provider evaluation, and audience testing create a measured implementation period. The team should avoid promising a fixed rendering date and should record which providers display the mark.

Business Benefits of BIMI for Inbox Trust and Engagement

BIMI's business value is strongest before the recipient opens the message. A recognizable logo can distinguish authenticated brand mail from lookalike messages, especially when the recipient scans a crowded inbox on a small screen.

That visual cue supports three commercial objectives:

Brand recognition: Repeated exposure to the same verified mark can help recipients identify legitimate mail faster.

Impersonation defense: A sender that enforces DMARC and qualifies for BIMI makes it harder for unauthorized messages to claim the same visible identity.

Engagement context: A branded sender identity can influence whether a recipient notices and considers a message before opening it.

The value differs by business model. A retail, financial, or travel sender may care about fast visual recognition during time-sensitive customer interactions. A business-to-business sender may place more weight on reducing executive impersonation risk and protecting trust in transactional communication.

BIMI should still be measured as a trust and recognition signal, not sold as a guaranteed open-rate or inbox-placement improvement. The verified mark doesn't override spam filtering, content classification, recipient engagement, complaint rates, or sender reputation. If the mail lands in spam, the logo's commercial value is limited.

A practical ROI model compares the cost of certificate issuance, logo maintenance, DNS ownership, and monitoring against observed changes in branded recognition, complaint patterns, phishing reports, and engagement by provider. Visual consistency also matters beyond email. Teams working on a broader identity system may find references such as build trust with card icons useful when aligning email marks with other customer-facing trust cues.

The conclusion is direct: BIMI can reinforce a healthy authentication program, but it can't compensate for a weak one. The revenue benefit comes from protecting trust at the inbox decision point, while the underlying deliverability benefit comes from the authentication discipline required to qualify.

Common Mistakes and the Operational Fragility of BIMI

BIMI is not a one-time logo upload. Its prerequisites can change as certificate authorities, trademark rules, certificate types, and mailbox policies evolve.

DMARC drift silently removes eligibility

A new sending source may fail alignment, prompting a team to loosen DMARC from enforcement back to monitoring. That change can protect short-term delivery for the new source, but it also removes the condition many receivers require before rendering BIMI.

Abandoned reporting creates the same problem. Without regular aggregate report review, teams may miss a new relay, unauthorized source, or subdomain that sends outside the intended authentication design.

Certificates and providers can change

Certificate ownership needs a named operator, renewal calendar, and documented DNS update process. Industry reporting for 2026 states that DigiCert accounted for 85.4% of year-to-date BIMI certificate issuances and 73.6% of cumulative issuance, while Entrust exited new BIMI certificate issuance. Those changes can force certificate holders to plan migration before expiration, as discussed in this BIMI adoption trends report.

CMC can expand eligibility for some brands, but it doesn't provide the same coverage or trust signaling as a VMC. It may also lack the blue checkmark experience associated with Gmail's stronger verification path.

SVG files fail more often than teams expect

Design files frequently include unsupported elements, external references, or structures that don't satisfy the BIMI profile. A logo can look perfect in a browser and still fail mailbox validation.

A further warning is reversibility. The same industry report found that nearly 40% of .fr BIMI implementations observed in 2024 were removed the following year. Publication doesn't prove that the organization still maintains the policy, certificate, asset, or DNS record.

BIMI Checklist and Next Steps for Senders

A practical rollout can follow this order:

Establish enforcement: Start with DMARC quarantine, monitor legitimate streams, and move to reject after alignment is stable.

Validate every source: Confirm SPF and DKIM pass for marketing, transactional, CRM, and relay traffic, not just the primary sending system.

Prepare the mark: Convert the approved brand logo to a valid SVG Tiny Portable/Secure file and host it over HTTPS.

Choose certificate evidence: Use a VMC when Gmail visibility and registered-trademark assurance matter. Consider CMC or self-asserted BIMI only when the audience and provider mix support that trade-off.

Publish the record: Place the BIMI TXT record at default._bimi.yourdomain.com, then verify the syntax, logo URL, and certificate URL.

Test provider by provider: Seed controlled messages across supported mailbox ecosystems and document where the logo renders.

Assign ownership: Track DMARC reports, certificate expiry, DNS changes, logo hosting, and new sending sources.

Multi-domain organizations should sequence rollout by domain rather than publish a single unmanaged configuration everywhere. Alias domains and subdomains need separate review because their visible From domain, DKIM signing domain, DMARC policy, and BIMI record may not align automatically.

MailAdept can monitor and configure BIMI alongside SPF, DKIM, DMARC, domain alignment, and related deliverability controls for teams with complex sending estates. That support matters when a missing logo is only the visible symptom of broader authentication drift.

BIMI is worth implementing when the audience uses supporting providers, the organization can enforce DMARC, and the team can maintain certificates and DNS over time. It isn't worth treating as a cosmetic shortcut. The mark is only as reliable as the authentication and operational ownership behind it.

Still facing deliverability issues? Get a free deliverability audit. Mailadept helps teams assess BIMI eligibility, correct authentication alignment, and maintain the DNS and certificate controls that support consistent branded email visibility.