BIMI, or Brand Indicators for Message Identification, is a standard that lets a domain publish a brand logo for supporting mailbox providers to consider displaying beside authenticated email.
BIMI- What is BIMI? How brand logos reach supporting inboxes
- The mental model
- How BIMI reaches the mailbox
- VMC, CMC, and provider differences
- A 2026 DMARC transition worth knowing about
- Worked example
- What BIMI requires
- A practical BIMI rollout
- What passes and what does not
- Common mistakes
- Troubleshooting
- Questions we get asked
- OnVoard's take
What is BIMI? How brand logos reach supporting inboxes
The important word is consider. BIMI does not force a mailbox to show a logo, and it does not make a message more authentic by itself. It is a visible brand signal that sits on top of email authentication and a mailbox provider's own eligibility rules.
The mental model: BIMI is the last layer, not the first
A useful way to think about BIMI is as the end of a chain:
Five gates, and the last one is still a judgment call
Starts with a message sent from the domain a recipient can actually see in the From address.
- Authentication1SPF or DKIM passesAligned to the domain in the visible From address.
- 2DMARC at enforcementQuarantine or reject, not monitoring only.
- BIMI assets3BIMI record foundA TXT record at the selector under _bimi.
- 4Logo and evidence validSVG Tiny PS, plus a certificate where the provider wants one.
- Receiver policy5Provider says yesIts own reputation, volume and engagement criteria.
- OutcomeLogo may displayMay, not will. And not a statement about inbox placement.
That sequence explains 2 common failures. A correct BIMI DNS record cannot rescue broken authentication, and perfect authentication still does not guarantee logo display.
How BIMI reaches the mailbox
BIMI starts with the domain in the visible From address because DMARC is what connects email authentication to that identity. A message can have a valid DKIM signature for a service provider's domain, for example, without that domain being the brand domain the recipient sees. For BIMI, the relevant authentication must satisfy DMARC alignment for the visible From domain.
After that, a supporting mailbox provider can discover a BIMI assertion in DNS. The default selector is usually published under a name such as:
What each part of the record is actually for
Declares the BIMI version. Always first.
The HTTPS location of the logo indicator. This is a pointer, not the picture: if the file moves, the chain breaks.
The HTTPS location of an evidence document such as a VMC or CMC. Optional in the BIMI syntax. Not optional at every provider.
default, but provider support and operational need vary, so most senders never need a second one.The a= field being optional in the BIMI specification does not mean certificates are optional everywhere. Receiver policy is a separate gate.
VMC, CMC, and provider differences
Provider behavior is where a lot of otherwise good BIMI explanations become misleading. There is no single statement such as "BIMI requires a VMC" that is correct for every receiver. The right question is:
> Which mailbox providers matter for my audience, and what does each currently require for display?
The same record, two different answers
Gmail
- Certificate
- A VMC or CMC is required. Google's current setup documentation makes this the gate for Gmail BIMI.
- Visible mark
- Gmail shows a checkmark next to senders verified with a VMC. A CMC can support logo display but does not earn that checkmark.
- Also asks for
- Gmail-specific SVG and hosting requirements, in addition to the general BIMI rules.
Yahoo
- Certificate
- Not currently required solely for logo display. A VMC can still be used as an input to eligibility.
- Visible mark
- No separate certificate-linked verification treatment described in its current sender documentation.
- Also asks for
- Bulk-mail behavior, sender reputation and recipient engagement, alongside the technical prerequisites.
A 2026 DMARC transition worth knowing about
You may see current BIMI and provider instructions that say DMARC must be at p=quarantine or p=reject with pct=100. At the same time, the IETF published RFC 9989 in May 2026 as the new DMARC standard. It obsoletes RFC 7489 and removes the old pct tag, replacing the special testing behavior with a t tag.
Those facts are not a reason to guess at mailbox-provider behavior. BIMI display eligibility is an operational receiver policy layered on top of standards. When a BIMI provider still publishes a pct=100 requirement, treat its current instructions as the compatibility requirement for that provider while the ecosystem transitions, and verify the latest provider guidance before making DNS changes.
The durable concept is full DMARC enforcement, not the historical spelling of one rollout control.
Worked example
Suppose offers@example.com sends a campaign.
- The message has:
From: Example Store <[email protected]>DKIM d=example.com: passDMARC: passDMARC policy: p=rejectBIMI record: presentSVG: valid
- That is a much stronger starting point than merely publishing
default._bimi.example.com
Now imagine the brand tests the message at 2 providers:
- Gmail sees the BIMI record, but the record does not reference a VMC or CMC. Gmail's current requirements are not met
- Yahoo sees the same record. Yahoo does not currently require a VMC solely for logo display, but it can still withhold display based on its other eligibility criteria
The same DNS configuration can therefore produce different visible results without either receiver being "wrong."
What BIMI requires
There are 4 practical layers to prepare.
1. DMARC at enforcement
BIMI Group implementation guidance requires DMARC enforcement rather than monitoring-only p=none. Its current guidance names p=quarantine or p=reject and expects enforcement across the relevant organizational domain and subdomains. This is not the same as "a DMARC record exists." A domain can publish DMARC in monitoring mode and still not be BIMI-ready.
2. A BIMI-compatible SVG
The logo is not an arbitrary SVG exported from a design tool. BIMI uses the restricted SVG Tiny Portable/Secure profile. Among the practical requirements and recommendations in current BIMI guidance:
baseProfileistiny-psversionis1.2- a
<title>element is required - scripts, external references, animation, and other interactive elements are not permitted
- the artwork should be designed for a square view box and very small rendering contexts
- the file should be kept small, with 32 KB a widely stated compatibility target
A logo can look fine in a browser and still fail BIMI validation because the problem is in the SVG structure, not the picture.
3. A BIMI DNS assertion
Publish the BIMI TXT record at the selector location for the domain you want to use. The DNS record is a pointer, not the logo itself. That means the referenced HTTPS resources must remain reachable. Moving or replacing the file without updating the associated record or certificate can break the chain.
4. The certificate your target providers expect
BIMI supports mark certificates that bind an organization and a logo. The 2 forms currently described by the BIMI Group are:
- VMC, Verified Mark Certificate: typically used for a qualifying registered mark
- CMC, Common Mark Certificate: provides a path for some marks that do not meet the VMC trademark model, subject to the issuer's and receiver's rules
Do not turn that distinction into a universal support table. Mailbox providers decide which evidence they accept and what user-interface treatment it earns.
A practical BIMI rollout
Eight steps, in order.
- 01Inventory every legitimate sender using the From domainBefore changing DMARC enforcement, list the services that send as your domain: marketing platform, transactional provider, support desk, commerce platform, billing system, and internal mail. If one legitimate stream is not aligned, strict enforcement can expose it.
- 02Make DMARC alignment reliableConfirm legitimate streams pass DMARC through aligned DKIM and/or SPF as appropriate. BIMI should come after the authentication work, not before it.
- 03Move the relevant domain to enforcementUse the current DMARC standard and your providers' current BIMI compatibility requirements. Do not assume monitoring mode is enough.
- 04Prepare and validate the logoCreate the SVG Tiny PS version, validate the file structure, and test how the mark survives small circular or rounded display masks.
- 05Choose the certificate path for the providers you care aboutIf Gmail is a target, its current documentation requires a VMC or CMC. If you want Gmail's VMC verification checkmark, that is a stricter goal than logo display alone.
- 06Publish the BIMI assertionUse the intended selector and HTTPS resource URLs. Keep the assets stable.
- 07Test by provider, not just by DNSA DNS lookup can tell you that the record exists. It cannot tell you that every provider considers the sender eligible to render the logo.
- 08Treat the setup as maintained infrastructureReview certificate expiry, hosted assets, DMARC behavior, logo changes, and provider policy changes. BIMI is not a one-time decorative setting.
What passes and what does not
- BIMI is useful precisely because its job is narrow
- It does not prove:
- that every message from the domain is wanted
- that the message will reach the inbox
- that the message content is safe
- that the human author has a particular identity
- that every mailbox provider will display the logo
- that a logo will appear immediately after DNS is changed
- The BIMI Group explicitly describes BIMI as a display signal layered on strong authentication rather than a security solution on its own. Google and Yahoo then apply their own product and sender criteria on top
Common mistakes
- Publishing BIMI before DMARC enforcement is ready
- Treating a browser-valid SVG as a BIMI-valid SVG
- Saying "BIMI requires a VMC" without naming the provider
- Expecting logo display to prove inbox placement
- Testing DNS only and never testing actual messages at the mailbox providers that matter
- Replacing the logo asset without reviewing the certificate and DNS chain
Troubleshooting
- ›Troubleshooting: record present, logo absentUse the chain in order. Does the message itself pass DMARC? A perfect record does not help a message that fails alignment. Is the domain at the enforcement level required by the provider? Monitoring-only DMARC is a common stopping point. Is the SVG actually Tiny PS compliant? Check the document structure, not just whether it renders. Are the logo and certificate resources reachable over HTTPS? A valid DNS pointer to a broken URL is still broken. Does the target provider require a VMC or CMC? Do not generalize another provider's rules. Does the provider impose additional sender eligibility rules? Yahoo, for example, explicitly lists reputation and engagement criteria in addition to the technical BIMI prerequisites. Did the logo or certificate recently change? A mark certificate is associated with the certified mark. Logo changes can require certificate work rather than a simple file replacement.
Questions we get asked
Does BIMI improve deliverability?
Do not use BIMI as a deliverability claim. BIMI Group guidance says BIMI does not change message delivery. The prerequisite authentication work can be valuable on its own, but a BIMI logo is not an inbox-placement guarantee.
Is BIMI an authentication protocol like SPF or DKIM?
No. SPF and DKIM authenticate domain-level identifiers. DMARC connects authenticated identifiers to the visible From domain and publishes policy. BIMI comes after that chain and gives supporting receivers a standardized way to discover a brand indicator.
Do I need both SPF and DKIM for BIMI?
DMARC can validate through an aligned authenticated identifier, but the BIMI Group's implementation guidance tells organizations to authenticate their email with SPF, DKIM, and DMARC and ensure alignment. Operationally, DKIM is particularly important for durable authentication across forwarding and for modern provider requirements. Treat BIMI as a reason to clean up the full authentication stack, not to search for the minimum checkbox.
Is a VMC always required?
No. Certificate acceptance is provider-specific. Gmail currently requires a VMC or CMC for BIMI. Yahoo currently says it does not require a VMC solely for logo display. Check the providers your recipients actually use.
Can different mail streams use different BIMI logos?
BIMI has a selector mechanism, so the protocol can support more than the default selector. In practice, provider support, certificate scope, and operational complexity must all be checked before relying on multiple selectors.
OnVoard's take
Treat BIMI as the visible end of an authentication project.
The useful success metric is not "we published a BIMI TXT record." It is: legitimate mail is aligned, DMARC is safely enforced, the logo and evidence chain are valid, and the providers that matter can independently evaluate the sender for display.
That framing prevents a branding project from hiding an authentication problem.
Every app on every plan. Connect your store and switch on the flows in an evening.