BIMI: brand identity in emails

BIMI (Brand Indicators for Message Identification) is the open industry standard that lets Gmail, Apple Mail, Yahoo Mail, Fastmail, and other supporting inboxes display your official company logo next to the emails you send.

BIMI is a display signal layered on top of strong email authentication: your logo only appears when a message is cryptographically authenticated and passes DMARC at enforcement. In Gmail:

• With a VMC (Verified Mark Certificate, backed by a registered trademark), Gmail displays your logo and the blue verified checkmark.
• With a CMC (Common Mark Certificate, backed by 12+ months of prior use), Gmail displays your logo next to your sender name without the checkmark.

How BIMI works#

Inboxes do not take your logo from an email attachment. Instead, every time an email arrives from your domain:

1. Authenticate and align: The receiving inbox checks that the message passes SPF or DKIM aligned with the visible From: domain, and that your domain's DMARC policy is at enforcement (p=quarantine at 100% or p=reject).
2. Look up your BIMI DNS record: The inbox queries a public TXT record at default._bimi.<yourdomain.com> (or falls back to your main organizational domain).
3. Fetch the logo and certificate: That record points to two HTTPS URLs: your SVG Tiny P/S logo file (l=) and your mark certificate PEM chain (a=).
4. Verify and display: The inbox validates the certificate chain, confirms the SVG embedded inside the certificate matches your logo, and renders your logo beside the message.

The five constituent parts of BIMI#

Every live BIMI setup relies on five parts working together:

1. Aligned SPF or DKIM authentication: At least one must pass and align with the visible From: header domain. Aligned DKIM is strongly recommended because it survives forwarding and works even when an email service cannot customize the Return-Path domain.
2. DMARC at 100% enforcement: Your organizational domain (and any sending subdomain) must publish p=quarantine (with pct=100 or no pct tag) or p=reject, and must not set sp=none.
3. A compliant SVG Tiny P/S logo: A square, self-contained vector file meeting both the BIMI specification and Gmail's strict rendering rules (VerifiedInbox converts and checks your logo automatically; see Logo requirements):
   • version="1.2" and baseProfile="tiny-ps" on the <svg> root element.
   • Square viewBox with absolute pixel dimensions of at least width="96" height="96" (never relative percentages like width="100%"), designed to remain recognizable at 20 to 40 px in both light and dark modes.
   • A solid background color baked into the SVG (inboxes crop the image into a circle or squircle; transparent backgrounds often render poorly in dark mode).
   • A <title> element containing your organization's name (and an optional <desc> element for accessibility).
   • File size of 32 KB or smaller.
   • Forbidden elements: no scripts, no animations or interactive elements, no external links or references, no embedded raster images (PNG/JPG), and no x= or y= attributes on the root <svg> element.
4. A mark certificate (VMC or CMC) PEM chain: Issued by an accredited Mark Verifying Authority (such as DigiCert). The hosted .pem file must include the complete certificate chain in order: your entity certificate (which cryptographically embeds a copy of your SVG logo), followed by the intermediate CA certificate(s) and root CA certificate. See VMC vs CMC and Certificates & renewals.
5. The default._bimi DNS TXT record and HTTPS hosting: The public DNS record linking your hosted .svg and .pem files over HTTPS (TLS 1.2+).

DNS records required for BIMI#

In the VerifiedInbox setup wizard, the DNS step shows every record your domain needs on one page, with copy buttons and live status checks against your domain's authoritative nameservers (so changes appear within seconds rather than hours).

Some DNS providers ask for the full host name (default._bimi.yourdomain.com), while others only want the prefix (default._bimi). The wizard shows both formats for your DNS provider.

1. Domain ownership#

2. Allowed senders (SPF)#

3. Email signatures (DKIM)#

4. Fake email protection (DMARC)#

5. Inbox logo & certificate (BIMI)#

How to configure BIMI#

1. Complete your email security and certificate steps. Once your certificate is issued, VerifiedInbox automatically hosts your approved SVG Tiny P/S logo and full PEM certificate chain (entity + intermediate + root certificates) at https://bimi.verifiedinbox.ai with the required HTTPS headers and MIME types. See Going live.
2. Add the default._bimi TXT record where you manage your domain's DNS (for example Cloudflare, Route 53, GoDaddy, Namecheap, or Squarespace):
   • Type: TXT
   • Host / Name: default._bimi
   • Value:
     textCopy

     v=BIMI1; l=https://bimi.verifiedinbox.ai/yourdomain.com/logo.svg; a=https://bimi.verifiedinbox.ai/yourdomain.com/certificate.pem

   • TTL: Default (or 3600 seconds).
3. Click Check now in the wizard. We query your authoritative nameservers directly to confirm the record is live and that the hosted files match.

Technical reference: BIMI tags, selectors & declination#

BIMI DNS record tags#

A BIMI record is a semicolon-separated list of tag=value attributes published as a DNS TXT record at <selector>._bimi.<domain> (almost always default._bimi.<domain>):

Using BIMI selectors for multiple logos or mail streams#

By default, every inbox looks up default._bimi.<domain>. If your company wants to show a different logo for a specific brand or newsletter stream on the same domain:

1. Publish a second BIMI TXT record under a custom selector name, such as newsletter._bimi.yourcompany.com.
2. Add the BIMI-Selector header to outgoing emails on that stream:
   textCopy

   BIMI-Selector: v=BIMI1; s=newsletter;

Excluding a subdomain (BIMI declination)#

Because subdomains automatically inherit the default._bimi record of your main organizational domain, you can explicitly opt a specific subdomain out of showing a BIMI logo by publishing a declination record (with empty l= and a= tags) at default._bimi.<subdomain>:

v=BIMI1; l=; a=;

How to troubleshoot BIMI issues#

If your BIMI record is published but you do not see your logo in the inbox yet:

1. Send a real test email using the Go live (or Email security) step in VerifiedInbox. We inspect the actual Authentication-Results header to verify that SPF, DKIM, and DMARC all pass with alignment.
2. Verify DMARC is at 100% enforcement on both the domain and organizational domain. Make sure _dmarc has p=quarantine (without pct below 100) or p=reject, and that your organizational domain does not set sp=none.
3. Check the hosted files. Both the l= logo URL and the a= certificate URL must be publicly reachable over HTTPS (TLS 1.2+), return status 200, serve the full certificate chain (entity + intermediate CA certificates), and match the exact SVG embedded in your mark certificate. VerifiedInbox handles and monitors all of this automatically when you use our hosting.
4. Allow 24 to 48 hours for inbox caching. After all technical checks pass, Gmail and other mailbox providers cache DNS and certificate lookups for up to 48 hours before showing the logo on new messages.

Common issues & edge cases#

• DMARC policy is still p=none or pct=25. Inboxes ignore BIMI unless DMARC is at p=quarantine (pct=100) or p=reject.
• Sending from a subdomain while the main domain has sp=none. Even if news.yourdomain.com has its own p=reject DMARC record, BIMI evaluators also inspect the organizational domain (yourdomain.com) and reject BIMI if sp=none is set there.
• Incomplete PEM certificate chain (missing intermediate CA certificates). When you receive a VMC or CMC from an issuer, the .pem file hosted at a= must contain the entity certificate plus the intermediate CA certificate(s) in order. Hosting only the leaf certificate causes Gmail and Apple Mail validation to fail. (VerifiedInbox builds and serves the complete chain automatically.)
• Editing the SVG file after the certificate was issued. A mark certificate embeds a cryptographic copy of your exact SVG Tiny P/S file. If the file at l= changes by even one character or whitespace byte, validation fails. To update your logo, request a reissue so a matching certificate is issued.
• Relative SVG dimensions (width="100%") or x=/y= attributes on <svg>. Gmail requires explicit pixel dimensions of at least width="96" height="96" on the <svg> root element and rejects files that use 100% or include x=/y= attributes on <svg>.
• Self-encoding or hosting blockers (WAF, bot protection, geo-fencing, or wrong MIME type). If you self-host your SVG or PEM behind a CDN firewall, Cloudflare bot challenge, IP allowlist, geo-block, or Content-Disposition: attachment header, mailbox provider crawlers cannot fetch the files. Using VerifiedInbox hosting (https://bimi.verifiedinbox.ai) avoids these issues.
• Self-asserted BIMI (l= without a=) not showing in Gmail or Apple Mail. Some providers (such as Yahoo Mail) may display a "self-asserted" SVG logo without a certificate on bulk mail from reputable senders, but Gmail and Apple Mail strictly require a VMC or CMC certificate (a=) before displaying any BIMI logo.
• Testing with a one-off personal email on Yahoo or low-reputation domain. Each mailbox provider applies its own sender reputation and volume rules. For example, Yahoo only displays BIMI logos on bulk/commercial mail streams, not on personal 1-to-1 messages.
• Smart quotes or line breaks in the TXT value. Copy and paste the v=BIMI1; ... string as a single line of plain text without typographic quotes.

Frequently asked questions#

Which inboxes support BIMI?#

Gmail, Apple Mail (iOS 16+, macOS Ventura+, and iCloud Mail), Yahoo Mail, Fastmail, La Poste, Onet Poczta, Zoho Mail, and Zone support BIMI. Gmail and Apple Mail require a mark certificate (VMC or CMC); Gmail adds the blue verified checkmark when your certificate is a VMC.

Do I need both l= and a= in my BIMI record?#

Yes. Always include both l= (your SVG Tiny P/S logo URL) and a= (your VMC or CMC certificate PEM URL). While Gmail can also read the SVG embedded inside the a= PEM file, other providers (such as Yahoo and Fastmail) read the SVG directly from l=.

How long is a BIMI mark certificate valid, and does the 47-day TLS rule affect it?#

BIMI mark certificates (VMC and CMC) are valid for up to 398 days (about 13 months). The CA/Browser Forum's move toward 47-day lifetimes applies only to browser Web PKI TLS server certificates; BIMI mark certificates are governed separately by the AuthIndicators Working Group and are not affected by the 47-day TLS schedule.

Can my BIMI record be on my domain while the SVG and PEM files are hosted on another domain?#

Yes. Cross-domain HTTPS hosting (such as hosting your files on https://bimi.verifiedinbox.ai while your DNS record lives at default._bimi.yourdomain.com) is completely standard and supported by every BIMI mailbox provider.

Do I need to change my BIMI DNS record when my certificate renews?#

No. When VerifiedInbox hosts your logo and certificate, your default._bimi record points to stable URLs at https://bimi.verifiedinbox.ai. When we renew your certificate each year, we update the hosted certificate file in place with zero DNS changes required from you.

What if my email provider cannot set a custom Return-Path for SPF?#

That is fine for BIMI. BIMI requires DMARC alignment with the visible From: domain, which is satisfied as long as your email provider signs messages with a DKIM key whose d= domain aligns with your From: domain.

Does BIMI replace a user's personal profile photo?#

Mailbox providers decide whether to show a personal contact photo or the BIMI brand logo in a given view, though you can include the optional avp=brand or avp=personal tag in your BIMI record as a preference hint.