Key takeaways

  • BIMI stands for Brand Indicators for Message Identification. A mailbox provider that supports it can display your logo beside your messages.
  • The base requirement is DMARC enforcement. Google's documentation says the policy must be quarantine or reject, never none, and the percentage must be 100.
  • Google's documentation also requires an SVG logo and a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) from a certificate authority. A VMC is tied to a trademarked logo; a CMC is the route for a logo that is not trademarked.
  • In Gmail, the checkmark appears next to senders verified with a VMC. Yahoo's documentation says VMCs are not required for BIMI logos to appear there, though a VMC is used to inform eligibility.
  • BIMI shows that a message passed DMARC for that domain and that the logo was verified for that domain. It does not prove the sender is trustworthy, that the message is safe, or that a lookalike domain cannot send mail.
  • Treat BIMI as a finishing step after the real work: SPF, DKIM, DMARC at enforcement, and a list of every service that sends mail for you.

What BIMI is

When you open an inbox, many messages show a round avatar or initials. BIMI is the standard that lets a company put its own logo there. It is specified by the AuthIndicators Working Group as an internet draft, and mailbox providers decide whether and how to show it. The idea is simple: if a domain has proven, through DMARC, that its mail is authenticated, and a certificate authority has verified the logo, the provider can show the logo with more confidence.

What you need first

Everything starts with DMARC. DMARC checks that the visible From domain matches the domain verified by SPF or DKIM and tells receivers what to do with mail that fails. Google's setup page says that to support BIMI, the DMARC policy must be quarantine or reject, and that BIMI does not support a policy of none. It also says the percentage option, pct, must be 100, so that the policy applies to all outgoing mail from the domain.

That has a practical meaning. If your domain is still at monitoring only, or you have a partial policy because a vendor sends mail that fails, BIMI will not work until that is fixed. Our DMARC rollout article on this site walks through moving from none to enforcement without losing legitimate mail. The list of senders is the hard part: marketing tools, billing systems, ticketing, a CRM, and old servers that still send.

The other requirements are technical and small. The logo must be in SVG format, and the web server hosting your BIMI files must use HTTPS. Google recommends TLS 1.2 or later. Then you publish a BIMI TXT record that points to the logo, and the certificate if you have one. Google says that after you add the record, it can take up to 48 hours for the logo to appear.

VMC and CMC

Both are certificates issued by a certificate authority that checks your logo and your domain. A Verified Mark Certificate, VMC, is for a logo that is trademarked with an intellectual property office that VMC issuers recognize. Google says the trademark process can take 6 to 12 months and recommends a VMC where possible. A Common Mark Certificate, CMC, is the route for a logo that is not trademarked. The current list of issuers and their requirements is published by the BIMI group, so check it, not a reseller's summary.

Gmail shows a checkmark next to senders verified with a VMC. Per Google, that checkmark feature is not available in non-Gmail web apps. Yahoo's documentation says it does not require VMCs for BIMI logos to appear in its apps, and that its decision also looks at things like the reputation and engagement of the sending address. Support differs by provider and changes over time, so test with the providers your customers use.

What BIMI proves

  • The message passed DMARC for the domain that sends it, and the domain's owner chose to enforce.
  • A certificate authority verified the logo you submitted against your domain, or against your trademark if you hold a VMC.
  • The logo shown is the one you submitted, not one a stranger picked.

What BIMI does not prove

  • That the content is honest. A real, well-authenticated sender can still send a bad link, and a compromised mailbox on your own domain passes DMARC.
  • That every lookalike is blocked. A different domain with a similar name can still send authenticated mail; BIMI only says something about the domain that holds the record.
  • That the recipient will see it. Providers choose whether to show it, and some do not support it.
  • That your email security is complete. BIMI sits on top of authentication and does nothing to stop phishing aimed at your staff.

For that reason, we describe BIMI to clients as brand and trust polish with a real security by-product: you only get it by finishing the authentication work that also helps stop spoofing of your own domain. The by-product matters more than the logo.

A short plan

  • Inventory every service that sends mail as your domain.
  • Get SPF and DKIM aligned for each, then move DMARC to quarantine or reject at pct=100.
  • Decide VMC or CMC, and start the trademark or evidence work early, because it takes the longest.
  • Prepare the SVG logo and a secure web location for it.
  • Publish the BIMI record and test in the mailbox providers that matter to you.
  • Keep monitoring DMARC reports. A new sender that fails alignment can break BIMI along with delivery.

We set up email authentication and run the DMARC rollout as scoped work, and we can add BIMI when the domain is ready. Certificates come from a certificate authority of your choice, and we do not promise that any provider will display your logo.

Sources

This article is general information, not legal or technical advice for your environment. Product menus, license names and provider rules change; check the vendor's current documentation before you act. Last reviewed .

Next article

Related reading

Need help with this?

Filter threats out of mail, keep every message in an immutable archive you can search, and keep email working when the mail platform goes down.

Email Security, Archiving & Continuity