A brand’s logo can appear next to an email in Gmail or Yahoo Mail thanks to BIMI (Brand Indicators for Message Identification), a DNS record that tells mailbox providers where to find the logo so they can show it in the message list. It only appears if the sending domain enforces a DMARC policy of quarantine or reject. Gmail also requires a brand certificate (VMC or CMC) tied to the logo. Apple requires verified proof of that logo.
The BIMI protocol has to be set up in a specific order: DMARC first, then the certificate. The SVG file and the DNS record come next, with a test on Gmail at the end.
How BIMI works
When a message arrives, the recipient’s mailbox provider first checks SPF, DKIM and DMARC. If authentication passes, it queries the sender domain’s DNS at default._bimi.yourdomain.com. The TXT record it finds points to a logo in SVG format and, depending on the case, to a certificate in PEM format. The provider checks the certificate, then shows the logo next to the sender name.
BIMI sits on top of the existing authentication protocols. The first one is DMARC, which proves that the sender controls the domain. The logo also slows down phishing: if someone spoofs the domain, the message fails DMARC and the logo does not appear.
The standard is still an IETF draft: version 14 of draft-brand-indicators-for-message-identification, dated May 1, 2026, expires on November 2, 2026 (IETF Datatracker). Gmail, Yahoo Mail and Apple Mail (from iOS 16 and macOS Ventura 13) already apply it.
Get the authentication prerequisites in place
Before buying any certificate, check four things on the sending domain:
- a valid SPF record covering every sending tool;
- a DKIM signature aligned with the domain;
- a DMARC policy (RFC 7489) set to
p=quarantineorp=reject; - an enforcement percentage of 100 (
pct=100, the default value when the tag is missing).
According to Google, p=none is not supported and pct=100 is required (the “Set up BIMI” page of the Google Workspace help center, updated October 13, 2026). A domain still on p=none should move up in steps (pct=10, then pct=50, then pct=100) and first go through a phase of aggregate reports (the rua tag) until there are no false positives left. Example of a TXT record to publish at _dmarc.example.com: v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com. Every third-party sending tool (Mailjet or SendGrid, for example) must sign with DKIM on behalf of the domain before you make this switch.
Choose between VMC, CMC and BIMI without a certificate
A VMC (Verified Mark Certificate) requires a registered trademark. A CMC (Common Mark Certificate) is for logos protected by prior use, with no registration: the BIMI Group announced on September 26, 2024 that Google officially supports CMCs in Gmail. An unregistered logo therefore goes through a CMC, whereas a trademark registration takes 6 to 12 months according to Google.
The rules differ by mailbox provider. According to the BIMI Group, Gmail rejects self-asserted records and requires a certified logo, while Yahoo Mail accepts them without a certificate, provided the SVG uses the SVG P/S profile. Apple, for its part, asks for verified proof of the logo (a “BIMI Evidence Document”, with the VMC as the example given in its developer documentation) and does not mention the CMC. The details are in the article on BIMI without a certificate.
| Criterion | VMC | CMC | No certificate |
|---|---|---|---|
| Logo status | Registered trademark | Prior use proven, registration not required | No proof required |
| Logo in Gmail | Yes | Yes | No |
| Gmail verification checkmark | Yes, according to Google | Not announced | No |
| Apple Mail | Verified proof required (VMC given as an example) | Not mentioned by Apple | No |
| Yahoo Mail | Not needed | Not needed | Yes, with an SVG in the SVG P/S format |
| Price | Set by the issuer | Set by the issuer | None |
Prices vary from one issuer to another and from year to year, which is why the table has no figure: ask for a quote for your domain before you decide. The list of authorized issuers is maintained by the BIMI Group and includes DigiCert, GlobalSign and SSL.com on its current page. A certificate has a limited validity period, so it must be renewed regularly: an expired certificate makes the logo disappear.
Prepare the SVG file
Google asks for an SVG using the SVG Tiny PS profile (baseProfile="tiny-ps", version="1.2"), at least 96 x 96 pixels in absolute units, centered in a square, on a solid background. A file size of 32 KB (32,768 bytes) or less is recommended. External links and scripts are forbidden, and so are animations. A <desc> element must describe the logo. A raw export from a drawing tool does not necessarily follow this profile: the conversion is covered in the article on creating a BIMI logo as an SVG image.
Publish the DNS record
Open the DNS zone of the sending domain at your host or registrar. Click “Add record”, choose the TXT type, and leave the TTL at 3600 seconds. Name: default._bimi (most interfaces append the domain automatically). Value:
v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem
The l= tag points to the SVG, the a= tag to the PEM file of your certificate, both over HTTPS. For Gmail, the l= value can stay empty. Gmail does not support a record with an SVG only and no a=. Save the record.
The logo then shows up after a delay of up to 48 hours (Google Workspace, “Set up BIMI” help page).
Test and troubleshoot
After publishing, query the DNS from a terminal with dig TXT default._bimi.example.com: the returned value must match the string you entered. Then run the domain through a BIMI testing tool, such as the BIMI Inspector, which validates the record and then the SVG. Finally, send a message to a test @gmail.com address, then open “Show original” to check that SPF, DKIM and DMARC all show PASS. Wait up to 48 hours before concluding there is a configuration error.
If the logo does not show, work through this list in order:
- DMARC is not at
pct=100or is still onp=noneat the organizational domain; - the SVG does not comply with Tiny PS (file too heavy, leftover script, non-square ratio);
- the PEM file is not reachable over HTTPS or the certificate has expired;
- the record sits on the wrong subdomain:
default._bimimust match the domain in the From field; - the test message fails SPF or DKIM, in which case DMARC fails too.
What BIMI does, and where coverage stops
A logo next to the name makes the sender recognizable at a glance. Gmail’s checkmark signals a sender verified by a VMC. BIMI only displays a logo: a message that lands in spam stays in spam.
As far as we know, Outlook and Microsoft 365 do not display the BIMI logo as of October 2026, and Microsoft has announced no rollout.
Pick your certificate based on your situation
Registered trademark and recipients mostly on Gmail: go for the VMC, which Google ties to the verification checkmark. Unregistered logo: the CMC gives access to the logo in Gmail without waiting the 6 to 12 months a trademark registration takes. Contact base mostly on Yahoo, or a zero budget: the self-asserted record is enough to get started.
