When you open your inbox, some senders show the company logo instead of a coloured initial. In many cases that logo comes from BIMI (Brand Indicators for Message Identification), a standard that links a domain's authentication to its visual identity. It is not a deliverability factor in the strict sense, because it does not help a message get past the spam filter. It is rather the reward for those who have already put SPF, DKIM and DMARC in order, and a recognition signal for readers.
How it works
The mechanism is simple. The domain publishes a DNS record saying where the logo is. The mailbox provider, when it receives a message that passes DMARC under a restrictive policy, reads that record, downloads the logo and displays it next to the sender.
An example BIMI record:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"
defaultis the BIMI selector. Other selectors can be used by naming them in a message header, butdefaultis the one normally used.l=is the address of the logo in SVG format.a=is the address of the certificate proving the right to use the mark, where required.
The prerequisite: enforced DMARC
BIMI does not work with p=none. The domain must have an enforced DMARC policy, meaning p=quarantine or p=reject, and quarantine must apply to all messages, with no pct= below 100. The subdomain policy must not be none either.
The logic is clear: showing a logo next to a message that could be forged would be a gift to fraudsters. The logo appears only if the domain has asked receivers to reject or isolate everything that is not authenticated.
In practice, for many companies BIMI becomes the concrete motivation to finally complete the DMARC journey that had stalled at p=none.
Preparing the logo
The logo cannot be just any SVG. The standard requires the SVG Tiny Portable/Secure profile (SVG Tiny PS), a reduced version of the format that excludes scripts, external references and animation. The main guidelines:
- square shape, with the subject centred, because many clients crop the image into a circle;
- solid background, not transparent;
- no scripts, no embedded raster images, no external links;
- a
titleelement with the brand name; - a small file size.
SVGs exported from graphics software are usually non-compliant and need cleaning up. There are conversion tools and public validators to check the result before publishing it. The file must be served over HTTPS.
VMC and CMC certificates
Some providers display the logo only if it comes with a certificate proving the link between the domain and the mark.
| Certificate | What it requires |
|---|---|
| VMC (Verified Mark Certificate) | a trademark registered with a recognized trademark office |
| CMC (Common Mark Certificate) | evidence that the logo has been in use for some time, without registration |
Certificates are issued by authorized certificate authorities after verifying the organization and the mark, and carry an annual cost. The certificate's PEM file also embeds the logo, which must match the one published.
With a VMC, some providers also add a check mark indicating a verified sender. Support for CMC is more limited than for VMC.
What to expect from providers
BIMI support varies a lot. Some large mail services implement it and require the certificate, others show the logo even without one, and others don't support it at all or use their own systems for sender logos. Providers may also choose not to show the logo for senders with poor reputation or very low volumes.
So it is important not to present BIMI as a guarantee. In my work I only suggest it once DMARC is enforced and stable: before that, it is effort spent in the wrong place.
A working sequence
- Bring DMARC to
p=quarantineat 100% orp=reject, with clean reports. - Prepare the logo in SVG Tiny PS and validate it.
- Decide whether a VMC or CMC is needed, based on the providers your recipients use most.
- Publish the logo and certificate over HTTPS, and the
default._bimirecord. - Check with a BIMI validator and with test sends to the main mailbox providers.
In short
- BIMI shows the brand logo next to authenticated messages, but does not improve spam filtering.
- It requires enforced DMARC, with quarantine at 100% or reject, subdomains included.
- The logo must be a square SVG Tiny PS file, with a solid background and no external elements.
- Some providers require a VMC certificate, based on a registered trademark, or a CMC.
- Support varies between providers: treat BIMI as a finishing touch, not a priority.
