BIMI: Getting Your Logo in the Inbox with a VMC or CMC

BIMI is the only part of email authentication anyone can see. SPF, DKIM and DMARC all work invisibly in the headers. That visibility is why BIMI gets sold as a security feature. It isn’t one, not directly. It is a reward for domains that have already done the security work.

What BIMI is, and what it isn’t

BIMI stands for Brand Indicators for Message Identification. The BIMI Group develops it, and it exists as an IETF Internet-Draft, not yet an RFC. A TXT record on your domain points to a logo; supporting mailbox providers show it in the inbox instead of a generic initial.

According to the BIMI Group, supporters include Google (Gmail), Apple, Yahoo, Fastmail, Zoho Mail, La Poste and Comcast. Microsoft does not support it. Whether your logo actually appears is up to each provider, and reputation and volume play a part.

BIMI doesn’t stop forgery. It assumes forgery is already blocked by DMARC. If that isn’t true for your domain yet, start with prevent email spoofing.

BIMI requirements at a glance

RFC 9989, published in May 2026, dropped pct from DMARC entirely, but Google’s Workspace help still mentions pct=100. Omit the tag and you satisfy both readings.

VMC or CMC?

The certificate proves you’re entitled to use the logo. There are two kinds:

For a small business without a registered figurative mark, the CMC is the realistic option. If you already hold a trademark, go for the VMC. Support for CMCs is not uniform across every provider, so check the BIMI Group’s current list before buying.

Without any certificate (an l= URL and an empty a=), Gmail shows nothing. Yahoo has displayed logos for senders with a good reputation even without one.

The logo: SVG Tiny PS

A regular SVG exported from Illustrator or Figma will be rejected. BIMI requires the SVG Tiny Portable/Secure profile. The main rules:

• root element with version="1.2" and baseProfile="tiny-ps"
• a <title> element containing the company name
• no scripts, no external references, no embedded raster images
• square aspect ratio with the mark centred, because clients crop it to a circle
• a solid background rather than transparency

A bare-bones skeleton:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 96 96" width="96" height="96">
  <title>Example Ltd</title>
  <rect width="96" height="96" fill="#0b6e99"/>
  <circle cx="48" cy="48" r="26" fill="#ffffff"/>
</svg>

Most certificate authorities check the file as part of the application, and the BIMI Group publishes conversion guidance.

Publishing the BIMI record

The record uses the selector default under the _bimi label:

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Here is what real ones look like:

$ dig +short TXT default._bimi.cnn.com
"v=BIMI1; l=https://amplify.valimail.com/bimi/time-warner/R4Ezf5xK5ac-CNN.svg; a=https://amplify.valimail.com/bimi/time-warner/R4Ezf5xK5ac-CNN.pem"

$ dig +short TXT default._bimi.bimigroup.org
"v=BIMI1; l=https://bimigroup.org/bimi-sq.svg; a="

CNN publishes a certificate; the BIMI Group’s own domain publishes only the logo. Both rest on an enforced DMARC policy.

Why the logo doesn’t show up

• DMARC enforced only on a subdomain. If you send from news.example.com but example.com is still at p=none, providers refuse the logo.
• Wrong SVG profile. A missing baseProfile="tiny-ps" or an embedded PNG is enough for rejection.
• Logo mismatch. The SVG at l= must match the mark embedded in the certificate. Change the colour after issuance and you need a new certificate.
• Hosting problems. No valid HTTPS, or a redirect to a login page. Providers fetch the files anonymously.
• Too little volume. At a handful of messages a day, the avatar often stays blank even with a perfect setup.

Check the files with curl -I https://example.com/bimi/logo.svg; the content type should be image/svg+xml.

Is it worth the effort?

For a retailer or a bank sending thousands of messages a day, often yes. A recognisable logo next to an order confirmation helps customers tell real mail from phishing. For a freelancer sending twenty emails a day, probably not: the certificate cost is out of proportion, and at low volume providers don’t display logos reliably anyway.

The first step is the same either way: set up DMARC and use DMARC reports to confirm every sender is clean. The logo also has to live on a domain you control. If your domain and its DNS records are at betadomain, the _bimi record goes in the same zone, and the renewal prices match the first year. If you still need the matching .com for your brand, search for it before applying for a certificate.

Step by step

1. Enforce DMARCMove your domain to p=quarantine or p=reject. Every provider ignores BIMI under p=none.
2. Produce an SVG Tiny PS logoConvert your logo to SVG Tiny Portable/Secure: baseProfile tiny-ps, version 1.2, square, a title element, no scripts or external references.
3. Get a mark certificateApply to a certificate authority for a VMC (registered trademark) or a CMC (logo in use for at least twelve months). You receive a PEM file.
4. Host both files over HTTPSPublish the SVG and PEM on a web server with a valid certificate, for example https://example.com/bimi/logo.svg.
5. Publish the BIMI recordAdd a TXT record at default._bimi.example.com with v=BIMI1; l=URL-of-SVG; a=URL-of-PEM and verify it with dig.