The short answer: To use BIMI you need DMARC enforced at p=quarantine or p=reject with pct=100, passing SPF or DKIM aligned with your From domain, a square SVG Tiny PS logo hosted over HTTPS, and a BIMI DNS record at default._bimi. Gmail additionally needs a certificate: a Verified Mark Certificate (VMC, needs a registered trademark) for the checkmark, or a Common Mark Certificate (CMC) for the logo alone.
This article covers what each requirement means and whether it is worth the effort. For the hands-on DNS steps, follow the BIMI setup guide.
Requirement 1: Enforced DMARC
BIMI is built on DMARC. Mailbox providers will not show a logo for a domain that has not committed to blocking spoofed mail.
| DMARC setting | BIMI requirement |
|---|---|
p= |
quarantine or reject. p=none does not qualify. |
pct= |
100, or omitted (100 is the default). Partial enforcement disqualifies you. |
sp= |
If present, must not be none. A weaker subdomain policy undermines the claim. |
| Alignment | Mail must pass DMARC through aligned SPF or DKIM. |
Google's BIMI documentation states the policy must be quarantine or reject with pct=100. A compliant record looks like this:
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; pct=100; rua=mailto:dmarc@example.com"
If you are still at p=none, that is the real project. Read DMARC policy: none, quarantine, reject and how to read DMARC aggregate reports to get there safely. Check where you stand with the DMARC checker.
Requirement 2: The Logo File
BIMI does not accept a normal SVG. The format is SVG Tiny Portable/Secure (SVG Tiny PS), a restricted profile with no scripts, external references or animation.
Practical rules:
- The root
<svg>element must includeversion="1.2"andbaseProfile="tiny-ps". - Square aspect ratio. Mailbox providers crop it into a circle or rounded square, so keep key shapes away from the edges.
- Google's documentation lists a minimum of 96x96 pixels and recommends a file under 32 KB.
- A solid background colour works best, as many clients do not support transparency well.
- Include a
<title>and ideally a<desc>element. - Host it on an HTTPS URL that returns the file reliably. Do not restrict it behind a login or a hotlink block.
- Exported SVGs from design tools usually need cleaning. A "Save as SVG" from Illustrator or Figma will often contain unsupported elements.
Test the file with a BIMI validator before spending money on a certificate, since the certificate is issued for a specific logo file.
Requirement 3: A Certificate (VMC or CMC)
BIMI itself defines two levels. Without a certificate you can publish a logo-only record, and some providers will display it. Gmail requires a certificate.
VMC: Verified Mark Certificate
A VMC proves you own the logo through a registered trademark. A certificate authority validates the trademark with a recognized trademark office, validates your organization, and issues a certificate embedding your SVG. In Gmail, a VMC unlocks the logo and the verified checkmark.
CMC: Common Mark Certificate
A CMC was introduced for organizations without a registered trademark. Instead of a trademark, the authority checks that you have used the logo publicly for a period, which the BIMI group's guidance puts at at least 12 months. Gmail accepts a CMC and displays the logo, without the checkmark.
| VMC | CMC | |
|---|---|---|
| Evidence required | Registered trademark | Documented prior use of the logo (about 12 months) |
| Gmail logo | Yes | Yes |
| Gmail verified checkmark | Yes | No |
| Apple Mail | Yes | No |
| Typical cost | Higher | Generally lower |
| Logo allowed | Exactly as trademarked | Logo as used publicly, with limited modification rules |
Treat the Gmail checkmark and Apple support rows as the key decision drivers. Both are current as of this writing, but vendors revise their rules, so confirm with your certificate authority before buying.
How issuance works
- Finish DMARC enforcement and finalize the exact logo file.
- Pick an accredited authority (the BIMI Group lists them) and submit the SVG with your organization details.
- The authority verifies your organization, plus the trademark for a VMC or the logo-use evidence for a CMC. Expect this to take days to weeks, depending on how quickly you respond to verification requests.
- You receive a PEM file. Host it over HTTPS and reference it in the
a=tag. - Set a renewal reminder. The certificate is time-limited, and an expired one removes the logo.
What it costs
Certificates are an annual fee, and the price varies by authority, reseller and certificate type. VMCs are the more expensive option and a CMC is typically cheaper. Because pricing changes, get current quotes from two or three accredited authorities. Budget also for trademark registration if you do not have one, which takes months and legal fees, and for annual renewal.
Who Shows What
Support differs by mailbox provider, and it changes. The picture as of October 2026:
| Provider | Logo shown | Certificate needed | Notes |
|---|---|---|---|
| Gmail (consumer and Workspace) | Yes | VMC or CMC | VMC adds the checkmark. |
| Apple Mail / iCloud Mail | Yes | VMC | CMC is not accepted. Requires iOS 16 or macOS Ventura and later. |
| Yahoo Mail | Yes | Not required | Displays a logo-only record when other requirements pass. |
| Fastmail | Yes | Not required | Supports BIMI without a certificate. |
| Outlook / Microsoft 365 | No | n/a | No BIMI support at the time of writing. |
Two cautions. Display also depends on the provider's own judgment, including sender reputation, so a technically perfect record does not guarantee a logo. And providers update their rules without notice, so test with real mailboxes on each platform you care about.
The BIMI DNS Record
BIMI lives in a TXT record at default._bimi.yourdomain.com.
Logo only (no certificate):
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg;"
With a certificate (VMC or CMC):
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem;"
| Tag | Meaning |
|---|---|
v=BIMI1 |
Version, must come first. |
l= |
HTTPS URL of the SVG Tiny PS logo. |
a= |
HTTPS URL of the PEM file containing the certificate chain. |
Both URLs must be HTTPS and reachable without authentication. The certificate must have been issued for the same logo that l= serves. Google notes that records can take up to 48 hours to propagate.
Why Your Logo Is Not Showing
| Symptom | Likely cause | Fix |
|---|---|---|
| No logo anywhere | DMARC still p=none, or pct below 100 |
Move to enforcement at 100% |
| DMARC fails on some mail | Unaligned SPF and no DKIM alignment | Fix alignment for each sender |
| Logo shows in Yahoo, not Gmail | No a= certificate |
Add a VMC or CMC |
| Gmail shows a logo but no checkmark | CMC, not VMC | A VMC is needed for the checkmark |
| Nothing in Apple Mail | CMC, or no VMC | Apple needs a VMC |
| Record is ignored | Wrong host name or syntax | Must be exactly default._bimi, v=BIMI1 first |
| Certificate rejected | SVG changed after issuance, or PEM not accessible | Re-serve the exact file and certificate |
| Logo is distorted or blank | Non-compliant SVG | Re-export as SVG Tiny PS and validate |
| Worked, then stopped | Certificate expired or DMARC regressed | Renew and recheck DMARC reports |
Send a test message to Gmail and Apple Mail accounts and wait up to two days after changes. The email header analyzer can confirm DMARC passes on the test message, and the email security score summarizes your authentication state.
Go or No-Go for a Small Business
BIMI is a brand feature, not a security control. Its security value comes from the DMARC enforcement it forces you to adopt. Use this to decide:
- Are you at
p=rejectorp=quarantineat 100%? If not, stop here. Do DMARC first, which gives most of the protection and deliverability benefit. Our email security setup service covers it. - Do customers mostly read in Gmail or Apple Mail? B2C and consumer brands benefit most. If your customers use Outlook, BIMI shows them nothing.
- Do you send meaningful volume of customer-facing mail? Newsletters, receipts and notifications give the logo something to do. A ten-person firm sending a few hundred emails a month gets little from it.
- Do you hold a registered trademark? Yes: a VMC is viable. No, but you have used the logo for over a year: a CMC may suit you, at the cost of no checkmark and no Apple support.
- Can you accept the annual certificate cost and the upkeep? If it is a stretch, publish a logo-only record for Yahoo and Fastmail at no certificate cost, and revisit later.
Go if you enforce DMARC, have customer-facing volume, and your audience is on Gmail or Apple Mail. No-go for now if you are at p=none, rely on Outlook-heavy B2B contacts, or have no budget for certificates. Either way, Google and Yahoo bulk sender requirements will matter more to your deliverability than a logo.
Frequently Asked Questions
What are the requirements for BIMI?
You need enforced DMARC (p=quarantine or p=reject, pct=100), an SVG Tiny PS logo on HTTPS, a default._bimi TXT record, and for Gmail a VMC or CMC certificate.
What is the difference between a VMC and a CMC?
A VMC requires a registered trademark and gives Gmail's checkmark plus Apple Mail support. A CMC requires evidence of roughly 12 months of logo use instead and shows the logo in Gmail without the checkmark.
Do I need a trademark for BIMI?
Only for a VMC. A CMC avoids that requirement, and Yahoo and Fastmail display logos without any certificate.
Does BIMI work in Outlook?
At the time of writing, Outlook and Microsoft 365 do not display BIMI logos. Check current provider documentation, as this can change.
Can I use BIMI with DMARC p=none?
No. BIMI needs enforced DMARC, so p=none disqualifies the domain. Move to quarantine or reject first.
How long does BIMI take to show up?
DNS changes can take up to 48 hours to propagate, and providers may take additional time to start displaying a logo after first detecting it.
Next step: Confirm your DMARC policy with the DMARC checker, then follow the BIMI setup guide. If you want DMARC moved to enforcement without breaking legitimate mail, request a free email audit.