BIMI: How to Show Your Logo in Gmail, Yahoo and Apple Mail

BIMI (Brand Indicators for Message Identification) puts your logo next to your messages in the inbox instead of a grey initial. It's the visible payoff for doing email authentication properly, because no major provider will show your logo until your domain is at DMARC enforcement. This guide covers what each provider requires, the difference between VMC and CMC certificates, how to prepare an SVG Tiny PS logo, and the DNS record to publish.

How BIMI works

1. You publish a DMARC policy at enforcement (quarantine or reject).
2. You publish a BIMI TXT record that points to your logo and, for most providers, a mark certificate that proves you're entitled to use it.
3. When a message passes DMARC, the receiving provider looks up your BIMI record, validates the logo and certificate, and decides whether to display it.

BIMI doesn't improve deliverability by itself. The underlying authentication does. What BIMI does is make your authenticated mail visually distinct from spoofed mail.

Provider support at a glance

Provider policies change, so confirm current status with the BIMI Group and each provider before you buy a certificate.

Step 1: get DMARC to enforcement

This is the requirement that stops most businesses, and the hardest part.

• Gmail requires p=quarantine or p=reject, applied to all mail (pct=100).
• The BIMI Group says DMARC must be at enforcement on the organizational domain and its subdomains. p=none and a pct below 100 are not accepted.
• Yahoo requires a policy of quarantine or reject, and prefers BIMI and DMARC at the organizational domain.

A record that qualifies:

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"

Leaving out pct means 100% under the original DMARC spec, and the new RFC 9989 removes pct entirely. Avoid sp=none and test mode (t=y), which weaken enforcement. If you're still at p=none, follow the rollout plan in DMARC explained first. It will take longer than everything else in this guide put together.

Step 2: choose a certificate (VMC or CMC)

Mark certificates are issued by certificate authorities that act as Mark Verifying Authorities. The BIMI Group maintains the list of issuers.

Verified Mark Certificate (VMC)

• Requires your logo to be a registered trademark with an intellectual property office that VMC issuers recognize.
• In Gmail, adds a blue checkmark next to your sender name.
• Accepted by Gmail and Apple Mail.
• Google notes that trademark registration can take 6 to 12 months if you haven't done it yet.

Common Mark Certificate (CMC)

• No trademark needed. Instead, you show prior use. GlobalSign, for example, requires the logo to have been in use for at least 12 months and to appear on your current website.
• Shows your logo in Gmail, but without the blue checkmark.
• Not accepted by Apple Mail.

Issuers also check DMARC themselves. GlobalSign requires quarantine (at 100%) or reject to have been in place for at least 30 days before you order, so publish enforcement before you start the paperwork.

Certificates are issued for a fixed term and must be renewed. When you renew, the PEM file at your published URL needs updating.

Can I skip the certificate?

You can publish a "self-asserted" BIMI record with only a logo URL. Yahoo can display it if your sending reputation qualifies. Gmail and Apple Mail won't. For most businesses, that means a certificate is needed for the logo to appear widely.

Step 3: prepare the SVG Tiny PS logo

BIMI logos must use the SVG Tiny Portable/Secure (Tiny PS) profile, a restricted subset of SVG designed so it can't carry scripts or pull in external content. A normal SVG exported from a design tool will almost always fail.

Requirements from Gmail's BIMI documentation and the BIMI Group:

• Root element uses version="1.2" and baseProfile="tiny-ps".
• A <title> element containing your brand name.
• Square artwork, centered, on a solid background (it will be cropped to a circle or rounded square).
• No scripts, animation, interactive elements, external references or embedded raster images.
• No x= or y= attributes on the root <svg> element.
• Gmail requires absolute dimensions of at least 96 x 96 pixels and recommends a file of 32 KB or less.

A minimal skeleton:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
     viewBox="0 0 512 512" width="512" height="512">
  <title>Example Co</title>
  <desc>Example Co logo</desc>
  <rect width="512" height="512" fill="#0B5FFF"/>
  <path fill="#FFFFFF" d="M136 136h240v60H206v50h150v60H206v70h170v60H136z"/>
</svg>

Practical tips:

• Start from the simplest vector version of your logo. Gradients, masks and many paths increase size and complexity.
• Convert text to paths, since fonts can't be referenced.
• Inline all styling as attributes. Even a <style> block can fail validation.
• Run the file through a BIMI SVG validator before you submit it to a certificate issuer. The issuer embeds this exact logo in your certificate.

Step 4: host the files

• Host the SVG and the PEM certificate file on HTTPS URLs with a valid certificate. Google recommends TLS 1.2 or later.
• The PEM file contains the logo plus the certificate chain. Your issuer provides it.
• Keep the URLs stable. Changing them means updating DNS.

Step 5: publish the BIMI record

The record goes on default._bimi under your domain:

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://www.example.com/bimi/logo.svg; a=https://www.example.com/bimi/vmc.pem"

• v=BIMI1: version, must be first.
• l=: HTTPS URL of the SVG logo.
• a=: HTTPS URL of the PEM certificate (VMC or CMC).

Google's own example for certificate-based BIMI leaves l= empty (v=BIMI1;l=;a=https://...pem), because Gmail takes the logo from inside the certificate. Many senders fill in both, so providers that don't use certificates, like Yahoo, can still find the logo. Without a certificate, publish only l=:

default._bimi.example.com.  TXT  "v=BIMI1; l=https://www.example.com/bimi/logo.svg"

default is the selector providers look up automatically. Google says the logo can take up to 48 hours to appear after you publish the record.

You can run a free audit to confirm your BIMI record is published and readable, alongside your DMARC policy.

Troubleshooting a logo that won't show

• DMARC not at enforcement, or pct below 100, or sp=none. Check the record receivers actually see, not the one you meant to publish.
• Message didn't pass DMARC. BIMI only applies to messages that pass. Check a real message's headers.
• SVG fails Tiny PS validation. The most common technical cause.
• Certificate problems. Expired, the wrong file at the URL, or a logo that doesn't match the certificate.
• Wrong domain. BIMI is looked up for the From: domain. A record on example.com won't help mail from a different brand domain.
• Reputation and volume. Yahoo only shows logos for bulk mail from senders with enough reputation and engagement, and providers can choose not to show logos for any sender.

Frequently asked questions

Does BIMI improve email deliverability?

Not directly. The DMARC enforcement BIMI requires does protect your domain from spoofing and supports good reputation. The logo itself mainly helps recognition and trust once the mail is in the inbox.

Is a VMC worth it over a CMC?

A VMC adds Gmail's blue checkmark and works in Apple Mail, but requires a registered trademark. A CMC is quicker if you don't have a trademark and is enough for Gmail logo display. Choose based on whether you already hold a trademark and how important Apple Mail is to your audience.

Can I use BIMI on a subdomain?

Yes. Providers look up BIMI for the From: domain, and Yahoo honors subdomain records. Your organizational domain still needs DMARC at enforcement, and Yahoo prefers BIMI and DMARC set up at the organizational domain level.

Why does Outlook not show my BIMI logo?

Microsoft's consumer and business mail don't currently display BIMI logos. Your record does no harm there, and it will be used if support is added later.

What to do next

Check where your DMARC policy stands today. If it isn't at quarantine or reject, that's your real BIMI project. Meanwhile, start on the logo: get a clean, square vector version validated as SVG Tiny PS, and check whether your logo is trademarked to decide between a VMC and a CMC. The email authentication checklist shows everything else that should be in place first.

Sources

• Google Workspace Admin Help: Set up BIMI
• BIMI Group: Implementation guide
• Yahoo Sender Hub: BIMI
• GlobalSign: Order a Common Mark Certificate