Technical Reference · 2026 Edition

what-is-bimi-email-authentication

Last updated August 1, 2026 6 min read

yaml

---

title: "What is BIMI? Brand Indicators for Message Identification"
description: "BIMI (Brand Indicators for Message Identification) allows you to display your verified brand logo in email clients. Here is how the standard works."
date: "2026-07-01"

What is BIMI? Brand Indicators for Message Identification

BIMI stands for Brand Indicators for Message Identification. It is an email specification that lets organizations display a verified brand logo directly in a recipient's inbox, next to the sender name. The logo appears before the email is opened. It signals authenticity at a glance.

The standard is maintained by the AuthIndicators Working Group, a coalition of email providers and security companies. Major inbox providers — including Gmail, Apple Mail, and Yahoo Mail — have adopted it.

How BIMI Works

BIMI builds on existing email authentication infrastructure. It does not replace DMARC, SPF, or DKIM. It extends them.

The flow works like this:

A sender publishes a DMARC policy with enforcement (p=quarantine or p=reject).
A BIMI DNS record is published pointing to a hosted logo file.
Optionally, a Verified Mark Certificate (VMC) is attached to prove trademark ownership.
The receiving mail server checks authentication, retrieves the logo, and renders it in the inbox UI.

No action is required from the recipient. The logo display is automatic when all conditions are met.

The DNS Record

BIMI is configured via a TXT record in DNS. The record lives at a specific subdomain:

text

_bimi.<yourdomain>.com

A standard BIMI DNS record looks like this:

text

_bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

Field breakdown:

| Field | Description | |-------|-------------| | v=BIMI1 | Protocol version. Required. | | l= | URL to the SVG logo file. Required for display. | | a= | URL to the VMC certificate (PEM format). Required by Gmail. |

You can also publish a default selector record or named selectors for use with specific mail streams.

A default record uses the default selector:

text

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=..."

Named selectors allow different logos for different sending domains or ESP configurations.

SVG Requirements

The logo file must be an SVG. Not just any SVG — a Tiny P/S SVG. This is a strict subset of the SVG 1.2 Tiny profile defined by the AuthIndicators Working Group.

Requirements include:

File must be a valid SVG Tiny P/S document.
Must include a </code> element for accessibility.</li> <li class="md-li">No embedded raster images (no PNG or JPEG inside the SVG).</li> <li class="md-li">No scripts or interactive elements.</li> <li class="md-li">Must be square aspect ratio (1:1 viewBox).</li> <li class="md-li">File size should not exceed 32 KB.</li> <li class="md-li">Must be served over HTTPS.</li> </ul> <p class="md-p"> Most design tools — Illustrator, Figma, Sketch — do not export SVG Tiny P/S natively. Their outputs include unsupported elements. This is the most common reason BIMI fails silently. </p> <p class="md-p"> <strong><a href="https://makebimi.com" class="md-link" target="_blank" rel="noopener">makeBIMI.com</a></strong> converts a standard SVG into a compliant BIMI SVG Tiny P/S file. Upload a vector logo, and it outputs a specification-conformant file ready for hosting. The tool is free and requires no account. </p> <hr class="md-hr" /> <h2 id="the-verified-mark-certificate-vmc" class="md-h2">The Verified Mark Certificate (VMC)</h2> <p class="md-p"> A VMC is a digital certificate that cryptographically ties a logo to a registered trademark. It is issued by accredited certificate authorities. </p> <p class="md-p"> Gmail requires a VMC. Without one, Gmail will not display the BIMI logo — even if the DNS record and SVG are correctly configured. Yahoo Mail and Fastmail currently display logos without a VMC, relying on DMARC enforcement alone. </p> <p class="md-p"> VMC requirements: </p> <ul class="md-ul"> <li class="md-li">The logo must be a registered trademark in at least one jurisdiction.</li> <li class="md-li">The SVG embedded in the certificate must match the publicly hosted SVG.</li> <li class="md-li">The certificate must be issued by an approved CA (currently DigiCert, Entrust, and HARICA).</li> <li class="md-li">The certificate is renewed annually.</li> </ul> <p class="md-p"> <strong><a href="https://veribimi.com" class="md-link" target="_blank" rel="noopener">veriBIMI.com</a></strong> handles VMC procurement. It acts as a certificate broker, working with accredited CAs to issue VMCs on behalf of brand owners. The process includes trademark verification and SVG validation before submission. </p> <hr class="md-hr" /> <h2 id="dmarc-prerequisites" class="md-h2">DMARC Prerequisites</h2> <p class="md-p"> BIMI will not function without a properly configured DMARC record. The DMARC policy must be at enforcement level. </p> <p class="md-p"> A minimum compliant DMARC record: </p> <div class="md-code-block"><div class="md-code-lang">text</div><pre><code class="lang-">_dmarc.example.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" </code></pre></div> <p class="md-p"> <code class="md-inline-code">p=none</code> is a monitoring policy only. It does not satisfy BIMI requirements. Mail providers will not render the logo if the DMARC policy is <code class="md-inline-code">none</code>. </p> <p class="md-p"> SPF and DKIM must also be configured and passing for the sending domain. BIMI is the last layer in a chain. Every link must hold. </p> <hr class="md-hr" /> <h2 id="inbox-provider-support" class="md-h2">Inbox Provider Support</h2> <h3 id="gmail" class="md-h3">Gmail</h3> <p class="md-p"> Gmail requires both a valid BIMI DNS record and a VMC. The logo appears as a circular avatar next to the sender name in the inbox list view and the message header. Gmail checks both the <code class="md-inline-code">l=</code> and <code class="md-inline-code">a=</code> fields. A missing or invalid VMC results in no logo, with no error shown to the sender. </p> <h3 id="apple-mail" class="md-h3">Apple Mail</h3> <p class="md-p"> Apple Mail (iOS 16+ and macOS Ventura+) supports BIMI without requiring a VMC. It renders the logo if DMARC is at enforcement and the SVG is valid. Apple shows the logo in the message list and the message detail view. </p> <h3 id="yahoo-mail" class="md-h3">Yahoo Mail</h3> <p class="md-p"> Yahoo Mail was one of the earliest adopters of BIMI. It supports logo display without a VMC, provided DMARC is enforcing. Yahoo renders the logo in both the inbox list and message view. </p> <h3 id="other-clients" class="md-h3">Other Clients</h3> <p class="md-p"> Fastmail supports BIMI without a VMC. Proton Mail and Microsoft Outlook do not currently support BIMI natively. Outlook uses its own BIMI-adjacent system called BIMI for Microsoft, which has separate requirements and is not part of the open standard. </p> <hr class="md-hr" /> <h2 id="common-implementation-errors" class="md-h2">Common Implementation Errors</h2> <p class="md-p"> <strong>Wrong SVG format.</strong> Using a standard SVG instead of SVG Tiny P/S is the most frequent mistake. Validate the file before hosting it. </p> <p class="md-p"> <strong>HTTP instead of HTTPS.</strong> The logo URL must be HTTPS. Plain HTTP will fail validation. </p> <p class="md-p"> <strong>DMARC policy at <code class="md-inline-code">none</code>.</strong> Enforcement is required. Audit your DMARC record before debugging BIMI. </p> <p class="md-p"> <strong>Mismatched VMC logo.</strong> The SVG in the VMC must be identical to the one served at the <code class="md-inline-code">l=</code> URL. Any mismatch invalidates the certificate check. </p> <p class="md-p"> <strong>DNS propagation delays.</strong> After publishing or updating the BIMI TXT record, allow up to 48 hours for full propagation before testing. </p> <hr class="md-hr" /> <h2 id="testing-bimi" class="md-h2">Testing BIMI</h2> <p class="md-p"> Several tools can verify a BIMI implementation: </p> <ul class="md-ul"> <li class="md-li"><strong>BIMI Inspector</strong> (bimi-inspector.com) checks DNS, SVG validity, and VMC status.</li> <li class="md-li"><strong>MXToolbox</strong> has a BIMI lookup tool for DNS record validation.</li> <li class="md-li"><strong>Google Postmaster Tools</strong> shows aggregate sender reputation data, useful for diagnosing DMARC issues upstream of BIMI.</li> </ul> <p class="md-p"> Send a test email to a Gmail account and inspect the inbox. If the logo does not appear, check the DNS record, SVG compliance, and VMC validity in that order. </p> <hr class="md-hr" /> <h2 id="summary" class="md-h2">Summary</h2> <p class="md-p"> BIMI is a layered standard. It depends on DMARC, SPF, and DKIM being correctly configured first. The logo file must conform to SVG Tiny P/S. Gmail requires a VMC for display. Other providers are less strict. </p> <p class="md-p"> The specification rewards senders who have invested in email authentication. The logo is a visible result of invisible infrastructure. Getting there requires precise technical implementation — but the path is well-documented. </p> <p class="md-p"> Start with a compliant SVG at <a href="https://makebimi.com" class="md-link" target="_blank" rel="noopener">makeBIMI.com</a>. Obtain a VMC through <a href="https://veribimi.com" class="md-link" target="_blank" rel="noopener">veriBIMI.com</a>. Publish the DNS record. The logo follows. </p> </div> <div class="doc-footer"> <a href="/" class="btn btn-primary">Convert Your Logo →</a> <a href="/check" class="btn btn-secondary">Audit Your Domain</a> </div> </main> </div> <footer> <div class="container footer-inner"> <div class="footer-left"> <span class="footer-copyright">© 2026 makeBIMI™</span> </div> <div class="footer-links"> <a href="/global" class="footer-link">Global</a> <a href="/knowledge">Learn</a> <a href="/certificates">VMC</a> <a href="https://veribimi.com" class="seo-link" rel="noopener">veriBIMI<sup style="font-size:0.45em; font-weight:400; color:rgba(247,248,248,0.28); position:relative; top:-0.5em; margin-left:1px; vertical-align:baseline;">℠</sup></a> <a href="https://veribimi.com/founder" rel="noopener">Founder</a> <a href="https://veribimi.com/privacy" rel="noopener">Privacy</a> </div> </div> </footer> <div class="cmd-overlay" id="cmd-overlay" role="dialog" aria-modal="true" aria-label="Command palette"> <div class="cmd-modal"> <div class="cmd-search-row"> <svg class="cmd-search-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="11" cy="11" r="8"/><path d="m21 21-4.35-4.35"/></svg> <input type="text" class="cmd-input" id="cmd-input" placeholder="Search documentation, navigate pages…" autocomplete="off" /> <span class="cmd-esc">ESC</span> </div> <div class="cmd-results" id="cmd-results"></div> <div class="cmd-footer"> <span><kbd>↑↓</kbd> Navigate</span> <span><kbd>↵</kbd> Select</span> <span><kbd>ESC</kbd> Close</span> </div> </div> </div> <div class="toast-container" id="toast-container"></div>  <script> window.DOC_SECTIONS = [{"id":"what-is-bimi-brand-indicators-for-message-identification","level":1,"text":"What is BIMI? Brand Indicators for Message Identification","anchor":"what-is-bimi-brand-indicators-for-message-identification","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"how-bimi-works","level":2,"text":"How BIMI Works","anchor":"how-bimi-works","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"the-dns-record","level":2,"text":"The DNS Record","anchor":"the-dns-record","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"svg-requirements","level":2,"text":"SVG Requirements","anchor":"svg-requirements","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"the-verified-mark-certificate-vmc","level":2,"text":"The Verified Mark Certificate (VMC)","anchor":"the-verified-mark-certificate-vmc","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"dmarc-prerequisites","level":2,"text":"DMARC Prerequisites","anchor":"dmarc-prerequisites","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"inbox-provider-support","level":2,"text":"Inbox Provider Support","anchor":"inbox-provider-support","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"gmail","level":3,"text":"Gmail","anchor":"gmail","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"apple-mail","level":3,"text":"Apple Mail","anchor":"apple-mail","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"yahoo-mail","level":3,"text":"Yahoo Mail","anchor":"yahoo-mail","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"other-clients","level":3,"text":"Other Clients","anchor":"other-clients","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"common-implementation-errors","level":2,"text":"Common Implementation Errors","anchor":"common-implementation-errors","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"testing-bimi","level":2,"text":"Testing BIMI","anchor":"testing-bimi","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"},{"id":"summary","level":2,"text":"Summary","anchor":"summary","slug":"what-is-bimi-email-authentication","docTitle":"what-is-bimi-email-authentication"}]; </script> <script src="/public/js/app.js?v4"></script> <script src="/public/js/toc.js?v4"></script> <script src="/public/js/interactions.js?v4"></script>  <div id="cookie-consent-banner" style="display:none;" role="dialog" aria-label="Cookie consent"> <div class="cookie-consent-inner"> <p class="cookie-consent-text"> We use Google Analytics to understand how visitors use this tool. No advertising cookies are set. <a href="https://veribimi.com/privacy" rel="noopener" class="cookie-consent-link">Privacy Policy</a> </p> <div class="cookie-consent-actions"> <button class="cookie-consent-btn cookie-consent-accept" onclick="acceptCookies()">Accept</button> <button class="cookie-consent-btn cookie-consent-decline" onclick="declineCookies()">Decline</button> </div> </div> </div> <script> (function() { // Only show for EU/EEA countries (Cloudflare sets CF-IPCountry via meta tag injected server-side) var country = document.documentElement.getAttribute('data-country') || ''; var EU_COUNTRIES = ['AT','BE','BG','CY','CZ','DE','DK','EE','ES','FI','FR','GR','HR', 'HU','IE','IT','LT','LU','LV','MT','NL','PL','PT','RO','SE','SI','SK', 'IS','LI','NO','GB','CH']; // EEA + UK + Switzerland (nFADP) var consent = localStorage.getItem('makebimi_cookie_consent'); if (!consent && EU_COUNTRIES.indexOf(country) !== -1) { document.getElementById('cookie-consent-banner').style.display = 'block'; } if (consent === 'declined') { // Remove GA4 script if previously declined var scripts = document.querySelectorAll('script[src*="googletagmanager"]'); scripts.forEach(function(s) { s.parentNode && s.parentNode.removeChild(s); }); } })(); function acceptCookies() { localStorage.setItem('makebimi_cookie_consent', 'accepted'); document.getElementById('cookie-consent-banner').style.display = 'none'; } function declineCookies() { localStorage.setItem('makebimi_cookie_consent', 'declined'); document.getElementById('cookie-consent-banner').style.display = 'none'; // Disable GA4 for this session window['ga-disable-G-S1HG2ZB83B'] = true; } </script> </body> </html>