Setup Guides · BIMI
BIMI Setup Guide: Publish Your Logo, and When You Need a VMC or CMC
BIMI puts your brand logo - and, with the right certificate, a blue verified check - next to your name in the inbox. But it only displays on top of an enforced DMARC policy, the logo has to be a very specific kind of SVG, and whether you need a paid certificate depends entirely on which mailboxes you care about. This guide walks the exact setup, the VMC-vs-CMC decision, and the failures we keep finding in audits.
Last updated 11 August 2026 · applies to any domain already at DMARC enforcement
BIMI (Brand Indicators for Message Identification) is a standard that lets a domain display its own verified brand logo next to its messages in the inbox. It grew out of a 2019 pilot at Verizon Media (Yahoo and AOL), reached general availability in Gmail in July 2021, and today displays in Gmail, Yahoo, Apple Mail and Fastmail. Its purpose is two things at once: give recipients a recognizable, hard-to-fake brand cue that helps them trust genuine mail over phishing, and reward the senders who lock their domain down with DMARC - the logo is the visible payoff for doing the authentication work. BIMI layers on top of DMARC and, despite being supported in production by Gmail, Yahoo, Apple and Fastmail, is still an IETF Internet-Draft - it has never been published as an RFC.
What it looks like, and what a certificate buys you
The single most confusing thing about BIMI is that a logo can appear without paying for anything at some mailbox providers, while others show nothing until you buy a certificate - and the blue checkmark is a separate thing again. Where it shows is worth knowing too: the logo replaces the coloured-initials placeholder in two places - next to your name in the inbox list, and in the message header when the email is opened - so recipients recognise the brand before and after the click. Here is the premium result in Gmail: a logo backed by a Verified Mark Certificate.
On CMC in the wild: a Common Mark Certificate technically shows a logo in Gmail with no blue check - but in practice these are rare. Almost every logo you actually see in Gmail carries the blue check (a VMC); a "logo without a check" is hard to find. So if the Gmail logo is the goal, a VMC is the realistic route.
Heads up: a valid setup is necessary, but not sufficient
Even with a perfect record, logo and certificate, the logo only appears once the sending domain has an established sending reputation at that mailbox provider. BIMI is built for bulk senders - a brand-new or low-volume domain, or a one-off test message, usually shows no logo until real, reputable volume builds up. Reputation is also per-provider (good standing at Gmail does not carry to Yahoo), and providers validate and cache the BIMI record asynchronously, so the logo can take a while to appear after you publish.
Before you start: the one hard prerequisite
BIMI does not display for a domain unless its DMARC policy is at enforcement - p=quarantine or p=reject, applied to 100% of mail, with SPF and DKIM aligned. This is deliberate: the logo is the reward for locking your domain against spoofing. If your DMARC is still p=none, no logo will show anywhere, certificate or not. Confirm where you stand with our free DMARC Monitor, and if you are not enforcing yet, work through SPF, DKIM and DMARC first.
The setup, step by step
1 Confirm DMARC is enforcing
Your record must read p=quarantine or p=reject (not p=none) and your legitimate mail must already pass aligned SPF or DKIM. If it does not, stop here and fix authentication first - BIMI on top of a broken DMARC just hides the problem.
2 Prepare the logo as an SVG Tiny 1.2 P/S
BIMI does not accept an ordinary SVG or a PNG. It requires the SVG Tiny 1.2 Portable/Secure profile: a square viewBox, a solid (non-transparent) background, a <title>, baseProfile="tiny-ps", and no scripts, external references, animation or raster images. Keep it small (well under 32 KB). Exporting a normal SVG from your design tool is the number-one reason a logo never appears.
3 Host the SVG over HTTPS
Upload the file to a stable HTTPS URL on your own domain and confirm it is served with Content-Type: image/svg+xml. A logo behind a redirect, behind a login, or with the wrong MIME type will be rejected.
4 Publish the BIMI DNS record
Add a TXT record at default._bimi.yourdomain.com. Without a certificate it is just the version and the logo URL:
default._bimi.yourdomain.com TXT v=BIMI1; l=https://yourdomain.com/assets/bimi/logo.svg;
Once you have a certificate (next step), add the a= tag pointing at its PEM URL:
v=BIMI1; l=https://yourdomain.com/.../logo.svg; a=https://yourdomain.com/.../vmc.pem;
5 Decide on a certificate (only if you want Gmail or Apple)
If you only care about Yahoo, AOL and Fastmail, you are already done - skip the certificate. To appear in Gmail or Apple Mail, you need a VMC or a CMC. The table below is the whole decision.
6 Verify it
Check the record and preview the rendered logo with our free BIMI checker, then send a real test to a Yahoo mailbox (the logo appears without a certificate) and, if you bought one, a Gmail mailbox.
VMC vs CMC: which one do you need?
| Self-asserted (no certificate) | CMC (Common Mark) | VMC (Verified Mark) | |
|---|---|---|---|
| Logo requirement | any BIMI-compliant logo (self-asserted) - supported by only some providers | logo publicly used for at least 12 months | a registered trademark |
| Logo in Yahoo / AOL / Fastmail | Yes | Yes | Yes |
| Logo in Gmail | No | Yes | Yes |
| Blue verified check in Gmail | No | No | Yes |
| Shows in Apple Mail (iOS 16+) | No | No | Yes |
| Rough cost / year | free | ~$650 - $1,150 | ~$750 - $1,550 |
| Issuers | - | DigiCert, GlobalSign, SSL.com | DigiCert, GlobalSign, SSL.com |
Notes: Outlook does not display BIMI at all yet, at any tier. The issuer row reflects the BIMI Group's current issuer list - and mailbox providers independently decide which issuers' certificates they accept, so check both before buying. VMC eligibility can also include certain government marks alongside registered trademarks. Apple Mail display additionally depends on the recipient's mail provider validating the BIMI evidence; VMC is the established certificate-backed route there - CMC support should not be assumed. Pricing checked August 2026 - it moves around, so confirm when you buy. A CMC is the cheaper route to a Gmail logo if you do not hold a registered trademark, though in practice CMC-only logos are uncommon; the blue check is VMC-only.
How the VMC process actually runs: the sequence is trademark-first. Your logo must already be a registered trademark with an accepted national trademark office before you apply - the certificate authority then validates your organisation's legal identity, checks that the logo in your application exactly matches the registered mark, and completes a verification step with a real representative of your organisation before issuing. The certificate itself typically arrives in days to a few weeks; the trademark is the long pole. If you do not hold one, either start the trademark registration now or take the CMC route (12 months of documented public use, no trademark) while it is pending.
The failures we keep finding
DMARC is still at p=none
The most common one by far. The record and logo are perfect, but nothing shows because BIMI requires enforcement. Move to p=quarantine then p=reject first.
A normal SVG instead of SVG Tiny 1.2 P/S
Exported straight from a design tool. It looks fine in a browser but fails validation. Convert it to the Tiny P/S profile with a proper title and a solid background.
The logo is not square, is transparent, or contains a script or external link
Any of these invalidates the file. Square viewBox, opaque background, fully self-contained, no scripting.
The logo URL is not HTTPS or returns the wrong content-type
Served over HTTP, behind a redirect, or with the wrong MIME type. It must be a direct HTTPS link returning image/svg+xml.
Expecting the blue check from a CMC
A CMC gets your logo into Gmail but never the blue verified check - that is VMC-only. If the checkmark is the goal, you need a registered trademark and a VMC.
Expecting Gmail (no cert) or Outlook to show it
Gmail shows nothing without a certificate; Outlook does not participate at all. A no-cert setup only lights up Yahoo, AOL and Fastmail.
Verify it end to end
- Record + logo preview: run your domain through the free BIMI checker - it parses the record and renders the SVG exactly as a mailbox would.
- Confirm enforcement: BIMI needs DMARC at
p=quarantineorp=reject- check yours with the free DMARC Monitor. - Real-inbox test: send a message to a Yahoo mailbox (logo displays without a certificate) and, once you have one, a Gmail mailbox.
Frequently asked questions
Do I need a VMC to use BIMI?
No. You can publish BIMI with no certificate and your logo will appear in Yahoo, AOL and Fastmail. You only need a certificate for Gmail (a VMC or CMC) or Apple Mail (a VMC), and only a VMC unlocks the blue verified check.
What is the difference between a VMC and a CMC?
A VMC requires a registered trademark for your logo and unlocks the Gmail logo, the blue verified check, and Apple Mail. A CMC needs no trademark - just proof the logo has been in public use for about a year - and unlocks the Gmail logo only (no blue check, no Apple).
How long does it take to get a VMC?
The certificate itself is the fast part - typically days to a few weeks, covering legal-identity validation, a check that your logo exactly matches the registered trademark, and a verification step with a representative of your organisation. The long pole is the trademark: your logo must already be registered with an accepted national trademark office before you can apply. No trademark yet? Start the registration now, or use a CMC (12 months of documented public use) in the meantime.
Does BIMI improve deliverability?
Not directly. BIMI does not change filtering. Its value is the visible logo and checkmark, which raise recognition and trust - and the requirement to enforce DMARC first, which genuinely helps. The logo is the incentive to do the authentication work.
Why is my logo not showing even though the setup looks correct?
Four usual causes: DMARC is not at enforcement, you have no VMC/CMC, the SVG is not a valid Tiny 1.2 P/S file, or - with all of that correct - your domain simply does not yet have the sending reputation the provider requires. Our BIMI checker pinpoints the record and SVG issues; reputation is earned over time with real, authenticated volume, which is why a one-off test from a low-volume domain often shows nothing.
Does Outlook show BIMI logos?
Not currently. Microsoft's consumer and business mail do not display BIMI logos, so plan around Gmail, Yahoo, Apple and Fastmail.
Want the why behind the how? Read BIMI: the logo is the bribe, enforcement is the point - our explainer on whether BIMI is worth it and how the certificates really work.
Want the logo in every inbox without the certificate maze?