BIMI, Brand Indicators for Message Identification, is the standard that displays your logo next to your messages in a supporting mail client. It is often sold as a deliverability feature, but BIMI has no effect on whether your mail arrives. It gives you a visible reward for having your email authentication fully in order, because you cannot turn it on until DMARC is enforcing. The logo is the carrot; DMARC enforcement is the price of admission.
The Hard Prerequisite: DMARC at Enforcement
You cannot publish a usable BIMI record while your DMARC policy is p=none. Mailbox providers require your policy to be p=quarantine (with pct=100) or p=reject. That single requirement is why most organizations that want BIMI are not ready for it: getting to enforcement means you have already identified and fixed every legitimate mail stream that was failing alignment, which is the hard part of email authentication.
_dmarc.example.com. IN TXT
"v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
If you are still at p=none, your next step is reading your DMARC aggregate reports and working up to enforcement. Come back to the logo afterward.
The BIMI DNS Record
Once DMARC is enforcing, BIMI itself is a single TXT record pointing at two things: your logo, and (for most providers) a certificate that vouches for it.
default._bimi.example.com. IN TXT
"v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"
l=is the HTTPS URL of your logo.a=is the HTTPS URL of your Verified Mark Certificate. Leave it empty and Gmail, among others, will not display the logo.
The Logo Has to Be SVG Tiny PS, and Nothing Else
This is where teams lose a week. BIMI requires a specific, restricted SVG profile called SVG Portable/Secure Tiny (SVG Tiny 1.2 PS), and an ordinary export from a design tool won't pass. The profile allows no scripts, no external references, and no embedded raster images, and it expects a single square logo on a solid background. Most logos need to be redrawn or heavily cleaned to conform.
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
viewBox="0 0 512 512">
<title>Example Corp</title>
<rect width="512" height="512" fill="#ff7800"/>
<path d="..." fill="#ffffff"/>
</svg>
The baseProfile="tiny-ps" attribute and a <title> are both mandatory. A logo that renders perfectly in a browser will still be rejected if it declares the wrong profile or references an external font.
The VMC Is a Real Cost
A Verified Mark Certificate is issued by a small number of authorized CAs after they verify that you own the trademark on the logo. That is the catch most people do not budget for: you generally need a registered trademark for the logo, in the relevant jurisdiction, before a VMC can be issued at all. The certificate then costs on the order of a thousand dollars a year, and the trademark registration behind it, if you do not already have one, is a longer and larger expense.
| Requirement | What it takes |
|---|---|
DMARC p=quarantine/p=reject |
Weeks of alignment work; free |
| SVG Tiny PS logo | Redraw/clean the logo to the restricted profile |
| Registered trademark | Legal filing; months and real money if you lack one |
| VMC from an authorized CA | ~$1,000+/year, renewed like any cert |
| HTTPS hosting for logo + VMC | A valid TLS endpoint you keep alive |
There is a lighter path. A Common Mark Certificate (CMC) accepts unregistered logos that have been in public use, at a lower bar, but support is narrower than for VMCs. Check which your target mailbox providers honor before you buy either.
It Is Still a Certificate You Have to Renew
The part that gets forgotten the day after launch: the VMC is a certificate with an expiry, and the logo and VMC are served from an HTTPS endpoint that has its own certificate. Let either lapse and the logo quietly disappears from the inbox, with no alert unless you were watching. You spent real money to earn that logo; treat both certificates as monitored infrastructure. Generator Labs certificate monitoring tracks the TLS endpoint hosting your logo and VMC and alerts before its certificate expires, and it runs alongside the SSL certificate checks you would run by hand. BIMI is the visible payoff for authentication done right; keeping it visible is a monitoring job. Start monitoring.