Loading...
Loading...
BIMI (Brand Indicators for Message Identification) publishes a DNS record that lets Gmail, Apple Mail, and Yahoo display your brand logo next to authenticated messages, but only once DMARC is at enforcement and, for the major providers, a paid certificate vouches for the logo.
Missing BIMI is not a security hole - it is a missed trust and deliverability signal. When your logo appears in the inbox, recipients recognize the sender faster and phishing that lacks the logo stands out. Without BIMI you forfeit that visual authentication and the brand real estate at the top of the message. The catch is that BIMI is meaningless until DMARC is enforcing: publishing a BIMI record while DMARC sits at p=none does nothing except signal that authentication is incomplete. Treat BIMI as the reward for finishing SPF, DKIM, and DMARC, not as a standalone fix.
BIMI is an emerging standard from the AuthIndicators Working Group (IETF draft-blank-ietf-bimi), not yet a finished RFC. The record is a TXT entry at `default._bimi.yourdomain.com` (the `default` label is the selector; senders can point specific streams at other selectors with a `BIMI-Selector` header). It carries three tags: `v=BIMI1` (version), `l=` (the https URL of the logo), and `a=` (the https URL of the certificate, left empty for a self-asserted record). The logo must be SVG Portable/Secure (SVG P/S), a locked-down profile of SVG Tiny 1.2: `version="1.2"`, `baseProfile="tiny-ps"`, a square `viewBox` with a 1:1 ratio, a single `<title>` of at most 64 characters, a solid background, no scripts, no external references, no animation, no raster `<image>` tags, and ideally under 32 KB. DMARC enforcement is a hard prerequisite: the organizational domain must publish `p=quarantine` or `p=reject` with `pct=100` and no `sp=none`. Gmail additionally requires a VMC (Verified Mark Certificate) or CMC (Common Mark Certificate); Apple Mail requires a VMC. A VMC costs roughly $1,000 to $1,500 per year from a Mark Verifying Authority (DigiCert or Entrust) and requires a registered trademark for the logo. See `/docs/dmarc-none-to-reject` for the enforcement path that unlocks BIMI.
BIMI is a TXT record at `default._bimi.yourdomain.com` beginning with `v=BIMI1`. A missing record means no logo anywhere. A record that exists but has no `a=` certificate is self-asserted: it works at Yahoo/AOL but Gmail and Apple stay blank. A record with a valid `l=` and `a=` still shows nothing unless DMARC is at `p=quarantine` or `p=reject` with `pct=100`, so always check DMARC alongside BIMI.
dig +short TXT default._bimi.yourdomain.comdig +short TXT _dmarc.yourdomain.comhttps://bimigroup.org/bimi-generator/The DNS record and the SVG logo are free. But Gmail and Apple Mail only render the logo when a certificate backs it: a VMC costs roughly $1,000 to $1,500 per year from DigiCert or Entrust. Yahoo and AOL will display a free self-asserted logo (empty `a=` tag), so a no-cost BIMI is possible if those providers are enough for you.
For a VMC, yes - a trademark registered with a recognized office (USPTO, EUIPO, and similar), and the mark on the certificate must match your SVG exactly. If you cannot get a trademark, a CMC (Common Mark Certificate) covers prior-use or government-issued marks and is accepted by Gmail, but not by Apple Mail as of 2026.
Almost always DMARC. BIMI needs `p=quarantine` or `p=reject` with `pct=100` and `sp` not set to none, sustained over time, plus decent sending reputation. Providers also roll BIMI out gradually and cache aggressively, so allow days after everything is in place.
A VMC vouches for a registered trademark and unlocks the widest support (Gmail, Apple Mail, Yahoo). A CMC covers logos that cannot obtain a trademark, such as government marks or prior-use logos, and is accepted by Gmail but not Apple. Both are paid certificates from the same Mark Verifying Authorities.
Applied the configuration change? Run a live scan to confirm the vulnerability is patched.