BIMI Implementation: Requirements, SVG and VMC Explained

Brand Indicators for Message Identification (BIMI) is the standard that shows your brand logo next to your emails in a supporting inbox. It is not a switch you flip. What you need to implement BIMI is a short but strict list: authenticated mail, a specific logo file, a DNS record, and — for the inboxes that actually draw the logo — a certificate.

This guide walks each requirement in order, explains when you also need a Verified Mark Certificate (VMC), and where a logo quietly fails to appear. Every provider fact is dated, because this area keeps moving. Each requirement below is checked against the BIMI Group's own implementation guide and each provider's documentation, as of August 2026.

The four things you need in place#

There are four requirements, and they are cumulative. A missing piece means no logo, not a partial one.

• DMARC at enforcement. Your domain publishes a DMARC policy of quarantine or reject, covering subdomains, applied to all of your mail.
• An SVG Tiny PS logo. A specific, locked-down profile of your official logo — not a PNG, and not an ordinary SVG export.
• A BIMI DNS record. A TXT record that points supporting inboxes at your logo, and optionally at your certificate.
• A certificate, for most real-world display. A VMC, or in some cases a CMC, because the mailbox providers that render logos require one.

Requirement 1: DMARC at enforcement#

The BIMI Group's implementation guide is explicit: your DMARC policy must be at enforcement on both the organizational domain and its subdomains — either p=quarantine with sp=quarantine, or p=reject with sp=reject. A policy of none, or one applied to less than all of your mail, is not accepted.

One thing to date-stamp. DMARC itself was updated in 2026: RFC 9989 now obsoletes the older RFC 7489 and RFC 9091. It removes the pct tag that BIMI and some provider docs still mention, replaces the Public Suffix List with a bounded DNS tree walk, and adds a psd tag. The practical BIMI requirement is unchanged — your policy has to apply to all of your mail, with no monitoring-only or partial rollout.

Requirement 2: an SVG Tiny PS logo#

BIMI does not accept a normal logo file. You need an SVG Tiny PS (Portable/Secure) version — a restricted profile of SVG Tiny 1.2, designed so a logo cannot carry scripts or fetch anything remotely. The BIMI Group publishes the exact constraints; the ones that trip people up are below.

• The root svg element uses baseProfile tiny-ps and version 1.2, and must not carry x= or y= attributes.
• A square aspect ratio, centered, on a solid background — transparent backgrounds may not render as expected.
• A title element carrying your company name; a desc element is recommended for accessibility.
• No scripts, no animation, no external links or references beyond the required XML namespaces, and no embedded raster images.
• A file no larger than 32 KB.

Requirement 3: the BIMI DNS record#

The record tells supporting inboxes where your logo lives. Publish a TXT record at the default selector, default._bimi, under the domain you send from. It carries three parts: the version, the logo location (l=), and an optional certificate location (a=).

Host the SVG over HTTPS at a stable URL. If you use a VMC or CMC, the a= tag points to its PEM file, also served over HTTPS.

Requirement 4: a VMC, for the inboxes that show the logo#

Here is the part most guides get half-right. In the BIMI specification, the a= certificate tag is optional — a record with only v= and l= is a valid, self-asserted BIMI record. But the mailbox providers that actually draw a logo have their own rules, and those rules are stricter than the spec's floor.

Gmail supports BIMI only with a certificate file: either a Verified Mark Certificate (VMC), or a Common Mark Certificate (CMC) for a logo that is not a registered trademark (Google Workspace admin help, checked August 2026). Apple Mail requires a VMC backed by a registered trademark and does not accept a CMC (Apple support documentation).

So for the two providers most senders care about, a self-asserted record — one with no a= certificate — will not display a logo. A VMC is issued only against a registered trademark by an authorized Mark Verifying Authority; a CMC covers logos without a registered mark, on a lighter verification path. Pricing varies by issuer and changes over time, so get a current quote from an authorized issuer rather than trusting an old figure.

Where AI Emaily fits, and where it doesn't#

It is worth being clear about which side of BIMI a mail client sits on, because it is easy to assume the wrong one. BIMI is a sender-side control. You publish it on the domain you send from, and it decides whether your logo appears in other people's inboxes. It says nothing about what lands in yours.

AI Emaily is on the reading side, and it does none of the setup above. We do not publish your DMARC record, generate your SVG, host your logo, or issue your VMC — that is the job of your DNS, your sending platform, and a certificate authority. A page that implied otherwise would be selling you something we do not do.

What a client like ours does with the same standards is on the receiving end: it treats every message as untrusted input and uses SPF, DKIM and DMARC results as signals in its spam and phishing filtering. The enforced DMARC that BIMI requires is exactly what lets a reading client confidently reject mail that spoofs a domain. We build AI Emaily, and that is the honest scope of what it does here.

VMC vs CMC vs a self-asserted record#

The choice comes down to whether you have a registered trademark and which inboxes you need to reach. This table is dated August 2026; verify each row against the provider's own page before you buy anything.

Do you actually need a VMC?#

If your logo is a registered trademark and you want it shown in Gmail and Apple Mail, a VMC is the path — it is the only type Apple accepts, and it earns Gmail's verified checkmark. If your logo is not trademarked, a CMC gets you a logo in Gmail but not in Apple Mail.

If you only want to test BIMI, or you are targeting an inbox that accepts self-asserted records, you can start with just v= and l= and add the certificate later. Do not expect the big two to draw anything until the a= certificate is in place.

Which inboxes display BIMI logos#

Provider support is a moving list, and the BIMI Group maintains the authoritative version. These are the major receivers as of August 2026; confirm the current rules before you rely on any single row.

Common misconceptions#

• BIMI gets you into the inbox. It does not. It shows a logo only on mail that already authenticates and passes your enforced DMARC. It is a trust and brand signal, not a deliverability fix.
• A self-asserted record is enough. At the spec level, yes; in practice, Gmail and Apple Mail draw nothing without a certificate, so most senders need a VMC or CMC.
• Any logo file works. It must be SVG Tiny PS with a title, a square shape, a solid background and no scripts, under 32 KB. A PNG or a normal SVG export will be rejected.
• p=none is fine because my mail is authenticated. BIMI requires enforcement — quarantine or reject — including subdomains. Monitoring-only never qualifies.
• One VMC covers every brand and domain. A certificate is tied to a specific logo and the domains it is issued for. Separate brands or unrelated domains generally need their own.