What Is BIMI? How Your Brand Logo Shows Up in the Inbox

You open your inbox and most senders are a gray circle with an initial in it — "A," "M," a stock silhouette. Then a few stand out: a small, crisp company logo sitting right next to the sender name, the same mark you would see on their website or app. Your bank does it. A couple of the big retailers do it. It looks official, and on some quiet level it makes the message feel more trustworthy before you have read a word. That logo is BIMI doing its job.

BIMI is one of those email acronyms that sounds like deep infrastructure and turns out to be a fairly simple idea wrapped in some genuinely strict prerequisites. The idea: let a brand publish its logo in a way the inbox can trust, so the logo — not a gray placeholder — shows up beside its messages. The strict part: the inbox will only show that logo if the sender has already proven, through email authentication, that the message really came from them. BIMI does not make email safer by itself. It rewards the senders who have already done the safety work by giving them a visible badge for it.

This guide explains BIMI in plain English, end to end. What the acronym actually stands for and what the standard does. The prerequisites you cannot skip — DMARC at enforcement, a specific logo file format, and for most inboxes a paid certificate. Which mailbox providers actually display BIMI logos today, and which still do not. How the whole thing works under the hood, from the DNS TXT record to what the receiving server checks. A real example of a BIMI record and a step-by-step setup path. What it costs in money and effort, and the honest answer to who it is worth it for. We will close with a short note on how an AI-native email client relates to all of this — because the trust signals BIMI is built on are exactly what a good client surfaces for you.

If you have read our explainers on SPF, DKIM, and DMARC, BIMI is the natural next stop — it sits on top of that stack and is the most visible payoff for getting it right. If you have not, do not worry: we will explain just enough of the foundation to make BIMI make sense, and link out where you want the full picture.

What does BIMI actually stand for and mean?

BIMI stands for Brand Indicators for Message Identification. Read it slowly and it nearly defines itself: it is a standard for letting a brand attach an identifying indicator — a logo — to its messages, so receiving mail systems can display that indicator in the inbox. The "identification" part is the key word. BIMI is about making it easier to identify, at a glance, that a message genuinely came from the brand it claims to be from.

In practical terms, BIMI is a published specification (an open industry standard, stewarded by the AuthIndicators Working Group, which includes Google, Apple, Yahoo, Fastmail, and others) that defines two things. First, how a domain owner publishes a pointer to their official logo using the DNS — the same global address book that already holds a domain's MX, SPF, DKIM, and DMARC records. Second, how a receiving mail server should fetch that logo, verify it is allowed, and render it next to the sender's name in the message list or open message.

It helps to separate BIMI from the things it is often confused with. BIMI is not an authentication protocol — it does not, on its own, decide whether an email is genuine. SPF, DKIM, and DMARC do that work; BIMI simply piggybacks on their verdict. BIMI is not anti-spam or anti-phishing technology in the active sense — it does not block bad mail. And BIMI is not a guarantee that a logo-bearing email is safe; it is a strong signal, backed by authentication, that the message came from a domain authorized to display that mark. Think of it as the visible reward layer on top of an email-authentication stack that already has to be working.

One more framing that clears up a lot of confusion: BIMI is a sender-side standard with a receiver-side payoff. The brand does the publishing work — fixing authentication, preparing a logo, sometimes buying a certificate. The mailbox provider (Gmail, Apple Mail, Yahoo, Fastmail) does the displaying. The recipient does nothing at all; they just start seeing a logo where a gray circle used to be. That asymmetry is why BIMI matters most to organizations that send a lot of mail to a lot of people and want to look unmistakably themselves in every one of those inboxes.

How does BIMI work, step by step?

BIMI rides on top of email authentication, so to follow how it works you have to start one layer down, with the verdict that BIMI depends on. When a message arrives at a receiving server, that server already runs the standard authentication checks: SPF (does the sending server's IP match what the domain authorized?), DKIM (does the cryptographic signature on the message verify against the domain's public key?), and DMARC, which ties the two together and tells the receiver what to do if they fail. Only once a message passes DMARC does BIMI even enter the picture. If a message would not pass DMARC, the inbox will not show a BIMI logo — that is the whole point.

Assuming the message passes authentication, the receiving server looks up the sending domain's BIMI record. This is a DNS TXT record published at a special, fixed location: the subdomain `default._bimi.example.com` (where `default` is the BIMI "selector" and `example.com` is the sending domain). The record's contents tell the receiver two things: where to fetch the brand's logo file, and — optionally but usually required — where to fetch a certificate that proves the brand is entitled to use that logo.

The receiver then fetches the logo. BIMI logos must be in a very specific format: SVG, and not just any SVG but the constrained SVG Tiny Portable/Secure (SVG Tiny PS) profile, a stripped-down, secure subset designed so the file cannot carry scripts or external references that might be abused. The logo has to be square, and ideally it is the brand's real, recognizable mark on a solid background. The server retrieves this file from the HTTPS URL named in the BIMI record.

For most major providers, the server also checks a certificate. This is where the Verified Mark Certificate (VMC) — or its newer sibling, the Common Mark Certificate (CMC) — comes in. A VMC is a special digital certificate, issued by an approved Certificate Authority, that attests the organization actually owns the logo (typically by proving the logo is a registered trademark) and is who it says it is. The BIMI record points to this certificate; the receiver validates it before trusting the logo. Without a valid certificate, Gmail and most large providers will simply not display the logo, even if everything else is in order.

If all of that checks out — DMARC passed, BIMI record found, logo fetched and valid, certificate verified — the receiving inbox renders the logo next to the sender. Exactly where it appears depends on the client: it might be the avatar in the message list, the circle next to the sender in the open message, or both. The recipient sees a brand logo instead of a placeholder, and BIMI has done its single job.

Notice what BIMI is doing across those steps: it is never the thing deciding whether the email is real. The DMARC verdict in step one is. BIMI is the layer that says, given that this message is authentically from a domain, here is the logo that domain is authorized to show, and here is the proof it owns that logo. It is verification of identity and ownership stacked on top of verification of the message. That layering is exactly why BIMI cannot be faked by a spammer: they would first have to pass your DMARC (which means actually being authorized to send as your domain), and then present a valid certificate proving they own your trademarked logo. Both are, by design, very hard for an impostor to do.

What do you need before BIMI will work?

BIMI has a short list of prerequisites, and there is no skipping them — the providers enforce each one. This is the part where most organizations discover that "add a BIMI record" is really "finish the email-authentication work you may have been putting off, then add a BIMI record." Here is the full requirements list, from the foundation upward.

First and non-negotiable: DMARC at an enforcement policy. A DMARC record alone is not enough — it has to be set to enforce. DMARC policies come in three levels: `p=none` (monitor only, take no action on failures), `p=quarantine` (send failures to spam), and `p=reject` (refuse failures outright). BIMI requires `p=quarantine` or `p=reject` — `p=none` will not qualify. And the enforcement generally has to apply to your whole domain, not a fraction of it (the DMARC `pct` tag, if used, should be 100). This is the biggest hurdle for most senders, because getting to enforcement safely means first auditing every legitimate source of mail for your domain so you do not accidentally start sending your own newsletters to spam. DMARC itself depends on SPF and DKIM being correctly configured, so in practice the whole authentication stack has to be healthy.

Second: a correctly formatted logo. The logo must be an SVG file conforming to the SVG Tiny Portable/Secure (SVG Tiny PS) profile — a tightly restricted, secure subset of SVG. It must be square (1:1 aspect ratio), centered, on a solid (non-transparent) background, and kept small in file size. You cannot use a PNG, a JPG, or a regular full-featured SVG; the file has to be the specific profile, with certain attributes present and many features forbidden. Producing a compliant file usually means running your existing vector logo through a converter or following the profile's rules carefully.

Third, for most providers: a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). The VMC is a paid digital certificate from an approved Certificate Authority that proves your organization owns the logo. The classic route requires that your logo be a registered trademark with a recognized trademark office. The newer CMC was introduced to widen access — it allows logos that are not registered trademarks (for example, a logo the organization has been using publicly) to qualify under a different verification path, so nonprofits, government bodies, and brands without a trademark have a route in. Gmail and Apple Mail require one of these certificates; the logo will not show to those audiences without it.

Fourth: the BIMI DNS record itself, published as a TXT record at the `default._bimi` subdomain, pointing to the logo URL and (where used) the certificate URL. This is the easy, last step — minutes of work once the other three are done. The table below lays out the full set.

The dependency chain is worth saying out loud because it sets expectations honestly: you cannot get a logo in Gmail without a certificate; you cannot get a certificate without (usually) a trademark; you cannot meaningfully publish BIMI without DMARC at enforcement; and you cannot safely reach DMARC enforcement without first auditing and authenticating every legitimate mail stream. So when a vendor or article says "just turn on BIMI," what they mean is "complete the entire email-authentication journey, register or document your logo, buy a certificate, and then publish one DNS record." For an organization that already enforces DMARC, that final stretch is quick. For one that does not, BIMI is the motivation to finally do the foundational work — which is arguably its biggest hidden benefit.

Which mailbox providers actually support BIMI?

BIMI is only useful where a mailbox provider chooses to display the logo, so support is the practical question that decides whether the effort pays off. Support has grown steadily, and as of 2026 the major consumer providers are on board — though the exact requirements and where the logo appears vary by provider.

Gmail was a turning point. Google rolled out BIMI support to Gmail in 2021, and crucially it requires a VMC (and now accepts CMC), which set the de facto industry standard that a certificate is needed for serious display. Because Gmail represents an enormous share of consumer inboxes, "showing up in Gmail" is the goal that drives most BIMI projects. Yahoo Mail was actually the earliest large adopter — it piloted and supported BIMI before Gmail — and AOL (part of the same group) followed along. Fastmail, a privacy-focused independent provider, supports BIMI as well and was an early backer of the standard through the working group.

Apple brought BIMI to Apple Mail with iOS 16, iPadOS 16, and macOS Ventura in 2022, displaying verified logos in Mail and requiring a VMC. Because Apple Mail is the default client on hundreds of millions of iPhones, that expanded BIMI's visible reach significantly. On the business side, Microsoft has been the notable holdout — Outlook.com and Microsoft 365 historically did not display BIMI logos, though Microsoft announced support was coming, so the picture there is the one most likely to have shifted; check current Microsoft documentation rather than assuming. The table summarizes the landscape.

The honest takeaway on support: BIMI now reaches a real majority of consumer inboxes through Gmail, Apple Mail, and Yahoo, which is why it is a credible investment for high-volume senders. But it is not universal, the requirements differ between providers (most notably whether a certificate is enforced and exactly where the logo renders), and behavior changes over time. If your audience is heavily on a provider that does not yet display BIMI, the visible payoff shrinks accordingly. Always confirm the current state of each provider you care about before budgeting a BIMI project around it.

How do you set up BIMI for a domain?

Setting up BIMI is a sequence, and the order matters because each step depends on the one before it. Below is the practical path from nothing to a logo in the inbox. The early steps are the heavy lifting (authentication); the final steps are quick once the foundation is in place. Treat anything involving sending behavior as something to verify with monitoring before you tighten it.

1. 1

   Get SPF and DKIM right for every sending source

   List every system that sends mail as your domain — your mail platform, marketing tools, invoicing, support desk, app notifications. Make sure each is covered by SPF and signs with DKIM, so messages from all of them can pass authentication. This inventory is the part people underestimate.

2. 2

   Publish DMARC and start in monitoring mode (p=none)

   Add a DMARC record set to p=none with reporting addresses. This does not affect delivery; it just collects reports showing who is sending as your domain and whether they pass. Read those reports until you are confident every legitimate source is authenticated.

3. 3

   Tighten DMARC to enforcement (p=quarantine, then p=reject)

   Once your reports are clean, move the policy up — first p=quarantine, then p=reject — across 100% of mail. This is the prerequisite BIMI actually checks. Do it gradually and keep watching reports so you never silently lose legitimate mail.

4. 4

   Prepare a compliant SVG Tiny PS logo

   Create or convert your logo into the SVG Tiny Portable/Secure profile: square, centered, solid background, small file. Use a converter that targets the BIMI profile specifically, then validate it against a BIMI logo checker before publishing.

5. 5

   Obtain a VMC or CMC certificate

   Apply to an approved Certificate Authority for a Verified Mark Certificate (needs a registered trademark of the logo) or a Common Mark Certificate (broader eligibility). The CA verifies your organization and logo ownership and issues a certificate file you host alongside the logo. This step costs money and takes time.

6. 6

   Host the logo and certificate over HTTPS

   Place the SVG logo and the certificate (PEM) file at stable HTTPS URLs you control. These URLs go into the BIMI record, and receivers fetch from them on every check, so the hosting must be reliable and long-lived.

7. 7

   Publish the BIMI TXT record in DNS

   Add a TXT record at default._bimi.<yourdomain> with v=BIMI1, the l= tag pointing to your logo URL, and the a= tag pointing to your certificate URL. This is the final, minutes-long step that switches everything on.

8. 8

   Validate and monitor

   Use a BIMI inspector to confirm the record, logo, and certificate all validate, then send test mail to Gmail, Apple Mail, and Yahoo accounts to confirm the logo renders. Keep monitoring DMARC and the hosted files so the logo does not silently stop showing.

The single most common reason a freshly published BIMI record does not show a logo is that one of the upstream pieces is not actually satisfied: DMARC is still at p=none, the logo is a regular SVG rather than SVG Tiny PS, the certificate has not been issued or has expired, or the test message did not itself pass DMARC. BIMI fails quietly — there is no error popup, the inbox simply shows the usual placeholder. So validation tools and test sends are not optional polish; they are how you find out whether it is working at all. Below is what a published record looks like.

What does BIMI cost, in money and effort?

BIMI's price tag comes in two parts — the recurring cost of the certificate and the one-time effort of the authentication work — and the second is usually larger than the first even though it is the one people forget to budget for.

The direct money cost is the certificate. A Verified Mark Certificate is a paid annual certificate from an approved Certificate Authority. Pricing is not trivial — it has historically run in the high hundreds to low thousands of dollars per year, depending on the CA and term, which puts it firmly in "a business decision" territory rather than "flip a switch." The Common Mark Certificate exists partly to broaden access, but it is still a paid certificate, not free. On top of that, there can be an upfront cost in getting your logo registered as a trademark if it is not already, which is a separate, slower, and potentially expensive process handled through a trademark office — that is often the real gate for smaller organizations pursuing a VMC.

The effort cost is the bigger story for most senders, and it is not really a BIMI cost at all — it is the cost of reaching DMARC enforcement safely. For an organization with many mail streams and no prior authentication work, getting from no DMARC to p=reject can take weeks or months of careful auditing, fixing SPF and DKIM for every sender, reading reports, and tightening the policy in stages without breaking legitimate mail. That work has enormous value on its own (it is the single biggest defense against people spoofing your domain), but it is real labor. By the time you have done it, the remaining BIMI-specific work — preparing the logo, getting the certificate, publishing the record — is comparatively small.

Framed honestly: if you already enforce DMARC, BIMI is a modest annual certificate cost plus a few hours of setup. If you do not, BIMI's true cost is "complete a domain-authentication program, then add a certificate." That is why BIMI is most often pursued by organizations that have either already done the authentication work or have a strong independent reason to do it — and BIMI becomes the visible bonus on top.

Who is BIMI actually worth it for?

BIMI is not for everyone, and pretending otherwise wastes money. The standard pays off in proportion to how much you send, how recognizable your logo is, and how much your audience sits on providers that display it. So the useful question is not "should I do BIMI?" but "do the conditions that make BIMI worthwhile apply to me?"

It is clearly worth it for established brands that send high volumes of mail to consumers — banks, retailers, large SaaS products, anyone whose logo people recognize and whose mail is a frequent phishing target. For them, a verified logo in millions of Gmail and Apple Mail inboxes is both a brand-recognition win (your mail stands out and looks legitimate) and a security signal (recipients learn to distrust lookalikes that lack the logo). The certificate cost is rounding error against their email program, and they have usually done the DMARC work already.

It is more marginal for small businesses, solo operators, and low-volume senders. If you send a few hundred emails a month, mostly to people who already know you, the visible benefit of a logo badge is small relative to the certificate cost and the trademark requirement. For these senders, the smart move is usually to do the underlying DMARC work (which is valuable regardless) and treat BIMI as a maybe-later. For individuals and personal email, BIMI is essentially irrelevant — it is built for organizations sending under their own domain, not for people using a personal mailbox.

There are also senders for whom BIMI was historically out of reach and now is not: nonprofits, government bodies, and brands without a registered trademark. The Common Mark Certificate was introduced specifically to give them a path, so if a recognizable-logo organization was previously blocked by the trademark requirement, the CMC route may now make BIMI viable. The table below summarizes the fit.

A fair summary: BIMI rewards scale and recognition. The more mail you send, the more recognizable your mark, and the more your audience uses providers that display logos, the better the return. If none of those apply strongly to you, the most valuable thing in the BIMI checklist is the part that helps everyone — DMARC enforcement — and you can collect that benefit without ever buying a certificate. Do the security work because it protects you; add the logo when the scale justifies it.

How does BIMI relate to SPF, DKIM, and DMARC?

BIMI is the top of a four-layer stack, and seeing the whole stack at once is the clearest way to remember what each piece does. SPF, DKIM, and DMARC are the authentication layers — together they answer "is this message genuinely from the domain it claims?" BIMI is the presentation layer on top — it answers "given that the message is genuine, what logo should the inbox show?" Each layer depends on the ones beneath it, and BIMI depends on all three.

SPF (Sender Policy Framework) publishes which servers are allowed to send mail for your domain; the receiver checks the sending server against that list. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message that the receiver verifies against a public key in your DNS, proving the message was not forged or altered in transit. DMARC (Domain-based Message Authentication, Reporting, and Conformance) ties SPF and DKIM together, requires that they align with the visible From domain, tells receivers what to do when authentication fails, and sends you reports. Those three are the foundation, and BIMI checks DMARC's verdict before it does anything.

The relationship is strictly hierarchical: no SPF/DKIM means no reliable DMARC pass; no DMARC at enforcement means no BIMI; no BIMI means no logo. You cannot leapfrog. That is also why BIMI is sometimes described as the carrot that finally gets organizations to enforce DMARC — the prospect of a visible logo motivates the unglamorous authentication work that security teams have wanted done for years. The visible reward at the top of the stack pulls the whole stack into place.

How does AI Emaily relate to BIMI and sender trust?

BIMI is a sender-side standard — something brands publish so inboxes can show their logo. AI Emaily sits on the other side of that exchange, as the email client you read your mail in, and a good client's job is to surface the trust signals that standards like BIMI produce so you can read your inbox with the right level of confidence at a glance.

Where a sender has published a valid BIMI record and the message passes authentication, a client should render that verified logo the way Gmail and Apple Mail do — so legitimate, authenticated brands look unmistakably themselves in your inbox, and the gray-placeholder senders stand out for not being verified. AI Emaily is built to present those sender and authentication signals clearly rather than burying them, because the value of all the DMARC and BIMI work upstream only reaches you if your client actually shows it.

AI Emaily is an AI-native email client that works across every account you connect — Gmail, Outlook, and any IMAP provider — in one place, so the same sender-trust signals are surfaced consistently wherever your mail lives. And it is private by design: your mail is yours, used to help you triage and draft, not to train models for anyone else. The point is not that the client replaces BIMI; it is that the client is where BIMI's payoff becomes visible to you, alongside the authentication context that tells you whether a message is what it claims to be.

You stay in control throughout. In its default Copilot mode, AI Emaily helps you sort, summarize, and draft, but nothing acts or sends on your behalf without your approval. You can start free at app.aiemaily.com/signup — the Free plan is $0 and connects your inbox with AI assistance, and Pro is $17.99/month billed annually when you want it across everything. The connection to BIMI is simple: BIMI is how trustworthy senders prove themselves at the door, and AI Emaily is the inbox that shows you they did.

The bottom line on BIMI

BIMI — Brand Indicators for Message Identification — is the standard that lets a verified brand logo appear next to a sender's messages in supporting inboxes. It works through a small DNS TXT record, but only after the real work is done: the sending domain must enforce DMARC, present a correctly formatted SVG Tiny PS logo, and, for Gmail and most major providers, hold a Verified Mark Certificate or Common Mark Certificate proving it owns the mark. It is a trust signal layered on top of authentication, never a substitute for it.

The practical shape of it: BIMI rides on SPF, DKIM, and DMARC, so it cannot be faked without first being authorized to send as the domain and proving ownership of the logo. It is displayed today by Gmail, Apple Mail, Yahoo, and Fastmail, with Microsoft the notable historical holdout. It costs an annual certificate plus — for most organizations — the larger one-time effort of reaching DMARC enforcement. And it is worth it mainly for high-volume, recognizable brands whose audiences use providers that show the logo; for small senders, the authentication work matters far more than the badge.

If you take one thing away, take this: do the DMARC work regardless, because it protects your domain whether or not a logo ever appears, and add BIMI when your scale justifies the certificate. And whichever side of the exchange you are on — publishing a logo or reading the inbox — the goal is the same: make it easy to tell, at a glance, that a message is genuinely from who it claims to be. That is the whole point of BIMI, and it is exactly the kind of signal a good email client should put in front of you.