You've probably noticed that some brands' emails show their logo in a little circle next to the subject line in Gmail, while yours shows a plain letter. You might have wondered how they do that.
The answer is usually BIMI.
So, what is BIMI? It stands for Brand Indicators for Message Identification. In plain English: it's a way to tell participating email providers "here's our official logo, please show it next to our authenticated emails".
Sounds like a branding nice-to-have. But here's the twist most BIMI guides bury halfway down: you can't get BIMI until your email authentication is properly locked down. That means DMARC at enforcement, which is a real anti-spoofing achievement in its own right.
So BIMI is less a branding project and more a reward for doing email security properly. This guide explains how it works, what it costs, the requirements that trip people up and how to decide whether it's worth it for a small business.
What BIMI Actually Does (and Doesn't Do)
BIMI lets you publish a DNS record pointing to your logo. Participating mailbox providers can then show that logo beside emails that pass strict authentication checks.
What it does:
- Shows your logo in supporting inboxes, next to authenticated emails from your domain
- Gives recipients a visual cue that the email is from you
- Rewards brands that have implemented strong authentication
What it doesn't do:
- It doesn't guarantee your emails reach the inbox
- It doesn't work in every email app
- It doesn't replace SPF, DKIM or DMARC (it depends on them)
- It isn't something you can switch on with a single record
The BIMI Group, which develops the standard, has an overview on its website.
The Big Requirement: DMARC at Enforcement
Before any provider will show your logo, your domain needs DMARC set to an enforcement policy: p=quarantine or p=reject. A policy of p=none (monitoring only) isn't enough.
Why? Because BIMI is meant to show the logo only when the receiver is confident the email genuinely came from you. A monitoring-only DMARC policy doesn't ask receivers to stop forgeries, so a logo could end up beside fake emails.
Getting to enforcement means:
- Every legitimate service that sends as your domain passes and aligns with SPF or DKIM
- You've checked DMARC reports to make sure nothing important is failing
- You've moved your policy up carefully
If you're not there yet, start with the DMARC setup guide and how to move from p=none to p=reject.
Check the current BIMI requirements before you start, because providers and the BIMI Group can update details like whether specific policy settings are required.
The Logo Has to Be in a Special Format
You can't just upload your normal logo file. BIMI requires an SVG file in a specific profile, often called SVG Tiny PS (Portable/Secure).
In practice, that usually means:
- A square logo that looks good in a small circle
- A solid background (not transparent)
- An SVG file converted to the required profile
- Hosted at a public HTTPS address
Most design tools don't export SVG Tiny PS directly. You may need a designer or a conversion tool, and then a check that the file meets the requirements. The BIMI Group publishes guidance and tools.
The Certificate Question: VMC, CMC or Nothing
This is where BIMI gets expensive, and where most small businesses pause.
Some providers, including Gmail, only show BIMI logos if you also have a certificate that verifies you own the logo:
- A Verified Mark Certificate (VMC) typically requires your logo to be a registered trademark
- A Common Mark Certificate (CMC) is an alternative that doesn't require a registered trademark in the same way, but has its own eligibility requirements
These certificates are issued by approved certificate authorities, cost money and need renewing. Check current pricing and eligibility directly with providers, because both change.
Some other mailbox providers may show BIMI logos without a certificate. Support varies, so check which inboxes your customers actually use.
What a BIMI Record Looks Like
The BIMI record is a TXT record at default._bimi on your domain:
Name: default._bimi.yourbusiness.co.uk
Type: TXT
Value: v=BIMI1; l=https://yourbusiness.co.uk/brand/logo.svg; a=https://yourbusiness.co.uk/brand/certificate.pem- v=BIMI1: the version
- l=: where your SVG logo is hosted
- a=: where your certificate (VMC or CMC) is hosted, if you have one
Without a certificate, the a= part may be left empty, but then providers that require a certificate won't show your logo.
Is BIMI Worth It for a Small Business?
Honest answer: it depends on what you're trying to achieve.
It might be worth it if:
- You send a lot of marketing or customer email to Gmail and similar providers
- Your brand is a big part of how customers recognise you
- You already have DMARC at enforcement
- You already have (or plan to get) a registered trademark
- Impersonation of your brand is a real concern
It's probably not a priority if:
- Your DMARC is still at p=none (fix that first, for security reasons alone)
- You mostly send one-to-one emails to business contacts using corporate mail systems that may not display BIMI
- The certificate cost is significant relative to your marketing budget
- Your logo isn't trademarked and you don't qualify for a CMC
Does BIMI Improve Deliverability?
You'll see claims that BIMI boosts open rates or inbox placement. Be careful with them.
BIMI doesn't override spam filtering. A logo won't rescue an email recipients don't want. What it can do is make your authenticated emails more recognisable in supporting inboxes, which may help people trust and engage with them.
The strong authentication you need for BIMI (aligned SPF/DKIM and DMARC enforcement) does help receivers trust your mail. That's the bigger benefit.
Step by Step: The BIMI Journey
- Get DMARC to enforcement. Every legitimate sender aligned, policy at quarantine or reject.
- Decide which providers matter. Check which inboxes your customers use and which ones show BIMI.
- Check certificate eligibility. Do you have a registered trademark (for a VMC), or do you qualify for a CMC?
- Prepare the logo. Square, solid background, converted to SVG Tiny PS.
- Get a certificate (if needed). From an approved certificate authority.
- Host the files. Logo and certificate at public HTTPS addresses.
- Publish the BIMI record. TXT at default._bimi.yourdomain.
- Test. Send emails to supporting inboxes and check the logo appears. Use BIMI checking tools to validate your record and logo.
Logos may take a while to appear after setup, as providers cache and verify.
Common Reasons BIMI Doesn't Show Up
- DMARC isn't at enforcement (the most common reason)
- The logo isn't in the correct SVG profile
- The logo URL isn't publicly reachable over HTTPS
- The certificate is missing, expired or doesn't match the logo
- The provider you're testing with doesn't support BIMI, or requires a certificate you don't have
- The email you're testing isn't passing DMARC (for example, it came from a sender that isn't aligned)
BIMI and Subdomains
If you send from subdomains (like news.yourbusiness.co.uk), check how BIMI applies to them. A BIMI record on your main domain may cover subdomains, or you might need a separate record, and the DMARC policy that applies to the subdomain also matters.
Plan this alongside your subdomain strategy. See should you use a subdomain for marketing emails.
A Realistic Example
A fictional Brighton skincare brand sends weekly newsletters and order emails to a large consumer audience, mostly on Gmail. Customers sometimes receive fake "order problem" emails pretending to be from the brand.
They:
- Spend two months getting every sender aligned and DMARC to p=reject
- Confirm their logo is a registered trademark
- Get a designer to produce an SVG Tiny PS version
- Buy a certificate from an approved provider
- Publish their BIMI record
Their logo now appears beside genuine emails in supporting inboxes. More importantly, forged emails using their exact domain are now being rejected, thanks to the DMARC work.
For them, it was worth it. For a five-person consultancy sending mostly to corporate clients, the same spend might not make sense.
BIMI vs Just Having a Profile Picture
You might wonder why some emails from small businesses show a photo or logo without any of this. A few reasons:
- Some email apps show a contact photo you've saved yourself
- Some providers show profile pictures linked to the sender's own account (for example, a Google account photo for emails sent from Gmail)
- Some apps guess a logo from the sender's website
None of those is BIMI. They depend on the recipient's app and settings, and they don't involve any authentication check.
BIMI is different because the logo is tied to your domain and only shown when your emails pass strict DMARC checks. That's what makes it meaningful as a trust signal, and why it takes more work.
What It Costs (Beyond Money)
The certificate is the obvious cost, but think about the full picture:
- Time to get DMARC to enforcement (often the biggest investment, but worth it anyway)
- Designer time to create a compliant SVG logo
- Trademark registration, if you don't already have one and want a VMC
- The certificate itself, renewed periodically
- Ongoing care: keeping the logo file and certificate hosted and valid, and keeping DMARC at enforcement
If any piece lapses (an expired certificate, a moved logo file, DMARC relaxed back to p=none), the logo can stop appearing.
A Five-Question Decision Guide
Answer these honestly:
- Is our DMARC at quarantine or reject today, with every sender aligned?
- Do most of our customers use inboxes that display BIMI?
- Is our logo a registered trademark, or do we qualify for a Common Mark Certificate?
- Is impersonation of our brand a real risk to our customers?
- Would the certificate cost be small relative to the value of our email marketing?
Mostly "yes"? BIMI is probably worth pursuing. Mostly "no"? Focus on getting DMARC to enforcement first. You'll protect your customers either way, and you can revisit BIMI later.
Keeping BIMI Working Once It's Live
Add these to your regular email checks:
- Is the certificate still valid, and when does it expire?
- Is the logo file still reachable at the URL in your record?
- Is DMARC still at enforcement?
- Have you added any new sending tools that might not align (and so won't show the logo)?
- Are new subdomains covered as you intend?
Put the certificate renewal date in your calendar with plenty of warning. A lapsed certificate is the most common reason a working BIMI setup suddenly stops showing the logo.
BIMI and Your Subdomains, Newsletters and Tools
BIMI applies to emails that pass DMARC for your domain. That means every sending tool matters:
- Staff email from Microsoft 365 or Google Workspace (with DKIM set up for your domain)
- Newsletters from your marketing platform (with custom DKIM)
- Invoices, booking confirmations and receipts from other tools
Any tool that isn't aligned won't pass DMARC, so its emails won't show your logo even after BIMI is set up. That's another reason a sender inventory matters. See the sender inventory template.
Common Myths About BIMI
- "BIMI makes emails bypass spam filters." It doesn't. Filtering happens regardless.
- "Any image file will do." It must be a correctly formatted SVG, hosted over HTTPS.
- "It works everywhere once set up." Support varies by provider and app.
- "It's only for big brands." Any business can implement it, if it meets the requirements and judges the cost worthwhile.
Where to Start This Week (Even If BIMI Is Months Away)
You don't need to commit to BIMI today to start moving towards it. These steps are worth doing regardless:
- Publish a DMARC record with reporting, if you haven't
- List every service that sends email as your domain
- Enable custom DKIM in each one
- Watch DMARC reports until every legitimate sender aligns
- Move DMARC to quarantine, then reject
At that point, your domain is protected against exact-domain spoofing, and you're eligible to consider BIMI. If you decide it's worth it, the remaining steps (logo, certificate, record) are comparatively quick.
Questions to Ask a Certificate Provider
If you decide to buy a VMC or CMC, ask:
- Which certificate types do you offer, and which providers accept each?
- What are the eligibility requirements (trademark, logo usage history, verification)?
- How long does verification take?
- What does renewal cost, and how often is it needed?
- Do you help with SVG formatting or validation?
- What happens if our logo changes?
Compare a couple of providers. Prices and requirements vary.
Frequently Asked Questions
What does BIMI stand for?
Brand Indicators for Message Identification.
Do I need a trademark for BIMI?
For a Verified Mark Certificate, typically yes. A Common Mark Certificate is an alternative with different eligibility. Some providers may show logos without any certificate. Check current requirements.
Can I use BIMI with DMARC at p=none?
No. BIMI requires DMARC at an enforcement policy (quarantine or reject).
Will BIMI get my emails out of spam?
No. BIMI doesn't override spam filtering. It only shows a logo on emails that already pass strict authentication.
Does Outlook show BIMI logos?
Support varies by provider and changes over time. Check current support for the inboxes your customers use.
How long does BIMI take to set up?
The DNS record takes minutes. Getting DMARC to enforcement safely can take weeks or months, and a certificate (if you need one) adds its own checks. Plan for the DMARC journey being the long part.
Will my logo show for every recipient?
No. Each mailbox provider decides whether to show BIMI logos, and some don't support it at all. Expect it to appear for some recipients, not everyone.
Is BIMI the same as a verified checkmark?
Not exactly. Some providers show a checkmark alongside the logo when a certificate is in place, but the logo and the checkmark depend on each provider's own rules.
Sources and further reading
Related reading
- What is DMARC?
- How to move DMARC from p=none to p=reject
- What sender name should you use for business emails?