What is BIMI and how does it work?

BIMI (Brand Indicators for Message Identification) is an email specification that allows organizations to display their verified brand logo next to authenticated emails in recipients' inboxes. It works by publishing a DNS TXT record that points to your logo file (SVG format) and optionally a Verified Mark Certificate (VMC). When an email passes DMARC authentication, the receiving mail server checks the BIMI record and displays the associated logo.

Which email providers support BIMI?

As of 2024, BIMI is supported by Gmail, Yahoo Mail, Apple Mail (iOS 16+, macOS Ventura+), Fastmail, and several other providers. Microsoft Outlook has announced support and is gradually rolling it out. Together, these providers cover the majority of global email users.

How much does BIMI implementation cost?

The main cost is the Verified Mark Certificate (VMC), which ranges from $1,000 to $1,500 per year from certificate authorities like DigiCert or Entrust. You also need a registered trademark, which varies by jurisdiction. The DNS and technical configuration itself has no direct cost beyond the time or expertise required.

Do I need a trademark to implement BIMI?

Yes, for providers that require a VMC (like Gmail), you need a registered trademark with an approved intellectual property office. However, some providers like Yahoo and Apple Mail can display BIMI logos without a VMC, though having one provides broader compatibility and stronger verification.

BIMI Email Logo Display: Implementation Guide to Strengthen Brand Identity

What Is BIMI and Why Does It Matter for Your Brand?

Every day, the average professional receives over 120 emails. In that crowded inbox, standing out is no longer optional—it’s a survival skill for brands. BIMI (Brand Indicators for Message Identification) is an emerging email standard that lets you display your verified brand logo directly next to your emails in supported inboxes.

Think of it as a visual trust signal. Instead of a generic avatar or the first letter of your sender name, recipients see your actual logo—a familiar visual cue that immediately signals legitimacy and builds recognition.

BIMI isn’t just cosmetic. According to studies by the BIMI Working Group and Entrust, brands that implement BIMI see:

Up to 10% increase in open rates
18% increase in brand recall
Reduced phishing susceptibility among recipients
Higher purchase likelihood (+34% in some verticals)

For any business investing in email marketing, BIMI is a powerful way to get more value from every message you send.

How BIMI Works: The Technical Overview

BIMI builds on top of existing email authentication protocols. Here’s the simplified flow:

You send an email authenticated with SPF, DKIM, and DMARC.
The receiving mail server verifies DMARC alignment passes.
The server queries your domain’s DNS for a BIMI TXT record.
The BIMI record points to your logo (SVG file) and optionally a VMC (Verified Mark Certificate).
The inbox displays your logo next to the message.

This chain of trust ensures that only legitimate senders who have properly authenticated their emails can display brand logos—making BIMI both a branding tool and a security enhancement.

The BIMI Ecosystem at a Glance

Component	Purpose	Required?
SPF	Verifies sending IP is authorized	Yes
DKIM	Cryptographically signs messages	Yes
DMARC	Aligns SPF/DKIM and sets policy	Yes (p=quarantine or p=reject)
BIMI DNS Record	Points to logo and VMC	Yes
SVG Logo File	The actual brand logo displayed	Yes (SVG Tiny PS format)
VMC Certificate	Verifies trademark ownership	Required by Gmail, recommended for all

Prerequisites: Getting Your Email Authentication in Order

Before you even think about BIMI, your email authentication stack must be solid. This is where many organizations stumble—and it’s also where the real security benefits begin.

Step 1: SPF (Sender Policy Framework)

Your SPF record must list all legitimate sending sources for your domain. A typical SPF record looks like:

v=spf1 include:_spf.google.com include:sendgrid.net include:mailchimp.com -all

The -all (hard fail) mechanism is preferred for BIMI readiness, as it signals strict authorization.

Step 2: DKIM (DomainKeys Identified Mail)

Ensure all your outgoing email is signed with DKIM using at least a 1024-bit key (2048-bit recommended). Every sending service you use—your CRM, transactional email platform, marketing tool—must sign with DKIM aligned to your domain.

Step 3: DMARC at Enforcement

This is the critical gate. BIMI requires your DMARC policy to be set to either quarantine or reject. A policy of none will not trigger BIMI logo display.

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; pct=100;

Pro tip: If you’re currently at p=none, don’t jump to p=reject overnight. Gradually move through p=quarantine with increasing pct values while monitoring your DMARC reports to ensure legitimate mail isn’t being blocked.

At Lueur Externe, we regularly help clients navigate this progressive DMARC enforcement process, ensuring zero disruption to email deliverability while building toward BIMI readiness.

Creating Your BIMI-Compliant Logo

BIMI has strict requirements for the logo file format. You can’t simply upload your existing PNG or JPEG logo.

Logo Requirements:

Format: SVG Tiny Portable/Secure (SVG Tiny PS)
Shape: Square aspect ratio (the logo will be displayed in a circle by most clients)
Size: Keep file size under 32KB
Background: Solid color background recommended (no transparency)
Content: Centered design with adequate padding for circular cropping
No animation, no external references, no scripts

SVG Tiny PS Specifications

The SVG Tiny PS format is a restricted subset of SVG. Here’s what a compliant file header looks like:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
     viewBox="0 0 100 100" width="100" height="100">
  <title>Your Brand Name</title>
  <!-- Your logo paths here -->
  <rect width="100" height="100" fill="#FFFFFF"/>
  <path d="M25,50 ..." fill="#003366"/>
</svg>

Key constraints:

Must declare baseProfile="tiny-ps"
No <script> elements
No external resources or xlink:href to external files
No <foreignObject> elements
Must include a <title> element

Tools for Creating BIMI Logos

BIMI SVG Conversion Tool by the Authindicators group
Adobe Illustrator (export as SVG, then manually edit for Tiny PS compliance)
Inkscape (with manual cleanup)
BIMI Group’s official SVG validator at bimigroup.org

Always validate your SVG file before publishing. An invalid SVG will silently fail—no error, no logo.

Obtaining a Verified Mark Certificate (VMC)

A VMC is a digital certificate that cryptographically links your logo to your registered trademark. While not all email providers require it, Gmail—the world’s largest email provider with over 1.8 billion users—mandates a VMC for BIMI logo display.

VMC Requirements:

Your logo must be a registered trademark with an approved intellectual property office (USPTO, EUIPO, UKIPO, CIPO, etc.)
The trademark must be a design mark (word marks alone don’t qualify)
The trademark must be active and in good standing
The logo in your SVG must match the registered trademark

VMC Issuers (as of 2024):

DigiCert — Verified Mark Certificates starting ~$1,499/year
Entrust — Similar pricing and validation process

The validation process typically takes 3-6 weeks, involving trademark verification and organization authentication.

What If You Don’t Have a Registered Trademark?

If trademark registration isn’t feasible immediately, you can still implement BIMI for providers that don’t require a VMC (Yahoo Mail, Fastmail, Apple Mail). However, investing in trademark registration is worthwhile for the complete BIMI ecosystem—and for broader intellectual property protection.

Publishing Your BIMI DNS Record

Once you have your SVG logo hosted and (optionally) your VMC, it’s time to publish the BIMI DNS record.

BIMI Record Structure

The BIMI record is a TXT record published at a specific subdomain:

default._bimi.yourdomain.com

The record value follows this format:

v=BIMI1; l=https://yourdomain.com/brand/logo.svg; a=https://yourdomain.com/brand/vmc.pem

Tag	Description	Required
`v=BIMI1`	Version identifier	Yes
`l=`	URL to your SVG Tiny PS logo (HTTPS required)	Yes
`a=`	URL to your VMC certificate in PEM format	Required for Gmail

Example DNS Configuration

Here’s a complete example for a domain using Cloudflare DNS:

Record Type: TXT
Name: default._bimi
Value: v=BIMI1; l=https://www.example.com/images/bimi-logo.svg; a=https://www.example.com/certs/vmc.pem
TTL: 3600

Important Hosting Requirements for Logo and VMC:

Both URLs must use HTTPS
The server must return proper Content-Type headers
- SVG: image/svg+xml
- VMC: application/x-pem-file
The files must be publicly accessible (no authentication)
Use a reliable CDN or hosting with high uptime (this is where AWS expertise matters—at Lueur Externe, we typically host these assets on AWS S3 + CloudFront for maximum reliability and global performance)

Testing and Validating Your BIMI Implementation

After publishing your DNS record, don’t just wait and hope. Validate everything.

Validation Tools:

BIMI Inspector (bimigroup.org/bimi-generator) — Checks your entire BIMI chain
MXToolbox BIMI Lookup — Verifies DNS record syntax
Google Admin Toolbox — Tests DMARC alignment
Mail-tester.com — Comprehensive email authentication testing

Testing Checklist:

DMARC policy is quarantine or reject with pct=100
SPF record is valid and not exceeding 10 DNS lookups
DKIM signing is active for all sending sources
BIMI TXT record resolves correctly at default._bimi.yourdomain.com
SVG file is accessible via HTTPS and validates as SVG Tiny PS
VMC certificate is valid, not expired, and accessible
Logo displays correctly when tested with supported email clients

Common Pitfalls to Avoid:

SVG not in Tiny PS format — Regular SVG files will be rejected silently
DMARC at p=none — Logo won’t display regardless of other configurations
Mixed sending sources without DKIM — Even one unauthenticated stream breaks DMARC alignment
Logo URL returning 403/404 — Check access permissions
Incorrect DNS record placement — Must be at default._bimi, not the root domain

Which Email Clients Support BIMI?

BIMI adoption is growing steadily. Here’s the current landscape:

Email Client	BIMI Support	VMC Required?	Notes
Gmail	✅ Full support	Yes	Largest deployment, strict requirements
Yahoo Mail	✅ Full support	No	Early BIMI adopter
Apple Mail	✅ iOS 16+ / macOS Ventura+	No	Uses own verification system too
Fastmail	✅ Full support	No	Strong privacy-focused provider
Microsoft Outlook	🔄 Rolling out	TBD	General availability expected 2024-2025
AOL	✅ Full support	No	Part of Yahoo ecosystem

With Gmail and Apple Mail alone, you’re covering well over 2.5 billion email accounts worldwide. When Outlook fully joins, BIMI will reach virtually every professional inbox.

Real-World Impact: BIMI Case Studies

Case Study 1: Financial Services Company

A mid-size European bank implemented BIMI across their transactional and marketing emails:

Open rate increase: +7.5% within 3 months
Phishing reports from customers: Down 65%
Brand trust score (surveyed): Up 22 points

Case Study 2: E-commerce Brand

An online retailer with 500K+ subscribers:

Time from BIMI project start to live: 8 weeks (including trademark registration delays)
Click-through rate improvement: +4.2%
Customer support tickets about “suspicious emails”: Reduced by 40%

These aren’t outlier results. The visual trust that BIMI provides translates directly into engagement metrics that matter.

BIMI Implementation Timeline

Here’s a realistic timeline for a complete BIMI implementation:

Phase	Duration	Activities
Assessment	1-2 weeks	Audit current email auth, identify gaps
DMARC Enforcement	4-12 weeks	Progressive policy tightening with monitoring
Logo Preparation	1-2 weeks	Design/convert SVG Tiny PS, validate
Trademark Registration	6-18 months	If not already registered
VMC Acquisition	3-6 weeks	Application, validation, issuance
DNS Publication	1 day	Publish BIMI record
Testing & Verification	1-2 weeks	Validate across providers

Total realistic timeline: 3-6 months if you already have a registered trademark, or 12-18 months if starting from scratch.

Advanced Considerations

Multiple Brands or Subdomains

If your organization sends email from multiple subdomains (e.g., marketing.yourdomain.com, support.yourdomain.com), you’ll need separate BIMI records for each sending domain. Each requires its own DMARC enforcement.

Selector-Based BIMI Records

While default is the standard selector, the BIMI specification allows custom selectors for different use cases:

campaigns._bimi.yourdomain.com  TXT  "v=BIMI1; l=https://...; a=https://..."

However, receiver support for non-default selectors is currently limited. Stick with default unless you have a specific requirement.

Monitoring and Maintenance

Monitor DMARC reports continuously — New sending sources can break alignment
Renew VMC certificates before expiry — Typically annual renewal
Update logo files if branding changes — DNS propagation means plan ahead
Track logo display rates — Some providers expose this in their postmaster tools

The Business Case for BIMI

Beyond the technical implementation, BIMI represents a strategic investment:

Brand consistency: Your logo appears uniformly across all supporting email clients
Competitive advantage: As of 2024, fewer than 5% of domains have BIMI implemented—early adopters stand out
Security posture: BIMI requires robust email authentication, which independently reduces spoofing risk
Customer confidence: Visual verification reduces hesitation when opening emails or clicking links
Future-proofing: As more providers adopt BIMI, early implementation means you’re already benefiting

For organizations sending tens of thousands of emails monthly, even a 5% improvement in open rates can translate to significant revenue impact.

Conclusion: Make Your Brand Visible in Every Inbox

BIMI is more than a technical specification—it’s a brand visibility strategy that leverages email authentication to earn visual real estate in your recipients’ inboxes. In a world where trust and recognition drive engagement, having your verified logo displayed next to every email you send is a competitive advantage that compounds over time.

The implementation path is clear: solidify your email authentication (SPF, DKIM, DMARC at enforcement), prepare your SVG Tiny PS logo, secure your VMC, and publish your DNS record. The process requires precision and expertise, but the payoff—increased open rates, stronger brand recall, and reduced phishing exposure—makes it well worth the investment.

At Lueur Externe, our team combines deep expertise in DNS configuration, AWS hosting architecture, and email deliverability to guide businesses through every step of the BIMI implementation process. From initial authentication audits to live logo verification, we ensure your brand is represented correctly in every inbox.

Ready to display your brand logo in your recipients’ inboxes? Contact the Lueur Externe team to discuss your BIMI implementation project and take your email branding to the next level.