BIMI shows your brand logo next to your messages in supporting mailboxes. It needs three things: a DMARC policy at enforcement, a logo in SVG Tiny PS format, and a TXT record at default._bimi.yourdomain pointing to them. Gmail also requires a VMC or CMC certificate. The DNS part is one line:
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem"
Start with DMARC, because without it nothing else matters. The BIMI Group states: “For the brand’s logo to be displayed, the email must pass DMARC authentication checks.” Check yours with the DMARC checker and see the whole picture in the email score.
What does BIMI require from DMARC?
The BIMI Group implementation guide says the DMARC policy “MUST be at enforcement on the organizational domain and subdomains”: p=quarantine; sp=quarantine or p=reject; sp=reject. It adds that p=none or a pct below 100 is not accepted. Google’s Gmail help says the same: p must be quarantine or reject, and pct must be 100.
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
pct=100 was the RFC 7489 default; RFC 9989 removed the pct tag, and some BIMI documentation still mentions it. A record without pct applies the policy to all mail, which is what BIMI documentation asks for. If you are not at enforcement yet, follow How to set up a DMARC record and none, quarantine or reject first. Moving to enforcement can block legitimate mail from forgotten senders, so do it from the reports, not for the logo’s sake.
Requirement 2: the logo
The BIMI Group asks you to “produce an SVG Tiny PS version of your official logo”, a restricted SVG profile that excludes scripts and external references. A normal export from a design tool is usually not valid; use a tool that targets the profile and validate the result. The BIMI Group links the profile specification from its implementation guide.
Host the file over HTTPS at a stable URL. Gmail’s help adds that the image must be at least 96 by 96 pixels with absolute (not percentage) dimensions, and recommends a centered logo on a solid background, 32 KB or smaller, with a <desc> element for accessibility.
Do I need a VMC or CMC certificate for BIMI?
| Option | What it proves | Notes |
|---|---|---|
| None (self-asserted) | Nothing | The BIMI Group says it has “limited support across the various Mailbox Providers” |
| CMC (Common Mark Certificate) | Control of the logo; used in place of trademarked logos | Issued by a Mark Verifying Authority |
| VMC (Verified Mark Certificate) | Ownership of the logo, validated by the authority | Gmail shows a checkmark next to VMC-verified senders |
The BIMI Group lists the certificate step as “Highly recommended, but Optional” and names the authorities on its Certificate Issuers page. Gmail is stricter: its help says “You need a VMC or CMC for your domain from a third-party certificate authority,” and that Gmail supports BIMI only with PEM files, with the logo embedded in the certificate. Certificates cost money and need identity validation, so budget time for it.
The record
The BIMI Group format is default._bimi.[domain] IN TXT "v=BIMI1; l=[SVG URL]; a=[PEM URL]".
l=is the URL of the SVG logo.a=is the URL of the VMC/CMC in PEM form. The BIMI Group describes it as optional for self-asserted records.- For Gmail with a certificate, Google’s example leaves
l=empty and sets onlya=:v=BIMI1;l=;a=https://images.example.com/certificate.pem.
Use https: URLs, not http:. Publish one record. After publishing, Google says it can take up to 48 hours for the logo to show.
Mailbox provider support
Each provider decides on its own. The BIMI Group states that “each participating mailbox provider has their own criteria for determining when a domain’s BIMI logo may be displayed”. Provider-published requirements change, so check each provider’s current documentation. DNSVerdict has verified only Gmail’s requirements from Google’s own help page (now served at knowledge.workspace.google.com). A passing DNS check does not guarantee that a logo will appear.
The standard
BIMI is not an RFC. It is an individual Internet-Draft, draft-brand-indicators-for-message-identification, version 14 as of 1 May 2026, with an expiry date of 2 November 2026. The datatracker marks it as not endorsed by the IETF. Drafts change; expect a newer version number.
FAQ
Do I need a certificate to publish a BIMI record? Publishing a record needs none: the BIMI Group’s implementation guide calls the certificate “Highly recommended, but Optional”, and a self-asserted record is valid DNS. Display is another matter. Google’s Gmail help says you need a VMC or CMC from a third-party certificate authority, so Gmail will not show the logo without one. Other providers set their own rules.
My BIMI record is valid but no logo shows. What should I check?
Work through the requirements in order. DMARC must be at enforcement (quarantine or reject) and applied to all mail, per the BIMI Group implementation guide. The SVG Tiny PS file must load over HTTPS, and Gmail needs a valid VMC or CMC. Google says a new logo can take up to 48 hours to appear, and each mailbox provider applies its own display criteria.
Can I use a subdomain?
Yes, you can publish BIMI for a sending subdomain, but the DMARC requirement still covers the whole domain tree. The BIMI Group implementation guide says the policy must be at enforcement on the organizational domain and its subdomains. Set sp= to quarantine or reject as well as p=, otherwise a subdomain that inherits a weaker policy can disqualify the logo.
Sources
- BIMI Group, Implementation Guide: https://bimigroup.org/implementation-guide/
- BIMI Group, home page: https://bimigroup.org/
- Google, Set up BIMI (redirected from https://support.google.com/a/answer/10911320): https://knowledge.workspace.google.com/admin/security/set-up-bimi
- IETF Datatracker, draft-brand-indicators-for-message-identification: https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/
- RFC 9989 (obsoletes RFC 7489): https://www.rfc-editor.org/rfc/rfc9989