What is BIMI? Inbox logos and how to get a certificate

BIMI, short for Brand Indicators for Message Identification, lets a domain choose the logo inboxes show beside its mail. It is one TXT record at default._bimi on your domain, pointing at a square SVG logo and, optionally, at a certificate that proves the logo is yours. A supporting inbox draws the logo where it would otherwise show an initial in a circle, and Gmail adds a blue checkmark when the certificate is a Verified Mark Certificate.

BIMI sits on top of DMARC: an inbox reads the record only for mail that passes DMARC, on a domain at p=quarantine or p=reject. If your domain is not there yet, start with what DMARC is and how to reach p=reject.

The specification is still an individual Internet-Draft, not an RFC: revision 14, from 1 May 2026, by authors at Google, Fastmail, Comcast and Valimail. The BIMI Group publishes the implementation guide and the rules for certificates.

How does BIMI work?

1. You publish DMARC at enforcement, a BIMI record, an SVG logo over https and, optionally, a certificate.
2. A message arrives with your domain in From. The receiving server checks that it passes DMARC, and that the From domain and its organisational domain are at quarantine or reject.
3. It finds your record at default._bimi under the From domain, or under the selector a BIMI-Selector header names, falling back to the organisational domain.
4. It fetches the logo from l= and, if it checks certificates, the certificate from a=, which must chain to a trusted issuer, name your domain, be in date and carry the logo.
5. It hands the logo over in a BIMI-Location or BIMI-Indicator header, and the mail app draws it as the sender's picture.

Receivers keep the final say, may weigh your sending reputation and cache logos, so changes take a while.

What does a BIMI record look like?

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

A record without a= is self-asserted: you vouch for the logo yourself, and only some inboxes accept that. With lps=support in the record, mail from [email protected] is looked up at support._bimi.example.com.

Selectors and the BIMI-Selector header

default is the selector used when a message names none. To give a product line its own logo, publish a record under another selector and name it in a header:

BIMI-Selector: v=BIMI1; s=brand;brand._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/bimi/brand.svg; a=https://example.com/bimi/brand.pem"

The draft asks senders to cover that header with a DKIM signature aligned with From, and receivers to ignore it otherwise.

To opt a name out, such as a subdomain that should not inherit its parent's logo, publish v=BIMI1; l=; a=;. Keep one record per name, because receivers stop at a name with two. And since many DNS hosts append your domain, enter only default._bimi as the name.

BIMI logo requirements: SVG Tiny PS

The logo has to be SVG Tiny Portable/Secure, a locked-down profile of SVG Tiny 1.2 with its own Internet-Draft. It cannot run code or load anything, so receivers can draw it safely. A valid file starts like this:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">  <title>Example Ltd</title>  <rect width="512" height="512" fill="#0b57d0"/>  <path fill="#ffffff" d="M128 128h256v256H128z"/></svg>

• Profile: version="1.2" and baseProfile="tiny-ps" on the root, with no x or y there.
• Title: a non-empty <title>, ideally your organisation's name, in 64 characters or fewer. Google also asks for a <desc>.
• Forbidden: scripts, animation, interactivity, embedded bitmaps and links to other files.
• Shape: square and centred, as inboxes may show it in a circle or a rounded square. Use a solid background, because a transparent one may not display as expected, and at least two colours, as the draft asks.
• Size: 32 KB or less, uncompressed. Gmail wants at least 96 by 96 pixels, in absolute pixels, and Fastmail asks for under 16 KB.

Design tools do not export this profile on their own. Google's steps start in Adobe Illustrator: save as SVG, not SVGZ, with the SVG Tiny 1.2 profile. Then, in a text editor, change baseProfile to tiny-ps, remove the root's x and y and put the <title> straight after the opening <svg> tag. Turn lettering into outlines first, since Google's steps rule out text.

Once it is live, the BIMI checker reads a domain's record and DMARC policy, draws the logo and lists what stops an inbox showing it.

VMC and CMC: how to get a BIMI certificate

A mark certificate is an X.509 certificate with your logo embedded, issued once a certificate authority has checked that the logo is yours. The BIMI Group's Mark Certificate Requirements, version 1.8 of June 2026, define two kinds:

A CMC can also cover a modified trademark, with words stacked, part of the design removed or new colours, or a logo that differs from a trademark registered at least three years before. Issuers want DMARC at enforcement first and check who you are: DigiCert asks for notarised ID documents or a live webcam interview.

The BIMI Group lists three issuers, or Mark Verifying Authorities: DigiCert, GlobalSign and SSL.com. On 31 October 2026, SSL.com listed a VMC from $1,275 a year and a CMC from $977.50, GlobalSign a VMC from $1,450 and a CMC from $1,035, and DigiCert a $1,416 yearly subscription for its mark certificates.

A certificate lasts 398 days at most, so budget for it every year. DigiCert can usually issue the same day once every document is verified, so the wait is in the checks and, for a VMC, the trademark, which Google says can take six to twelve months to register.

Host the PEM file with your certificate first, then any intermediate, then the root, and serve the exact SVG embedded in it at l=. Under the IETF draft on validating VMCs, receivers take the logo from the certificate and may reject a record whose two logos differ.

Which email clients support BIMI in 2026?

Apple's documentation names the VMC, not the CMC, and leaves the checks to the recipient's provider: the logo shows only when that provider is on the BIMI Group's list and approved by Apple, has verified the certificate, and adds headers vouching for the message.

Outlook does not show BIMI logos: Microsoft is the one provider that the BIMI Group's support table, last updated in May 2025, lists as not supporting BIMI. Those it lists as supporting BIMI include Comcast, La Poste, Zoho Mail and Onet Poczta.

BIMI and DMARC: the enforcement requirement

The BIMI Group's guide and the draft set the same rules for your DMARC record:

• p=quarantine or p=reject on the organisational domain, and on the From domain when it is a subdomain with a record of its own.
• No sp=none. A subdomain policy, if present, has to be quarantine or reject as well.
• No pct below 100. Leave it out or set it to 100.

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:[email protected]"

So news.example.com gets no logo while example.com sits at p=none, whatever the subdomain publishes. Getting to enforcement safely takes reports and time: What is DMARC? covers the move from p=none, and the DMARC record generator builds each step of it.

How to set up BIMI, step by step

1. Authenticate everything that sends as you, so each service passes DMARC with aligned DKIM or SPF. SPF, DKIM and DMARC explained covers the three.
2. Move DMARC to quarantine or reject at full strength, with no sp=none.
3. Make the SVG Tiny PS logo: square, on a solid background, under 32 KB.
4. Choose a certificate. None works at Yahoo, AOL and Fastmail, a CMC adds Gmail, and a VMC adds Gmail's checkmark and Apple Mail.
5. Buy it and pass validation, with a registered trademark for a VMC or 12 months of use for a CMC.
6. Host the logo and the PEM file over https, with TLS 1.2 or later, as Google recommends.
7. Publish the TXT record at default._bimi on your domain.
8. Wait up to 48 hours, Google's figure, then check.
9. Renew the certificate every year.

Why is my BIMI logo not showing?

• DMARC is not at enforcement: p=none on the domain or its organisational domain, sp=none, or pct below 100.
• The message failed DMARC, often because a service signs with its own domain instead of yours.
• There is no a= at an inbox that needs a certificate, such as Gmail or Apple Mail.
• The SVG is not Tiny PS: a wrong baseProfile, x and y on the root, no <title> or an embedded bitmap.
• A URL fails: plain http, a TLS certificate that does not chain to a trusted root, or a file that is not an SVG.
• The certificate does not match: its logo differs from the one at l=, it names another domain or it has expired.
• There are two records at default._bimi, or one landed at default._bimi.example.com.example.com.
• Reputation: Yahoo shows logos only on bulk mail from senders with enough engagement.
• Caching: receivers keep logos for a while, so publish a new logo at a new URL.
• The inbox has no BIMI support, as with Outlook.

The BIMI checker tests the record, the logo and the DMARC policy in one pass, and the deliverability checker reads SPF, DKIM, DMARC, BIMI and MX from live DNS.

Common questions about BIMI

Do I need a trademark for BIMI?

Only for a VMC, which Gmail's checkmark and Apple Mail need. Gmail draws a logo with a CMC, which covers a logo shown on your site for 12 months, and Yahoo, AOL and Fastmail need no certificate at all.

How much does BIMI cost?

The record is free, and so is a self-asserted logo where it is accepted. For Gmail, add a certificate every year, roughly $980 to $1,450 at 2026 list prices, plus registering the trademark for a VMC.

Does Outlook support BIMI?

No. Outlook.com and Microsoft 365 show no BIMI logos, and the BIMI Group lists Microsoft as not supporting it.

Does a subdomain need its own BIMI record?

No. Receivers that follow the draft fall back to the organisational domain's record, and Yahoo honours a subdomain's own record if there is one. The certificate has to name the subdomain or its organisational domain, and both need DMARC at enforcement.

Where Nextmail fits

Every verified domain in Nextmail has a Logo panel on its Sender tab. Upload an ordinary SVG and Nextmail converts it to SVG Tiny PS: it centres the art on a square canvas, sets the profile, adds a <title> with your workspace name when the file has none, turns CSS into plain attributes and drops what inboxes do not draw. Files with bitmaps, filters, masks, clipping or links to other files are refused with the reason, as is a logo still over 32 KB once converted.

Nextmail serves the logo over https and publishes the record at default._bimi where it writes the domain's DNS, or shows you the TXT record to add. Upload your VMC or CMC as the PEM, DER or PKCS #7 file from your certificate authority, and Nextmail checks that it is a mark certificate for the domain and still valid, hosts it, fills in a= and, when the certificate carries a logo, publishes that logo so the two match.

The panel can move DMARC to quarantine once the domain's mail is signed, reads the parent domain's record for a subdomain, and says inbox by inbox whether the logo shows and what is missing. The same steps are MCP tools and API calls, and the BIMI check runs over the API.

In the other direction, Nextmail uses a sender's BIMI logo as one source for the picture beside their mail, and a message that fails DMARC gets no logo, as sender pictures explains.