--- title: "What is BIMI? Inbox logos and how to get a certificate" description: "BIMI is a DNS record that puts your logo beside mail that passes DMARC. How the record, the BIMI logo and VMC or CMC certificates work, inbox by inbox." url: "https://nextmail.sh/blog/what-is-bimi" --- [Blog](https://nextmail.sh/blog.md)[Deliverability](https://nextmail.sh/blog/tags/deliverability.md) # What is BIMI? Inbox logos and how to get a certificate BIMI is a DNS record that puts your logo beside mail that passes DMARC. How the record, the BIMI logo and VMC or CMC certificates work, inbox by inbox. Arta Nextmail team October 31, 2026 10 min read TL;DR - BIMI is a TXT record at default.\_bimi on your domain that points inboxes at a square SVG Tiny PS logo, which they show beside mail that passes DMARC at p=quarantine or p=reject. - Gmail shows the logo only with a Common Mark Certificate or a Verified Mark Certificate and adds its blue checkmark only for a VMC, while Yahoo, AOL and Fastmail can show it with no certificate. - A VMC needs a registered trademark and a CMC a logo shown on your site for at least 12 months, and certificates list at roughly $980 to $1,450 a year. BIMI, short for Brand Indicators for Message Identification, lets a domain choose the logo inboxes show beside its mail. It is one TXT record at `default._bimi` on your domain, pointing at a square SVG logo and, optionally, at a certificate that proves the logo is yours. A supporting inbox draws the logo where it would otherwise show an initial in a circle, and Gmail adds a blue checkmark when the certificate is a Verified Mark Certificate. BIMI sits on top of DMARC: an inbox reads the record only for mail that passes DMARC, on a domain at `p=quarantine` or `p=reject`. If your domain is not there yet, start with [what DMARC is and how to reach p=reject](https://nextmail.sh/blog/what-is-dmarc.md). The specification is still an individual Internet-Draft, not an RFC: revision 14, from 1 May 2026, by authors at Google, Fastmail, Comcast and Valimail. The BIMI Group publishes the implementation guide and the rules for certificates. ## How does BIMI work? 1. **You publish** DMARC at enforcement, a BIMI record, an SVG logo over https and, optionally, a certificate. 2. **A message arrives** with your domain in From. The receiving server checks that it passes DMARC, and that the From domain and its organisational domain are at quarantine or reject. 3. **It finds your record** at `default._bimi` under the From domain, or under the selector a `BIMI-Selector` header names, falling back to the organisational domain. 4. **It fetches the logo** from `l=` and, if it checks certificates, the certificate from `a=`, which must chain to a trusted issuer, name your domain, be in date and carry the logo. 5. **It hands the logo over** in a `BIMI-Location` or `BIMI-Indicator` header, and the mail app draws it as the sender's picture. Receivers keep the final say, may weigh your sending reputation and cache logos, so changes take a while. ## What does a BIMI record look like? txt ``` default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem" ``` | Tag | What it holds | Required | | --- | --- | --- | | `v` | The version, `BIMI1`. It must come first | Yes | | `l` | One https URL of the SVG logo, or empty to publish none | Yes | | `a` | One https URL of the certificate, a PEM file, or empty | No | | `lps` | Local-part prefixes that get records of their own | No | | `avp` | `brand`, the default, or `personal` to prefer a person's own avatar | No | A record without `a=` is self-asserted: you vouch for the logo yourself, and only some inboxes accept that. With `lps=support` in the record, mail from `support@example.com` is looked up at `support._bimi.example.com`. ### Selectors and the BIMI-Selector header `default` is the selector used when a message names none. To give a product line its own logo, publish a record under another selector and name it in a header: txt ``` BIMI-Selector: v=BIMI1; s=brand;brand._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/brand.svg; a=https://example.com/bimi/brand.pem" ``` The draft asks senders to cover that header with a DKIM signature aligned with From, and receivers to ignore it otherwise. To opt a name out, such as a subdomain that should not inherit its parent's logo, publish `v=BIMI1; l=; a=;`. Keep one record per name, because receivers stop at a name with two. And since many DNS hosts append your domain, enter only `default._bimi` as the name. ## BIMI logo requirements: SVG Tiny PS The logo has to be SVG Tiny Portable/Secure, a locked-down profile of SVG Tiny 1.2 with its own Internet-Draft. It cannot run code or load anything, so receivers can draw it safely. A valid file starts like this: xml ``` Example Ltd ``` - **Profile:** `version="1.2"` and `baseProfile="tiny-ps"` on the root, with no `x` or `y` there. - **Title:** a non-empty ``, ideally your organisation's name, in 64 characters or fewer. Google also asks for a `<desc>`. - **Forbidden:** scripts, animation, interactivity, embedded bitmaps and links to other files. - **Shape:** square and centred, as inboxes may show it in a circle or a rounded square. Use a solid background, because a transparent one may not display as expected, and at least two colours, as the draft asks. - **Size:** 32 KB or less, uncompressed. Gmail wants at least 96 by 96 pixels, in absolute pixels, and Fastmail asks for under 16 KB. Design tools do not export this profile on their own. Google's steps start in Adobe Illustrator: save as SVG, not SVGZ, with the SVG Tiny 1.2 profile. Then, in a text editor, change `baseProfile` to `tiny-ps`, remove the root's `x` and `y` and put the `<title>` straight after the opening `<svg>` tag. Turn lettering into outlines first, since Google's steps rule out text. Once it is live, the [BIMI checker](https://nextmail.sh/tools/bimi.md) reads a domain's record and DMARC policy, draws the logo and lists what stops an inbox showing it. ## VMC and CMC: how to get a BIMI certificate A mark certificate is an X.509 certificate with your logo embedded, issued once a certificate authority has checked that the logo is yours. The BIMI Group's Mark Certificate Requirements, version 1.8 of June 2026, define two kinds: | | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) | | --- | --- | --- | | Proves | A registered trademark or a government mark is yours | You have used the logo, or it derives from your trademark | | Main condition | A trademark in good standing at an office the World Intellectual Property Organization recognises | The logo on your site today, and on archive.org at least 12 months earlier on the same domain | | In Gmail | The logo and the blue checkmark | The logo, without the checkmark | A CMC can also cover a modified trademark, with words stacked, part of the design removed or new colours, or a logo that differs from a trademark registered at least three years before. Issuers want DMARC at enforcement first and check who you are: DigiCert asks for notarised ID documents or a live webcam interview. The BIMI Group lists three issuers, or Mark Verifying Authorities: DigiCert, GlobalSign and SSL.com. On 31 October 2026, SSL.com listed a VMC from $1,275 a year and a CMC from $977.50, GlobalSign a VMC from $1,450 and a CMC from $1,035, and DigiCert a $1,416 yearly subscription for its mark certificates. A certificate lasts 398 days at most, so budget for it every year. DigiCert can usually issue the same day once every document is verified, so the wait is in the checks and, for a VMC, the trademark, which Google says can take six to twelve months to register. Host the PEM file with your certificate first, then any intermediate, then the root, and serve the exact SVG embedded in it at `l=`. Under the IETF draft on validating VMCs, receivers take the logo from the certificate and may reject a record whose two logos differ. ## Which email clients support BIMI in 2026? | Inbox | What it needs | What you get | | --- | --- | --- | | Gmail | A VMC or a CMC | The logo, plus a blue checkmark with a VMC | | Apple Mail and iCloud.com | A certificate such as a VMC, checked by the recipient's mail provider | The logo, on iOS 16, iPadOS 16, macOS Ventura 13 and later | | Yahoo Mail and AOL | No certificate, but bulk mail with enough reputation and engagement | The logo in the apps' message list and read view, and in webmail's read view | | Fastmail | No certificate | The logo next to the sender's address | | Outlook.com and Microsoft 365 | Not supported | Nothing | Apple's documentation names the VMC, not the CMC, and leaves the checks to the recipient's provider: the logo shows only when that provider is on the BIMI Group's list and approved by Apple, has verified the certificate, and adds headers vouching for the message. Outlook does not show BIMI logos: Microsoft is the one provider that the BIMI Group's support table, last updated in May 2025, lists as not supporting BIMI. Those it lists as supporting BIMI include Comcast, La Poste, Zoho Mail and Onet Poczta. ## BIMI and DMARC: the enforcement requirement The BIMI Group's guide and the draft set the same rules for your DMARC record: - `p=quarantine` or `p=reject` on the organisational domain, and on the From domain when it is a subdomain with a record of its own. - No `sp=none`. A subdomain policy, if present, has to be quarantine or reject as well. - No `pct` below 100. Leave it out or set it to 100. txt ``` _dmarc.example.com. TXT "v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@example.com" ``` So `news.example.com` gets no logo while `example.com` sits at `p=none`, whatever the subdomain publishes. Getting to enforcement safely takes reports and time: [What is DMARC?](https://nextmail.sh/blog/what-is-dmarc.md) covers the move from `p=none`, and the [DMARC record generator](https://nextmail.sh/tools/dmarc.md) builds each step of it. ## How to set up BIMI, step by step 1. **Authenticate everything that sends as you**, so each service passes DMARC with aligned DKIM or SPF. [SPF, DKIM and DMARC explained](https://nextmail.sh/blog/spf-dkim-dmarc-explained.md) covers the three. 2. **Move DMARC to quarantine or reject** at full strength, with no `sp=none`. 3. **Make the SVG Tiny PS logo**: square, on a solid background, under 32 KB. 4. **Choose a certificate.** None works at Yahoo, AOL and Fastmail, a CMC adds Gmail, and a VMC adds Gmail's checkmark and Apple Mail. 5. **Buy it and pass validation**, with a registered trademark for a VMC or 12 months of use for a CMC. 6. **Host the logo and the PEM file over https**, with TLS 1.2 or later, as Google recommends. 7. **Publish the TXT record** at `default._bimi` on your domain. 8. **Wait up to 48 hours**, Google's figure, then check. 9. **Renew the certificate every year.** ## Why is my BIMI logo not showing? - **DMARC is not at enforcement**: `p=none` on the domain or its organisational domain, `sp=none`, or `pct` below 100. - **The message failed DMARC**, often because a service signs with its own domain instead of yours. - **There is no `a=`** at an inbox that needs a certificate, such as Gmail or Apple Mail. - **The SVG is not Tiny PS**: a wrong `baseProfile`, `x` and `y` on the root, no `<title>` or an embedded bitmap. - **A URL fails**: plain http, a TLS certificate that does not chain to a trusted root, or a file that is not an SVG. - **The certificate does not match**: its logo differs from the one at `l=`, it names another domain or it has expired. - **There are two records** at `default._bimi`, or one landed at `default._bimi.example.com.example.com`. - **Reputation**: Yahoo shows logos only on bulk mail from senders with enough engagement. - **Caching**: receivers keep logos for a while, so publish a new logo at a new URL. - **The inbox has no BIMI support**, as with Outlook. The [BIMI checker](https://nextmail.sh/tools/bimi.md) tests the record, the logo and the DMARC policy in one pass, and the [deliverability checker](https://nextmail.sh/tools/deliverability.md) reads SPF, DKIM, DMARC, BIMI and MX from live DNS. ## Common questions about BIMI ### Do I need a trademark for BIMI? Only for a VMC, which Gmail's checkmark and Apple Mail need. Gmail draws a logo with a CMC, which covers a logo shown on your site for 12 months, and Yahoo, AOL and Fastmail need no certificate at all. ### How much does BIMI cost? The record is free, and so is a self-asserted logo where it is accepted. For Gmail, add a certificate every year, roughly $980 to $1,450 at 2026 list prices, plus registering the trademark for a VMC. ### Does Outlook support BIMI? No. Outlook.com and Microsoft 365 show no BIMI logos, and the BIMI Group lists Microsoft as not supporting it. ### Does a subdomain need its own BIMI record? No. Receivers that follow the draft fall back to the organisational domain's record, and Yahoo honours a subdomain's own record if there is one. The certificate has to name the subdomain or its organisational domain, and both need DMARC at enforcement. ## Where Nextmail fits Every verified domain in Nextmail has a Logo panel on its Sender tab. Upload an ordinary SVG and Nextmail converts it to SVG Tiny PS: it centres the art on a square canvas, sets the profile, adds a `<title>` with your workspace name when the file has none, turns CSS into plain attributes and drops what inboxes do not draw. Files with bitmaps, filters, masks, clipping or links to other files are refused with the reason, as is a logo still over 32 KB once converted. Nextmail serves the logo over https and publishes the record at `default._bimi` where it writes the domain's DNS, or shows you the TXT record to add. Upload your VMC or CMC as the PEM, DER or PKCS #7 file from your certificate authority, and Nextmail checks that it is a mark certificate for the domain and still valid, hosts it, fills in `a=` and, when the certificate carries a logo, publishes that logo so the two match. The panel can move DMARC to quarantine once the domain's mail is signed, reads the parent domain's record for a subdomain, and says inbox by inbox whether the logo shows and what is missing. The same steps are [MCP tools](https://nextmail.sh/docs/mcp/tools/domains.md) and API calls, and the [BIMI check](https://nextmail.sh/docs/api/tools/bimi.md) runs over the API. In the other direction, Nextmail uses a sender's BIMI logo as one source for the picture beside their mail, and a message that fails DMARC gets no logo, as [sender pictures](https://nextmail.sh/features/sender-avatar.md) explains. ## Free tools Try what you just read on your own setup. They are free and need no account. [BIMI logo checker See why an inbox is not drawing your logo.](https://nextmail.sh/tools/bimi.md)[DMARC record generator Build the next DMARC record, step by step.](https://nextmail.sh/tools/dmarc.md) - [Deliverability](https://nextmail.sh/blog/tags/deliverability.md) - [Email authentication](https://nextmail.sh/blog/tags/email-authentication.md) - [DNS](https://nextmail.sh/blog/tags/dns.md) ## References 1. 1 [Brand Indicators for Message Identification (BIMI), draft-brand-indicators-for-message-identification-14](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/) IETF 2. 2 [SVG Tiny Portable/Secure (SVG Tiny PS), draft-svg-tiny-ps-abrotman-12](https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/) IETF 3. 3 [BIMI implementation guide](https://bimigroup.org/implementation-guide/) BIMI Group 4. 4 [Minimum Security Requirements for Issuance of Mark Certificates, version 1.8](https://bimigroup.org/resources/VMC_Requirements_latest.pdf) BIMI Group 5. 5 [BIMI support by mailbox provider](https://bimigroup.org/bimi-infographic/) BIMI Group 6. 6 [Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi) Google 7. 7 [Prepare your email server for BIMI support in Apple Mail](https://developer.apple.com/support/bimi) Apple 8. 8 [Sender Hub: BIMI](https://senders.yahooinc.com/bimi/) Yahoo 9. 9 [Using BIMI in Fastmail](https://www.fastmail.help/hc/en-us/articles/7002542139663) Fastmail 10. 10 [Buy Verified Mark Certificates (VMC) or Common Mark Certificates (CMC)](https://www.digicert.com/tls-ssl/verified-mark-certificates) DigiCert Keep reading ## Related articles Oct 31, 2026 9 min read ### What is DMARC? Policy, reports and getting to p=reject DMARC is a DNS record that checks SPF and DKIM against your visible From domain, tells inboxes what to do with mail that fails and reports who sends as you. Arta Deliverability Oct 31, 2026 5 min read ### SPF, DKIM and DMARC explained: how inboxes trust mail What SPF, DKIM and DMARC each check, why alignment decides whether DMARC passes, and a safe order for moving a domain from p=none to p=reject. Benjamin Deliverability Oct 31, 2026 9 min read ### What is DKIM? How DKIM signatures and records work DKIM is a signature on every email that proves which domain vouches for it and that nothing changed on the way. How it works, tag by tag, and which keys to use. Benjamin Deliverability Try it yourself ## Your email, on your own domain. Nextmail puts your domains, sending and inbox in one place, with the full API on every plan, the free one included. [Open mail](https://nextmail.sh/mail/inbox) [Get Started](https://nextmail.sh/signup.md)[All articles](https://nextmail.sh/blog.md)