BIMI explained: how a verified logo shows up next to your email
BIMI shows a verified logo next to your email in Gmail and Yahoo, but only after DMARC enforcement. What the record requires and what a VMC costs.
By David Lara, Founder
Founder-reviewed ·How we research and correct articles
BIMI stands for Brand Indicators for Message Identification. It’s the mechanism that puts your actual logo — not a generic avatar, not the first letter of your name in a colored circle — next to your emails in a supporting inbox. It’s the last piece of the authentication stack most senders bother with, and the one requirement trips up nearly everyone building toward it: you need DMARC at enforcement first.
This is a guide to what BIMI actually requires, what it does and doesn’t do for you, and whether the certificate that unlocks the checkmark is worth buying.
What BIMI actually does
BIMI is a DNS-published pointer to an SVG logo, checked at delivery time by a small number of mailbox providers. When a message from your domain authenticates cleanly and your BIMI record resolves, the provider fetches your logo and renders it where the sender avatar normally goes.
That’s the entire mechanism. BIMI is a display feature, not a filtering signal. It doesn’t touch spam scoring, and it doesn’t run before your mail is already accepted and authenticated. If your messages were landing in the spam folder before you set up BIMI, they still will after — the logo only ever appears on mail that already passed. For the filtering layer itself, see why emails go to spam.
What it does give you is a trust signal at the exact moment a recipient decides whether to open the message — recognizable brand mark, next to a name they may or may not already know.
Why DMARC enforcement comes first
Every major implementer requires the sending domain to publish DMARC at
p=quarantine or p=reject, applied to the full stream — pct=100,
not a partial rollout. A domain still sitting at p=none doesn’t qualify,
full stop, no matter how correctly the BIMI record itself is configured.
The logic is straightforward: BIMI is a promise that “mail claiming to be
this domain is provably this domain.” p=none makes no such promise — it
only watches. p=quarantine and p=reject are the two policies that
actually act on failures, so they’re the only ones a receiver will trust
enough to hang a logo on.
If you’re not at enforcement yet, that’s the real prerequisite project. Read p=none vs p=quarantine vs p=reject for the honest climbing checklist, and use the free DMARC record generator to build a correct record once you’re ready to move.
BIMI sits on top of DMARC enforcement — it’s the last layer, not a substitute for the authentication underneath it.
The BIMI DNS record
A BIMI record is a TXT record published at a fixed subdomain, using the
selector default unless you have a reason to run more than one:
default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg;"Two tags matter:
l=— the HTTPS URL of your logo, which must be an SVG Tiny PS file (a restricted, security-scoped profile of SVG — no scripts, no external references, no raster embeds), typically square, on a transparent or solid background.a=— the HTTPS URL of your certificate (VMC or CMC), required by Gmail, optional for providers that accept a self-asserted logo.
default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem;"Verify the record resolves correctly and doesn’t collide with an existing TXT entry using DNS lookup before you consider the setup finished — a malformed or unreachable logo URL is the most common reason BIMI silently fails to render.
VMC vs CMC: the certificate layer
The certificate is where BIMI stops being “just DNS” and starts costing money and paperwork.
- VMC (Verified Mark Certificate) — issued against a registered trademark. It’s what unlocks the blue verified checkmark next to your logo in Gmail, on top of the logo display itself. Trademark registration is the long pole here: expect it to take several months to over a year through a recognized IP office, well before the certificate itself is purchased.
- CMC (Common Mark Certificate) — a newer, lighter option some issuers now offer for senders without a registered trademark. Gmail expanded its BIMI support in 2024 to accept CMCs for eligible senders, which displays the logo without the checkmark. It’s a meaningfully lower bar, but not every provider treats it the same way a VMC is treated.
What a VMC actually costs
Pricing varies by issuer and reseller, but expect roughly $800 to $1,500+ per year, on top of whatever the trademark registration itself costs and the months of lead time it takes. As of 2026, DigiCert, Entrust, GlobalSign, SSL.com, and Sectigo are the issuers listed by the BIMI Group, the working group that maintains the specification and implementation guides.
Where BIMI actually shows up
Support is real but uneven, and it changes as providers iterate:
| Provider | Requires a certificate | Notes |
|---|---|---|
| Gmail | VMC (checkmark) or CMC (logo only) | Requires DMARC at p=quarantine/p=reject, pct=100 |
| Yahoo Mail / AOL | Not required | Will display a self-asserted logo, VMC recommended |
| Apple Mail | Not required | iOS 16+, iPadOS 16+, macOS Ventura 13+, iCloud.com |
| Fastmail | Not required | Displays logo without a certificate |
| Microsoft Outlook / 365 | — | Has not adopted BIMI as of this writing |
The practical takeaway: Yahoo, AOL, Apple Mail, and Fastmail reward a correctly published record with no certificate spend at all. Gmail’s checkmark is the one feature actually gated behind a VMC and a trademark. If your recipient base skews Gmail-heavy — as most B2B cold-email lists do — that’s the provider to plan the certificate decision around.
Setting it up: the order of operations
- Confirm DMARC enforcement.
p=quarantineorp=reject, applied to 100% of mail, no exceptions carved out on subdomains you actually send from. - Design and host an SVG Tiny PS logo. Square, clean, on a domain you control, served over HTTPS with a valid certificate.
- Publish the BIMI TXT record at
default._bimi.yourdomain.com, with just thel=tag to start. - Check rendering in Yahoo, Apple Mail, or another certificate-free provider first — it’s the fastest way to confirm the record and logo are both correct before spending anything.
- Decide on a certificate once the rest works, based on how much of your list is Gmail and whether the checkmark is worth the trademark timeline.
Frequently asked questions
Does BIMI improve deliverability?
Not directly. BIMI is a display feature checked only after a message has already passed authentication and been accepted — it has no effect on spam filtering or inbox placement by itself. The indirect benefit is that reaching BIMI's DMARC requirement forces you to complete a fully enforced authentication setup, which does improve deliverability on its own.
Do I need p=reject for BIMI?
You need DMARC at p=quarantine or p=reject applied to all mail, with pct=100. p=none does not qualify with any current major implementer. Quarantine is sufficient; reject is not a stricter BIMI requirement beyond that, though many senders end up at reject anyway as the final rung of the enforcement ladder.
What is a VMC and do I need one?
A Verified Mark Certificate is a digital certificate issued against a registered trademark that authenticates your logo for BIMI and unlocks the verified checkmark in Gmail. You need one only if you want the Gmail checkmark specifically or if a provider you care about requires a certificate at all — Yahoo, AOL, Apple Mail and Fastmail will display a correctly published logo without one.
Which providers support BIMI?
Gmail, Yahoo Mail, AOL, Apple Mail on iOS 16 and macOS Ventura or later, iCloud.com, and Fastmail all support BIMI logo display as of 2026. Gmail requires a Verified Mark Certificate or Common Mark Certificate; the others will display a self-asserted logo without a certificate. Microsoft Outlook and Microsoft 365 have not adopted BIMI.
Does a Common Mark Certificate replace a VMC?
Not entirely. A CMC lets Gmail display your logo without a registered trademark, which is a meaningfully lower bar than a VMC. But it does not produce the verified checkmark, and not every provider that accepts a VMC treats a CMC the same way, so check current requirements per provider before assuming parity.