What is BIMI? Brand Indicators for Message Identification

Brand Indicators for Message Identification (BIMI) is an email specification that displays a business's verified brand logo next to authenticated messages in the recipient's inbox. Pronounced "bih-mee," it builds directly on DMARC, SPF, and DKIM: only mail that has already passed authentication and meets an enforced DMARC policy can carry a logo. By turning authentication into a visible trust signal, BIMI helps recipients recognise legitimate mail at a glance and makes phishing that impersonates your brand harder to pull off.

How does BIMI work?

BIMI relies on a foundation of email authentication so that only verified senders can display a logo. The flow has three moving parts:

BIMI only activates once DMARC is enforced at quarantine or reject.

• DMARC authentication. The message must pass DMARC, which in turn depends on SPF (confirming the sending IP is authorised) and DKIM (validating the cryptographic signature). Critically, your DMARC policy must be set to p=quarantine or p=reject — a p=none monitoring policy will not trigger BIMI.
• BIMI record. The domain owner publishes a DNS TXT record at default._bimi.yourdomain.com containing a URL to a logo in SVG Tiny Portable/Secure (SVG Tiny P/S) format, hosted over HTTPS. The record can also point to a certificate that proves you own the logo. You can generate and check a record with the BIMI record tool.
• Logo display. When a supporting inbox receives an authenticated message from your domain and finds a valid BIMI record, it renders your logo beside the message — and, where a Verified Mark Certificate is present, a verified checkmark.

What you need before BIMI will work

BIMI is not plug-and-play. Before a logo will ever appear, you need all of the following in place:

• An enforced DMARC policy at p=quarantine or p=reject, applied at 100% (no pct below 100), with SPF and DKIM passing and aligned for your legitimate mail.
• A square SVG Tiny P/S logo — the profile strips scripts and external references for security. A normal SVG exported from a design tool usually needs conversion.
• HTTPS hosting for both the logo file and, where used, the certificate.
• A mark certificate for the inboxes that require one (covered below).
• A healthy sending reputation. Even a perfect BIMI setup can be suppressed if a domain has spam complaints or poor domain reputation, because providers gate logo display on trust as well as authentication.

VMC vs CMC: which certificate do you need?

Two certificate types can back a BIMI record, and the difference matters:

• Verified Mark Certificate (VMC). Proves the logo is a trademark you own, validated by a certificate authority. A VMC is what unlocks the Gmail blue verified checkmark, and it is required by Apple Mail and by Gmail for the checkmark experience.
• Common Mark Certificate (CMC). A newer, lighter option for logos that are not registered trademarks (for example, a logo in use for at least a year). A CMC can display your logo in Gmail but does not grant the verified checkmark.

If your logo is a registered trademark and you want the checkmark, get a VMC. If it isn't trademarked, a CMC now lets many brands display a logo that previously couldn't qualify at all.

Which inboxes display BIMI logos?

Support has broadened well beyond the original launch partners. As of 2026, BIMI logos render in Gmail and Google Workspace, Apple Mail (iOS 16 / macOS Ventura and later), Yahoo Mail, AOL, Fastmail, and several regional providers such as GMX and La Poste. Apple Mail and the Gmail checkmark both require a VMC.

The notable holdout is Microsoft: Outlook.com, Hotmail, Exchange Online, and Microsoft 365 mailboxes do not render standard BIMI logos for normal inbound mail. Plan your rollout knowing a large share of business recipients won't see the logo yet — the authentication work underneath it still pays off everywhere.

Why BIMI matters

• Enhanced trust. A verified logo signals authenticity, helping users tell genuine mail from impersonation — especially valuable in banking, healthcare, and retail.
• Brand visibility. Your logo stands out in a crowded inbox, reinforcing recognition before the message is even opened.
• Better engagement. Recognisable, trusted mail tends to see higher open and click-through rates.
• An incentive to enforce DMARC. Because BIMI requires quarantine or reject, it gives teams a concrete, visible reason to finish the DMARC journey they might otherwise leave at none.

BIMI won't activate without an enforced DMARC policy and proper SPF and DKIM.

You can confirm your DMARC, SPF, and BIMI readiness in one place with the Email Security Score, and if you're not yet at enforcement, see what a VMC is and how it fits the picture.

Related reading

• What are DMARC, DKIM, and SPF?
• What is a VMC?
• What is spoofing?