CyberFurl can load analytics only after you opt in. Core product features work without analytics consent.
What is BIMI? Brand Logo in Gmail & Apple Mail — Full Guide (2025)
Email Security
BIMI Explained: How to Display Your Verified Brand Logo in Gmail, Apple Mail, and Yahoo
BIMI (Brand Indicators for Message Identification) displays your verified brand logo in Gmail, Apple Mail, and Yahoo inbox next to authenticated emails. It requires DMARC at p=quarantine or p=reject and a Verified Mark Certificate (VMC). Learn the exact requirements, common failure causes, VMC costs, and how to implement BIMI step by step.
BIMI (Brand Indicators for Message Identification) displays your verified brand logo in Gmail, Apple Mail, and Yaho…
What is BIMI?
BIMI (Brand Indicators for Message Identification) is an email standard that displays your verified brand logo next to your emails in Gmail, Apple Mail, Yahoo, and other supporting mail clients. When a recipient sees an email from a BIMI-enabled domain, they see your company logo — typically your avatar or brand mark — instead of a generic initial or silhouette.
BIMI is not just a cosmetic feature. The logo only appears when the underlying email authentication stack is fully enforced: DMARC must be at p=quarantine or p=reject, and in most major mail clients, a Verified Mark Certificate (VMC) must cryptographically prove your trademark ownership. This means BIMI is a visual indicator of authentication maturity — and for recipients, the absence of a logo on an email claiming to be from a BIMI-enabled brand becomes an immediate red flag.
BIMI requirements (what you need before implementing)
BIMI sits on top of your existing email authentication stack. Before publishing a BIMI record, all of these prerequisites must be in place:
| Requirement | Details |
|-------------|---------|
| DMARC enforcement | p=quarantine or p=reject at pct=100 — p=none is not sufficient |
| SPF alignment | SPF must pass and align with your From domain |
| DKIM alignment | DKIM must pass and align with your From domain |
| Registered trademark | Required to obtain a VMC — must be registered with a recognized IP office |
| SVG Tiny PS logo | Square, under 32KB, no external resources, compliant with Tiny PS schema |
| Verified Mark Certificate (VMC) | Required by Gmail and Apple Mail — issued by DigiCert or Entrust |
| HTTPS hosting | Both logo and VMC must be served from valid HTTPS endpoints |
BIMI is not an entry-level email control. It is the reward for completing the harder authentication work first.
SVG Tiny PS format: what it is and why it matters
Mailbox providers require logos in SVG Tiny PS (Portable Secure) format because they must render the logo safely in their UI without executing scripts or loading external resources. Regular SVG files from design tools typically fail BIMI validation.
SVG Tiny PS requirements:
Square aspect ratio (1:1)
File size under 32KB
Must include <title> and <desc> elements
No external script references, no <use> referencing external files
No embedded raster images (PNG, JPEG, etc. inside the SVG)
Valid XML with proper SVG Tiny PS namespace
Must be hosted at a stable HTTPS URL
Common failure: exporting from Adobe Illustrator or Figma with default settings generates SVG that fails BIMI validation. Use a dedicated BIMI SVG validator and, if needed, a conversion tool that strips prohibited elements.
VMC vs CMC certificates
Verified Mark Certificate (VMC) is the current production standard for BIMI. Issued by DigiCert or Entrust, it cryptographically binds the domain to the registered trademark and the SVG logo. Gmail and Apple Mail require VMCs.
Common Mark Certificate (CMC) is a newer, simpler certificate type designed for organizations without registered trademarks — it allows logo display based on brand recognition criteria rather than trademark ownership. CMC support is rolling out gradually across mailbox providers (Yahoo has piloted CMC support). For most enterprise implementations, VMC remains the primary path.
BIMI in Gmail, Apple Mail, and Yahoo
Gmail: Supports BIMI with VMC required. Logo appears in the inbox next to sender name, and in the message view. Widely adopted by major brands — users are increasingly familiar with expecting logos from trusted senders.
Apple Mail: Supported with VMC required. Logo appears in the message list and message view. Apple introduced support in iOS 16 and macOS Ventura.
Yahoo Mail: Supports BIMI with VMC optional (can publish with empty a= tag for testing or for senders without a trademark). Good for validating SVG and DNS setup before investing in VMC.
Outlook / Microsoft 365: Does not currently support BIMI logo display in the traditional sense. Microsoft has its own brand verification system separate from the BIMI standard.
How to publish a BIMI record
step 1─────────>
step 2─────────>
step 3─────────>
step 4─────────>
step 5─────────>
step 6
1. Step 1:BIMI requires DMARC policy to be at p=quarantine or p=reject with pct=100. Check your DMARC record with a DMARC checker tool. If you are still at p=none, complete your DMARC rollout before proceeding — BIMI will not display without enforcement. Subdomain policy (sp=) should also be set to quarantine or reject.
2. Step 2:Your brand logo must be in SVG Tiny PS (Portable Secure) format — not a regular SVG exported from Illustrator or Figma. The file must be square aspect ratio, under 32KB, include <title> and <desc> elements, and contain no external scripts, fonts, or resources. Use a BIMI SVG validator to check the file before proceeding. Common failures: non-square ratio, prohibited XML attributes, missing namespaces, or embedded raster images.
3. Step 3:Apply for a VMC from an authorized CA (DigiCert or Entrust). Requirements: an active registered trademark for the logo, domain control validation, and the BIMI-compliant SVG file. The CA performs trademark ownership verification against intellectual property offices (USPTO, EUIPO, etc.). Timeline: 3-6 weeks typically. The VMC is issued as a PEM certificate file that you host on an HTTPS server at your domain.
4. Step 4:Both the logo file and the VMC must be hosted at publicly accessible HTTPS URLs with valid TLS certificates. Host them at your own domain (e.g., https://bimi.example.com/logo.svg and https://bimi.example.com/bimi.pem). Ensure the endpoints are fast, always-on, and have valid, non-expired TLS certificates — mailbox providers fetch these files when validating every BIMI-enabled email.
5. Step 5:Publish a TXT record at default._bimi.yourdomain.com containing both URIs: v=BIMI1; l=https://bimi.example.com/logo.svg; a=https://bimi.example.com/bimi.pem; — For Yahoo (VMC-optional): v=BIMI1; l=https://bimi.example.com/logo.svg; a=; — After publishing, wait for DNS propagation and verify the record with a BIMI checker tool.
6. Step 6:Send test emails to Gmail, Apple Mail, and Yahoo accounts and confirm the logo appears next to your sender name. BIMI display is not instant — some providers cache BIMI data with TTLs of several hours. Monitor VMC expiration (typically 397 days) and calendar renewal 60 days in advance. Set up DNS monitoring on the _bimi record to alert on unauthorized changes.
Common BIMI failures
DMARC not at enforcement: The most common failure. A domain at p=none will never display BIMI logos — DMARC enforcement is a hard gate.
Invalid SVG format: The SVG file fails Tiny PS schema validation. Run the file through a BIMI SVG validator before hosting it. Invalid namespace declarations, missing <title>, or prohibited elements are frequent culprits.
Self-signed or non-VMC certificate: The a= tag must point to a real VMC from DigiCert or Entrust. Using a self-signed certificate, a Let's Encrypt TLS certificate, or a standard web certificate in place of a VMC causes immediate rejection by Gmail and Apple Mail.
VMC expired: VMCs have a validity period (typically 397 days). An expired VMC causes the logo to disappear globally. Track VMC expiration dates the same way you track TLS certificate renewals.
HTTPS hosting issues: If the l= logo URL or a= VMC URL is unreachable, slow, or returns TLS errors, the mailbox provider cannot validate BIMI. Ensure both endpoints are highly available with valid certificates.
pct tag below 100: pct=100 is required. A DMARC record with pct=50 (enforcing on only 50% of failing mail) does not qualify for BIMI display in Gmail.
ROI of BIMI: business case and open rates
BIMI is primarily a trust and brand signal, not a deliverability control. The business case:
Increased open rates: Studies from the BIMI Group show 10-15% improvement in open rates for BIMI-enabled senders compared to non-BIMI
Brand recognition: Recurring visual presence of your logo builds inbox familiarity and trains recipients to expect it — making spoofed emails that lack the logo stand out immediately
Authentication maintenance: The VMC renewal cycle forces annual review of DMARC, DKIM, and SVG assets — acting as a forcing function for authentication hygiene
Competitive differentiation: In crowded inboxes, a verified logo distinguishes your emails from generic-looking competitors
For brands with high email volume (marketing, financial services, healthcare), the ROI of BIMI typically justifies the VMC investment. For low-volume senders, completing DMARC enforcement may be the better immediate priority.
Technical Architecture
BIMI is architecturally dependent on the email authentication stack. Once DMARC passes, the receiving MTA queries default._bimi.example.com for the BIMI TXT record, which contains two URIs:
Logo URI (l=): HTTPS link to the SVG Tiny PS logo file
Certificate URI (a=): HTTPS link to the VMC PEM file
The mailbox client fetches both, validates the VMC against trusted root CAs, and cryptographically verifies the VMC covers the SVG content. If all checks pass, the UI renders the logo.
DNS Record / Config
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://bimi.example.com/logo.svg; a=https://bimi.example.com/bimi.pem;"
For Yahoo testing (VMC optional):
DNS Record / Config
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://bimi.example.com/logo.svg; a=;"
Common Misconfigurations
Insufficient DMARC policy: p=none or pct<100 disqualifies BIMI display in Gmail
Invalid SVG format: Non-compliant Tiny PS files fail silently — logo simply does not appear
Self-signed certificates in a=: Only DigiCert and Entrust VMCs are accepted by Gmail and Apple Mail
Missing subdomain isolation: Unprotected subdomains with weak DMARC can damage organizational domain reputation and indirectly affect BIMI display eligibility
Compliance Impact
CISA BOD 18-01: Federal agencies achieving BIMI readiness demonstrate successful, sustained DMARC p=reject compliance
Trademark validation: VMC issuance requires legal proof of trademark registration — forces alignment between digital infrastructure and legal brand ownership
Best Practices for BIMI in 2025/2026
Never rush to p=reject just for BIMI — advance DMARC enforcement because it is the right security control, not to unlock a logo
Validate the SVG before purchasing a VMC — a non-compliant SVG wastes the VMC application process and fees
Track VMC expiration like TLS certs — calendar a renewal reminder 60 days before expiry
Monitor the _bimi TXT record — unauthorized modifications to the l= URI could point recipients to a malicious logo
Tools to check your BIMI
Use the CyberFurl BIMI validator as your primary BIMI checker to inspect the live DNS record, verify DMARC enforcement level, validate SVG compliance, and test VMC validity. Running a BIMI check before and after implementation confirms the full authentication chain is working. For ongoing BIMI monitoring — including DMARC alignment status, VMC expiration tracking, and DNS record integrity — combine the BIMI validator with Email Security monitoring.
CF
How CyberFurl Helps
Automated monitoring. Zero manual work.
CyberFurl BIMI validator provides instant BIMI posture validation covering all four components of a working BIMI deployment: DMARC enforcement level, SVG Tiny PS compliance, VMC validity, and DNS record correctness. By surfacing the exact failure reason across the full authentication stack, CyberFurl eliminates the guesswork from BIMI debugging.
The BIMI DNS record itself is free to publish. The cost comes from the Verified Mark Certificate (VMC), which is required by major mailbox providers like Gmail and Apple Mail to display your logo. VMC pricing from the two authorized Certificate Authorities (DigiCert and Entrust) typically ranges from $1,000 to $3,000 per year per domain. Before purchasing a VMC, you also need a registered trademark in the applicable jurisdiction — trademark registration fees vary by country but typically run $300 to $1,500. Yahoo historically supported BIMI without a VMC (using the a= tag empty), allowing organizations to test logo display before committing to certificate costs. Gmail and Apple Mail require a valid VMC.
Do I need a VMC for BIMI?
For Gmail and Apple Mail — yes, a Verified Mark Certificate (VMC) is required. These providers only display the BIMI logo if the a= tag in your BIMI DNS record points to a valid VMC issued by an authorized Certificate Authority (currently DigiCert or Entrust). For Yahoo Mail, a VMC is not strictly required — Yahoo supports BIMI with an empty a= tag, allowing logo display based on DMARC alone. However, the VMC is the direction the broader ecosystem is moving, and both Gmail and Apple Mail (which represent the majority of email opens) require it.
Which mail clients show BIMI?
Gmail (web and mobile) and Apple Mail display BIMI logos for messages from domains with valid BIMI records, DMARC enforcement at p=quarantine or p=reject, and a valid VMC. Yahoo Mail supports BIMI with a simpler setup (VMC optional). Fastmail supports BIMI. Outlook/Microsoft 365 does not currently support BIMI logo display in the traditional sense — Microsoft has its own email brand verification system (BIMI is not implemented for Outlook as of 2025). Coverage among smaller providers varies. Always test in the specific mail clients your audience uses before assuming universal display.
How long does VMC verification take?
The VMC issuance process typically takes 3 to 6 weeks from application to delivery, but preparation can be the longest phase. Before applying for a VMC, you need: (1) an active registered trademark in the jurisdiction(s) where you are applying, (2) a BIMI-compliant SVG Tiny PS logo file, (3) DMARC enforcement at p=quarantine or p=reject. The CA (DigiCert or Entrust) validates your trademark ownership, verifies domain control, and reviews your SVG file before issuing the certificate. Plan for the full process to take 4 to 8 weeks if starting from zero.
Can I use BIMI without DMARC?
No. BIMI is architecturally dependent on DMARC. The receiving mailbox provider only processes the BIMI record if the inbound email passes DMARC authentication. Without DMARC, there is no trust signal for the receiving provider to verify that the email genuinely came from the domain claiming the logo. Furthermore, BIMI requires DMARC policy to be at p=quarantine or p=reject — monitoring mode (p=none) is not sufficient. If your domain is still at p=none, you must complete your DMARC rollout before BIMI implementation is possible.
What trademark is required to get a Verified Mark Certificate?
A VMC requires an active registered trademark specifically for the logo you want to display — not just a wordmark or brand name in text form. The trademark must be registered with a recognized intellectual property office such as the USPTO (United States), EUIPO (European Union), UKIPO (United Kingdom), JPO (Japan), or other WIPO-recognized national offices. A pending trademark application is not sufficient — the trademark must be granted and active. If your organization does not have a registered trademark for your specific logo, pursuing trademark registration is the mandatory first step before beginning the VMC application process with DigiCert or Entrust.
How do I validate my SVG logo file before applying for a VMC?
Use a dedicated BIMI SVG validator tool before submitting to a Certificate Authority. Key checks the validator runs: (1) Is the file in SVG Tiny PS format with the correct namespace declaration? (2) Is the aspect ratio exactly 1:1 square? (3) Does the file include required <title> and <desc> elements? (4) Are there any prohibited elements — external scripts, Google Fonts references, embedded raster images, or <use> referencing external resources? (5) Is the file under 32KB? Common failure: Illustrator or Figma exports include proprietary namespaces or non-square artboards that fail BIMI validation. Use an online BIMI SVG conversion tool to produce a compliant file, then validate before purchasing a VMC — a non-compliant SVG wastes the application fee.
