BIMI Setup: Get Your Logo in the Inbox (2026)

by

A proper bimi setup puts your brand logo next to your emails in the inbox — one of the strongest visual trust signals you can add to your email program. Once configured, Gmail, Yahoo, and Apple Mail display your actual logo beside the sender name, but only if your domain passes strong authentication. This guide walks you through the full bimi setup process: prerequisites, logo and certificate requirements, the exact DNS record, testing, and the mistakes to avoid.

What Is BIMI?

BIMI (Brand Indicators for Message Identification) is an open email standard that lets a domain display its brand logo in the mailbox once the email passes strong authentication. Instead of a generic initial, recipients see your real logo — a clear signal the message is legitimate.

Importantly, BIMI is not authentication itself. It is the reward for doing authentication right: mailbox providers only display your logo when your domain enforces DMARC at p=quarantine or p=reject. Without enforcement, a bimi setup does nothing.

Which Providers Support BIMI?

  • Gmail / Google Workspace: displays BIMI logos. Requires DMARC at quarantine or reject, plus a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).
  • Yahoo Mail: displays BIMI logos. Requires DMARC at reject and a VMC tied to a registered trademark.
  • Apple Mail (iOS 16+ / macOS Ventura+): displays BIMI logos.
  • Fastmail: supports BIMI display.
  • Outlook.com: historically limited support — confirm current behavior with your own test sends.

For most lists, Gmail and Yahoo cover the bulk of recipients, so completing your bimi setup pays off quickly.

Prerequisites: Authentication First

Every bimi setup is built on fully authenticated mail. Verify all of these before you begin:

  • SPF published and passing for every IP that sends for the domain.
  • DKIM signed with a valid key (2048-bit recommended).
  • DMARC at p=quarantine or p=reject, with alignment working for your sending domain.
  • DMARC aggregate reports (rua=) confirm SPF and DKIM consistently pass in alignment.

DMARC at p=none is monitoring only and will not trigger logo display. If you are still on p=none, tighten gradually (none → quarantine with low pct=, then full quarantine, then reject) before starting your bimi setup.

Verify Your DMARC Policy

dig +short TXT _dmarc.yourdomain.com

The response should show p=quarantine or p=reject. Anything less means your bimi setup is not ready yet.

Logo Requirements: Trademark and SVG Tiny PS

BIMI logo rules are strict, and this is where most senders stall:

  • Trademarked logo: a VMC requires a registered trademark of the logo (text marks do not qualify). Without a trademark, a Common Mark Certificate based on established use is an alternative at providers that accept it.
  • SVG Tiny PS: the file must be SVG in the “Tiny Portable/Secure” profile (version="1.2", baseProfile="tiny-ps"). Standard SVGs from design tools must be converted with the BIMI working group's free tools.
  • Square, centered: logos render in a circular or square avatar, so keep the mark centered with safe margins.
  • HTTPS hosted: served from a stable HTTPS URL you control, with an image/svg+xml content type.

Verified Mark Certificate (VMC) Options

A VMC is issued by a Mark Verifying Authority (DigiCert, Entrust, and others) and proves you own the trademark. It is typically a yearly subscription, so budget accordingly.

  • Gmail: needs a VMC or CMC for the logo to display; without one, Gmail authenticates BIMI but shows no logo.
  • Yahoo: needs a VMC tied to a registered trademark.

You can publish the BIMI record before obtaining a certificate — providers that do not require one may show the logo immediately, and your bimi setup will be complete the day the VMC is issued.

The BIMI DNS Record: Exact Format

Publish a TXT record at default._bimi.yourdomain.com:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem;

  • v=BIMI1 — version tag, always first.
  • l= — HTTPS URL of your SVG Tiny PS logo.
  • a= — HTTPS URL of your VMC in PEM format. Omit this tag entirely if you have no certificate — never publish an empty or broken URL.

Without a certificate, the record is simply:

v=BIMI1; l=https://yourdomain.com/logo.svg;

Add it at your DNS provider under the host default._bimi, then confirm propagation with dig +short TXT default._bimi.yourdomain.com.

Testing Your BIMI Setup

  • BIMI validator: run your domain through a public BIMI checker (e.g. bimigroup.org) to validate record syntax, logo format, and the certificate chain.
  • DNS checks: confirm the TXT record resolves from multiple locations; caching delays visibility after changes.
  • SVG validation: the logo must parse as valid SVG Tiny PS and load over HTTPS without redirects or hotlink protection.
  • Send tests: once the checker is green, mail Gmail and Yahoo test inboxes and confirm the logo renders.

Allow 24–48 hours after a correct publication — mailbox providers cache logo lookups, so a too-early test looks like a failed bimi setup.

Reliable Hosting for Your Mail Infrastructure

Your bimi setup is only as reliable as the infrastructure behind it: flaky DNS or a down mail server breaks authentication and the logo disappears. For dependable self-hosted mail, a solid VPS is the practical choice — Contabo offers high-RAM VPS plans at very competitive prices, ideal for Postfix, PowerMTA, or a full mail suite. If you want fast provisioning for mail projects, AVA Hosting is another dependable option.

Common BIMI Setup Mistakes

  • DMARC still at p=none: the most common reason logos never appear.
  • Wrong SVG profile: convert exports to SVG Tiny PS; a designer SVG will be rejected.
  • Blocked logo URL: redirects or hotlink protection break logo fetching.
  • Empty a= tag: omit it until you hold a VMC.
  • Missing subdomain records: sending from mail.yourdomain.com needs a record at default._bimi.mail.yourdomain.com.
  • Impatience: wait 24–48 hours for DNS and logo caches before re-testing.

Key Takeaways

  • A bimi setup shows your brand logo in the inbox once your domain passes SPF, DKIM, and enforced DMARC.
  • DMARC must be at p=quarantine or p=reject; p=none will not trigger logo display.
  • The logo must be trademarked (for a VMC), in SVG Tiny PS format, and hosted over HTTPS.
  • Gmail and Yahoo require a Verified Mark Certificate; budget for the yearly VMC cost.
  • Publish the TXT record at default._bimi.yourdomain.com using the exact v=BIMI1; l=...; a=...; format.
  • Validate with a BIMI checker and allow 24–48 hours for caches before judging results.

Related Guides

Leave a Comment