BIMI and VMC: is it worth it?
What BIMI shows in the inbox, the DMARC and logo requirements, VMC versus CMC certificates, the costs and a checklist for deciding whether to adopt it.
What BIMI is
Brand Indicators for Message Identification (BIMI) is a standard for showing a sender's logo in the mail client, next to messages that pass DMARC. It is developed by the AuthIndicators Working Group and published as an IETF draft. The logo location, and optionally a certificate proving the right to use it, are published in DNS.
BIMI adds no new authentication. It is a reward for authentication that already exists: providers display the logo only when the message passes DMARC under an enforcing policy. That is why BIMI projects often start as DMARC projects.
Requirements
| Requirement | Details |
|---|---|
| DMARC at enforcement | p=quarantine or p=reject on the organizational domain, with the policy applied to all mail; sp must not weaken it for the sending subdomain |
| SPF and DKIM aligned | Messages must actually pass DMARC, ideally through DKIM |
| BIMI TXT record | At default._bimi.<domain> (or a named selector) with v=BIMI1 and the logo URL |
| SVG Tiny PS logo | Square, the Tiny Portable/Secure profile of SVG, served over HTTPS |
| Mark certificate | VMC or CMC in the a= tag; required by several large providers |
| Reputation | Providers apply their own volume and reputation criteria before displaying anything |
Check your DMARC state with the Email Security before anything else. A record at p=none, or with pct below 100 during a rollout, does not qualify. The p=none to p=reject plan is the path there.
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"An empty l= together with an empty a= declines BIMI for a domain, which is useful for subdomains that should not inherit a logo. Selectors other than default can be named in a BIMI-Selector header of the message, for brands that send several logos from one domain.
Preparing the logo
The logo must use SVG Tiny Portable/Secure (SVG Tiny PS), a restricted profile without scripts, external references, animation or embedded raster images. Most design tools export ordinary SVG, which does not validate; conversion usually means cleaning up the file and setting the profile attributes. The image should be square and look good as a small circle, because many clients crop it.
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
<title>Example Company</title>
<rect width="512" height="512" fill="#ffffff"/>
<path d="M128 128h256v256H128z" fill="#1a5fd0"/>
</svg>- Include a
<title>with the brand name. - Use a solid background; transparent logos can disappear on dark themes.
- Keep the file small and serve it over HTTPS with a stable URL.
- For certificate-backed BIMI, the SVG must be the one embedded in the certificate; changing the logo means a new certificate.
VMC versus CMC
A mark certificate is an X.509 certificate from a qualifying certificate authority that binds a logo to a domain after verifying the organisation. Mailbox providers that require one use it to avoid showing logos of brands a sender has no right to use. The certificate is published as a PEM file at the a= URL.
| Aspect | Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) |
|---|---|---|
| Basis | A registered trademark for the logo in an accepted trademark office | Evidence the logo has been in public use, without a registered trademark |
| Verification | Organisation validation plus trademark check | Organisation validation plus proof of prior use |
| Checkmark in some clients | Yes, where the provider shows verified senders | Generally no checkmark |
| Typical fit | Established brands with registered marks | Organisations without a registered trademark for the exact logo |
Support differs by provider and changes over time. Gmail accepts both VMC and CMC and shows a checkmark for VMC senders. Other providers have their own rules, some requiring a certificate and some showing logos for senders that meet internal criteria without one, so check each provider's current sender documentation before deciding.
Plan for renewals
Costs and effort
| Item | One-time | Ongoing |
|---|---|---|
| DMARC enforcement | Sender inventory and alignment fixes | Report monitoring |
| Trademark (VMC) | Registration if you do not already have one | Renewals through the trademark office |
| Mark certificate | Validation process with the CA | Annual fee and re-validation |
| Logo file | Conversion to SVG Tiny PS | New certificate if the logo changes |
| DNS and hosting | BIMI record, HTTPS hosting for logo and PEM | Minimal |
The DMARC work is the part with lasting security value, and it is needed with or without BIMI. The certificate and trademark are the parts with a direct cost. For an organisation that already has a registered trademark and enforced DMARC, BIMI can be a small project; for one starting from p=none without a trademark, it is a long one.
Is it worth it?
BIMI's benefit is recognition: recipients see a familiar logo in a crowded inbox, and some clients mark certificate-backed senders as verified. Brands that send large volumes of consumer mail, especially where phishing imitates them, have the strongest case. Public figures on measurable open-rate gains exist mostly from vendors, so treat them as indications rather than guarantees.
| Your situation | Suggestion |
|---|---|
DMARC at p=none | Do the DMARC rollout first; revisit BIMI afterwards |
| Enforced DMARC, registered trademark, high consumer volume | Good candidate for BIMI with a VMC |
| Enforced DMARC, no trademark, public-facing brand | Consider a CMC where the providers you care about accept it |
| Mostly business-to-business mail | Lower benefit; many corporate mail clients do not show BIMI logos |
| Small volume, no brand impersonation | Usually not worth the certificate cost |
If you are unsure, measure before and after on a stream you control. Keep sending patterns, content and audience stable for a few weeks on both sides of the launch, and compare engagement at the providers that display the logo with those that do not. That comparison tells you more about your own audience than general statistics can.
Whatever you decide, BIMI does not replace user awareness or monitoring of lookalike domains. A spoofed display name from examp1e-support.example.net shows no logo, but many users will not notice the absence.
The BIMI record in detail
The record is a short tag list, similar in style to DMARC. Providers look it up at <selector>._bimi.<domain>, where the selector is default unless the message names another one. If the exact From domain has no record, providers fall back to the organizational domain.
| Tag | Meaning | Example |
|---|---|---|
v | Version, must be first | v=BIMI1 |
l | HTTPS URL of the SVG Tiny PS logo; empty to decline | l=https://example.com/bimi/logo.svg |
a | HTTPS URL of the mark certificate (PEM); optional in the syntax, required by several providers | a=https://example.com/bimi/vmc.pem |
Host both files on your own domain over HTTPS, at stable URLs that do not redirect through other hosts, and serve them with correct content types. Providers cache the logo and certificate, so a changed file can take a while to appear. Version the file names when you replace a logo, rather than overwriting the old file.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| No logo anywhere | DMARC not at enforcement or pct below 100 | Finish the DMARC rollout; confirm with Email Security |
| No logo, DMARC fine | Messages fail DMARC for this stream | Check alignment in the message headers |
| Logo rejected by validators | SVG is not Tiny PS, or contains scripts or external references | Re-export and validate the SVG |
| Certificate-requiring provider shows nothing | No a= tag, expired certificate, or logo differs from the certificate | Publish a matching, valid VMC or CMC |
| Logo on some messages only | Subdomain or stream uses another From domain without BIMI | Publish BIMI for that domain or align From domains |
| Everything valid, still no logo | Provider reputation or volume thresholds | Keep sending authenticated mail; check the provider's documentation |
Start troubleshooting from a real received message. Its Authentication-Results header in the Email Header Analyzer shows whether DMARC passed and with which policy, which rules out the most common cause in one step.
Security considerations
A logo in the inbox is a trust signal, so it attracts abuse. Mark certificates exist because a logo published in DNS without verification proves only that someone controls a domain, not that they own the brand. That is why the providers with the largest audiences require a certificate before showing a logo.
BIMI also does not help with the most common impersonation, which uses lookalike domains or free mailbox accounts with a brand name in the display name. Those messages simply show no logo. Treat BIMI as a positive signal for your authenticated mail, not as protection against phishing that never uses your domain.
Setup steps
- Reach DMARC enforcement on the organizational domain and every subdomain that sends branded mail.
- Decide on VMC or CMC based on your trademark situation and the providers you care about.
- Prepare the logo as SVG Tiny PS and validate it with the BIMI Group's tools.
- Order the certificate and complete the organisation and mark validation.
- Host the SVG and the PEM file over HTTPS at stable URLs on your domain.
- Publish the
default._bimiTXT record, then check it with the DNS Lookup using record type TXT. - Send test messages to accounts at supporting providers; display can take a while because providers cache BIMI data and apply their own checks.
Document who owns each part: the DNS record, the logo files, the certificate renewal and the DMARC monitoring. BIMI touches marketing, IT and legal, and a missing owner is the usual reason logos quietly disappear a year later.
Keep the DMARC aggregate reports flowing after launch. A sending service that breaks alignment does not only risk rejection under p=reject; its messages also lose the logo.
FAQ
Does BIMI improve deliverability?
BIMI itself is a display feature. The DMARC enforcement it requires does help protect your domain's reputation, and a recognisable logo may improve engagement, but providers do not promise better inbox placement for BIMI.
Can I use BIMI with p=none?
No. BIMI requires DMARC at enforcement, p=quarantine or p=reject, applied to all mail.
Do I need a trademark?
For a VMC, yes, a registered trademark for the logo. A CMC is designed for logos without a registered trademark but with evidence of prior public use.
Why is my logo not showing?
Common causes are DMARC not at full enforcement, an SVG that is not valid Tiny PS, a certificate that does not match the logo, a provider requiring a certificate you do not have, or the provider's own reputation thresholds.
Can subdomains have different logos?
Yes. Publish a BIMI record under the subdomain, or use selectors with the BIMI-Selector header for different brands on one domain.
How long does it take for a logo to appear?
After the record, logo and certificate are valid, it can take from days to a few weeks, because providers cache BIMI data and apply their own reputation checks. Keep sending authenticated mail and check again later.
Can I use a different logo for marketing and support mail?
Yes, with BIMI selectors. Publish a record per selector and add a BIMI-Selector header to the messages that should use it. Each certificate-backed logo needs its own certificate.
Does Outlook show BIMI logos?
Support varies by client and changes over time. Check the current documentation of each mailbox provider your recipients use rather than relying on older lists.