Email security · checked 19 October 2026
BIMI setup: show your logo in the inbox
BIMI (Brand Indicators for Message Identification) puts your logo next to your emails in supporting inboxes. It's a reward for locking down your domain: it only works once DMARC is enforced, which also stops criminals sending as you.
Before you start: DMARC must be enforced
BIMI needs a DMARC policy of p=quarantine or p=reject for the whole domain. p=none doesn't qualify, and neither does partial enforcement. If you still have a pct tag, set it to 100. Get there in steps: how to set up DMARC, then make sure DKIM and SPF pass for every service that sends as you.
Step 1: make the logo file
- Export it as SVG Tiny Portable/Secure (SVG Tiny PS): the root element needs
version="1.2"andbaseProfile="tiny-ps". - No scripts, animation, external links or embedded bitmap images.
- Use a square logo with a solid background, and keep the file small (32 KB or less is a safe target).
- Host it on HTTPS, for example
https://yourcompany.com/bimi/logo.svg.
Step 2: decide on a certificate
| Option | Needs | Gmail |
|---|---|---|
| VMC (Verified Mark Certificate) | A registered trademark for the logo | Logo plus the blue verified checkmark |
| CMC (Common Mark Certificate) | Proof you've used the logo for a while; no trademark | Logo, no checkmark |
| No certificate | Nothing | No logo in Gmail; some other inboxes may show it |
Certificates come from a small number of certificate authorities and need identity and logo checks, with an annual fee. Ask for current prices before you commit.
Step 3: publish the DNS record
Add a TXT record at default._bimi.yourcompany.com:
v=BIMI1; l=https://yourcompany.com/bimi/logo.svg; a=https://yourcompany.com/bimi/certificate.pemLeave out the a= part if you have no certificate. Use the domain your emails are sent "from".
Step 4: check it
- Run our free check to confirm DMARC is at quarantine or reject.
- Send yourself an email at Gmail. Logos can take a while to appear and are only shown when the mailbox provider is satisfied with your sending reputation.
Is it worth it for a small business?
The logo is a nice touch. The real value is the work you do to qualify: an enforced DMARC policy is what stops spoofed invoices "from" your domain. If the certificate cost isn't worth it, enforce DMARC anyway. More on how invoice fraud uses your domain.
Sources: Suped, BIMI requirements and implementation steps (DMARC policy, SVG Tiny PS, VMC and CMC, Gmail, record location); Red Sift, what is BIMI. Read 19 October 2026.