Brand Indicators for Message Identification (BIMI) empowers domain owners to display their official trademarked logo directly beside authenticated emails inside consumer and enterprise mailboxes.
Requirements
Deploying BIMI requires meeting rigorous cryptographic and legal prerequisites across your domain infrastructure:
- 100% DMARC Enforcement: Your sending domain and parent organizational domain must publish a DMARC policy with
p=quarantine; pct=100orp=reject, as detailed in our guide on SPF, DKIM, and DMARC Explained. Use our DMARC Record Generator to craft valid tags. - Strict Identifier Alignment: Both SPF and DKIM signatures must align with the RFC 5322
From:domain without relying on relaxed third-party relay signatures. - Compliant SVG Vector Asset: A square, standalone vector file formatted to the SVG Tiny P/S profile.
- Verified Mark Certificate (VMC): A cryptographic digital certificate issued by DigiCert or Entrust validating registered trademark ownership.
Setup Steps
Achieving verified inbox branding follows a strict four-stage deployment pipeline:
- Enforce Domain Authentication: Monitor DMARC aggregate XML reports (RUA) until zero legitimate mail streams fail alignment, then advance your policy to
p=reject. - Author the SVG Tiny P/S Artwork: Cleanse your vector artwork by stripping scripts, external URLs, raster bitmaps, and non-standard XML namespaces. Validate the coordinate box (
viewBox="0 0 512 512") and square aspect ratio. - Secure a Verified Mark Certificate (VMC): Submit proof of word or design mark registration with an authorized intellectual property agency (such as the USPTO, EUIPO, or UKIPO) to an approved CA for identity and notarized validation.
- Publish the BIMI DNS TXT Record: Provision a TXT record at the designated subdomain selector indicating the location of your SVG file and PEM-formatted certificate chain.
Benefits
Beyond aesthetic appeal, BIMI creates measurable deliverability and operational dividends:
- Visual Trust Verification: In supported web and mobile clients (including Apple Mail on iOS 16+ and Google Workspace), recipient inboxes display verified brand marks that cannot be faked by spoofed lookalike domains.
- Elevated Engagement Signals: Branded inbox avatars produce documented uplifts in open rates and click-through metrics, signaling positive recipient engagement back to ESP reputation algorithms to avoid the spam folder.
- Phishing Immunization: Because BIMI requires strict DMARC enforcement, deploying the protocol forces organizations to close lingering spoofing vulnerabilities across shadow IT and secondary dispatch servers.
BIMI DNS Record Structure & Verification
BIMI relies on a TXT record hosted at default._bimi.yourdomain.com (or custom selector prefixes when segmenting multi-brand operations). The record syntax declares the BIMI specification version, your publicly resolvable HTTPS logo URI, and the URI of your certificate authority bundle:
default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/branding/logo.svg; a=https://yourdomain.com/branding/cert.pem;"The asset referenced in the l= tag must strictly adhere to the SVG Tiny P/S (Portable/Secure) specification. It must be served over HTTPS with valid TLS certificates, omit embedded CSS <style> scripts, maintain an explicit XML namespace (xmlns="http://www.w3.org/2000/svg"), and utilize a file size under 32KB to ensure rapid caching across receiving MTAs.
Inbox Ecosystem & VMC Certification
Adoption across mailbox providers bifurcates based on certificate validation rules. While Yahoo Mail can render BIMI logos for high-reputation domains using self-hosted SVGs without a VMC, Google Workspace, Apple Mail, and Fastmail strictly enforce VMC verification:
When receiving MTAs inspect inbound messages, they parse the BIMI assertion header, query the _bimi DNS record, fetch the certificate authority bundle from the a= URI, and verify the cryptographic signature binding your logo hash to your domain name. If the certificate revocation check (OCSP) fails or DMARC evaluation reports unaligned SPF/DKIM, the mailbox falls back to displaying a generic monogram. Auditing recipient lists prior to dispatch with the MailVeri Email Checker ensures that your authenticated branding reaches responsive, deliverable mailboxes.