BIMI: How to Get Your Logo in Gmail, Apple Mail and Yahoo

What BIMI is

BIMI (Brand Indicators for Message Identification) lets a domain publish a logo in DNS. When a message from that domain passes DMARC, a mailbox provider that supports BIMI can fetch the logo and show it as the sender's avatar in the inbox list and the open message, in place of an initial or a generic icon.

It is a display standard, not a filter. The BIMI Group, which maintains it, says BIMI does not change message delivery. The specification itself is still an IETF Internet-Draft (version 14 as of May 2026), and each provider decides on its own whether to show a logo, so a correct setup makes you eligible, not guaranteed.

What you need before the logo shows

1. DMARC at enforcement. The draft requires p=quarantine or p=reject on both the organizational domain and the From domain, and a quarantine policy may not use a pct below 100. A subdomain policy (sp=), if you publish one, may not be none. Google asks for the same: p=quarantine or p=reject, and pct=100. Getting there safely is its own project; see DMARC policy modes and, for subdomains, DMARC subdomain policies.
2. Aligned SPF or DKIM. The message has to actually pass DMARC, which means SPF or DKIM passing for a domain that aligns with your From address. The SPF, DKIM and DMARC guide covers how the three fit together.
3. An SVG Tiny PS logo. Not a regular SVG export. Google lists the rules: the root element declares version="1.2" and baseProfile="tiny-ps"; no scripts, animation, interactive elements or external references; no x= or y= on the root element; absolute pixel dimensions. It recommends a square logo centred on a solid background, a file of 32 KB or less, and for Gmail at least 96 by 96 pixels.
4. A mark certificate, for most inboxes. The BIMI Group lists it as "highly recommended, but optional" and warns that self-asserted records (no certificate) have limited support. Gmail requires one. The two kinds are below.
5. HTTPS hosting. The logo and certificate are fetched over HTTPS; the draft allows no other transport.

VMC or CMC

A mark certificate is issued by a certificate authority after it checks that your organization is entitled to use the logo. The certificate embeds the SVG, which is why Gmail wants the record to point at the certificate's PEM file rather than the logo alone.

VMC (Verified Mark Certificate). Needs a registered trademark for the logo. Google calls it the recommended option and notes that registering a trademark can take 6 to 12 months. It is the only certificate that gets the Gmail checkmark.

CMC (Common Mark Certificate). Announced by the BIMI Group in September 2024 for logos that are not trademarked. DigiCert issues one for a logo used for at least 12 months on a domain you control, or one similar to your registered trademark. Gmail accepts it and shows the logo, without the checkmark.

Which other providers accept a CMC is the unclear part. The BIMI Group leaves acceptance to each provider and publishes no list. Apple's page names VMCs and does not mention CMCs, and deliverability vendors report that Apple Mail displays only VMC-backed logos, but Apple has not confirmed that. Yahoo requires neither. The issuers the BIMI Group lists are DigiCert, GlobalSign and SSL.com; none of the official sources state a price, only that there is an annual fee.

Which inboxes show BIMI logos

What each provider's own documentation says today:

The BIMI Group's support list (last updated May 2025) also names Fastmail, Zoho Mail, Comcast, La Poste, Onet Poczta, KDDI, NTT docomo, Cloudmark and others as supporting BIMI. It lists Microsoft as not supporting it, so Outlook and Outlook.com show no BIMI logo however complete your setup is.

The BIMI record

One TXT record at a fixed name under your domain:

Name:  default._bimi.example.com
Type:  TXT
Value: v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem

• default._bimi: the selector (default) followed by the fixed _bimi label. Receivers look up default unless a message names another one.
• v=BIMI1: required, and it must come first, or the whole record is ignored.
• l=: the HTTPS URL of the SVG Tiny PS logo.
• a=: the HTTPS URL of the certificate's PEM file (the draft calls it the evidence document). Optional in the spec, required for Gmail.

Google's own example for a certificate leaves the logo empty (v=BIMI1;l=;a=https://…/certificate.pem), since the PEM already carries the logo. The draft, though, defines a record with both l= and a= empty as an explicit refusal to take part, and the BIMI Group calls l= required. Filling in both, as above, satisfies both readings.

Subdomains inherit: if mail.example.com has no BIMI record, receivers fall back to default._bimi.example.com. A subdomain can publish its own record to override it.

Using a selector for a second logo

To show a different logo on one stream, say a newsletter with its own brand, publish a record under another selector and name it in a BIMI-Selector header on those messages:

; DNS: a second logo under its own selector
newsletter._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/news.svg; a=https://example.com/bimi/news.pem"

; Message header, covered by your DKIM signature
BIMI-Selector: v=BIMI1; s=newsletter;

The draft says receivers should ignore the header unless your DMARC-aligned DKIM signature covers it, so ask your sending platform whether it signs custom headers. The BIMI Group notes that support for selectors varies between platforms. Most senders never need anything but default.

Setting it up, in order

1. Get DMARC to enforcement. This is usually the longest step, and the one to start first. Run your domain through the deliverability checker to see where SPF, DKIM and DMARC stand today.
2. Decide on the certificate. If the logo is a registered trademark, a VMC. If not, a CMC for Gmail, or no certificate if Yahoo is the inbox you care about.
3. Produce the SVG Tiny PS file. Convert from your master logo, square it, and check the root attributes. Design tools do not export this profile by default.
4. Order the certificate. The issuer validates your organization and the logo, then returns a PEM file containing the certificate and the embedded SVG. Google says to append the chain in order: entity certificate, intermediates, root.
5. Host both files over HTTPS at stable URLs that automated fetchers can reach without a login, captcha or bot challenge.
6. Publish the TXT record at default._bimi.yourdomain.com.
7. Check it, then send. Google says the logo can take up to 48 hours to appear.

Check your BIMI setup

The free BIMI checker looks up your BIMI record (falling back to the organizational domain, as receivers do) and your DMARC policy. It fetches the logo and tells you if the URL is not HTTPS, returns an error such as a 403 from a CDN firewall, is served with the wrong content type, is not square, is not SVG Tiny PS, or contains scripts or external references. It also flags a DMARC policy that would stop the logo from showing, and whether the record declares a certificate.

It does not validate the certificate itself. Check the PEM with your issuer, and confirm in a real Gmail inbox that the logo appears on a fresh message.

Why the logo still doesn't show

• DMARC is not at enforcement, or is at p=quarantine with a pct below 100, or a subdomain falls under sp=none.
• The message did not pass DMARC. A sending platform that signs with its own domain instead of yours passes DKIM but not alignment.
• No certificate, for Gmail. Gmail does not show self-asserted logos. Neither, by most reports, does Apple Mail.
• The SVG is not Tiny PS, or is not square, or carries scripts or external links.
• The logo or PEM is unreachable: a 404, a redirect to a login, or a CDN that blocks automated requests.
• The certificate lapsed. Mark certificates carry an annual fee; one that was not renewed no longer backs the logo.
• Reputation. Yahoo requires sufficient reputation and engagement and shows logos on bulk mail only. Every provider keeps the final say.
• It is Outlook. Microsoft does not support BIMI.
• Caching. The BIMI Group notes that caching can delay display; recheck with a newly sent message.