BIMI (Brand Indicators for Message Identification) is an email standard that lets businesses display their official logo next to messages in supported inboxes.
You may have noticed company logos beside emails in Gmail, Yahoo Mail, or other email services. These logos can make a message easier to recognize, but they do not appear automatically. The sender must first secure its domain with email authentication methods such as SPF, DKIM, and DMARC.
In this guide, you will learn what BIMI is, how it works, why it matters, and what you need to set it up.
Table of Contents
What is BIMI?
BIMI stands for Brand Indicators for Message Identification. It gives domain owners a standard way to tell participating email providers where to find their official logo.
This information is published as a DNS TXT record that points to a logo hosted at a secure HTTPS address. It may also point to a certificate connecting the organization, domain, and logo.
After authenticating a message, the receiving provider can look for the BIMI TXT record. If the setup meets its rules, the logo may appear beside the email.
A BIMI setup usually includes:
- A secure and properly configured sending domain
- An enforced DMARC policy
- A compatible SVG logo
- A BIMI TXT record in DNS
- A digital mark certificate, when the email provider requires one
A basic BIMI TXT record can look like this:
default._bimi.example.com. TXT “v=BIMI1; l=https://example.com/bimi-logo.svg;”
Here, default._bimi is the standard hostname, v=BIMI1 identifies the BIMI version, and l= provides the location of the brand logo. Some records also include an a= tag. This tag points to a digital certificate that verifies the logo.
How does BIMI (Brand Indicators for Message Identification) work?
BIMI does not authenticate email by itself. Instead, it works on top of three existing email authentication methods: SPF, DKIM, and DMARC.
When an email arrives, the receiving server checks whether it passes DMARC. DMARC uses SPF and DKIM results, together with domain alignment, to determine whether the sender is authorized to use the domain in the visible “From” address.
If the message passes, the receiving provider can search DNS for the BIMI TXT record. It then retrieves and validates the logo or certificate from the HTTPS address in the record. If the configuration meets the provider’s rules, the logo may appear beside the message.
The process has five basic steps:
- Your organization sends an email.
- The recipient’s service validates SPF, DKIM, and DMARC.
- The service searches DNS for your BIMI TXT record.
- It retrieves and validates your logo and certificate.
- It decides whether to display the logo.
The email provider always makes the final decision. A valid setup does not guarantee that the logo will appear in every inbox because each provider can apply its own security, reputation, and display rules.
Experience Industry-Leading DNS Speed with ClouDNS!
Ready for ultra-fast DNS service? Click to register and see the difference!
Why is BIMI important?
Every day, people receive many emails, making it challenging for most users to verify the true identity of each sender. A sender name can be copied, and a familiar-looking message can still lead to a phishing website. BIMI cannot eliminate phishing, but it encourages organizations to strengthen domain authentication before receiving the branding benefit.
For businesses, a visible logo can make legitimate messages easier to recognize. This is useful for organizations sending invoices, account alerts, order updates, or marketing emails.
Its value goes beyond appearance. BIMI (Brand Indicators for Message Identification) also encourages businesses to improve their email security by configuring SPF, DKIM, and DMARC correctly and reducing domain impersonation.
However, BIMI is not proof that every message is safe. Attackers can still create convincing messages, copy brand names, or use similar-looking domains. Recipients should still be cautious with suspicious links, attachments, and payment requests.
It is also not a direct solution to improve email deliverability. It does not guarantee that messages will reach the inbox. Email providers still consider sender reputation, mailing practices, and message quality.
What are the requirements to implement BIMI?
A successful BIMI setup requires several components. Make sure to complete them in order.
1. Configure SPF and DKIM
SPF (Sender Policy Framework) identifies the servers authorized to send email for your domain. Its configuration is published as a TXT record in DNS.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages. The receiving email server uses a public key published in DNS to verify that the message was authorized and was not altered after it was sent.
At least one method must pass with domain alignment for DMARC to pass, although configuring both is strongly recommended. SPF and DKIM protect email in different ways and provide a stronger foundation when used together.
2. Implement DMARC
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail servers what to do when messages using your domain fail authentication.
BIMI requires a DMARC policy that actively handles authentication failures. The policy must normally be set to p=quarantine or p=reject. It should also apply to 100 percent of messages by using pct=100.
An example DMARC record is:
_dmarc.example.com. TXT “v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com”
The p=quarantine value asks receiving providers to treat failed messages as suspicious, often by sending them to the spam folder. The stricter p=reject policy asks providers to reject failed messages completely.
Before enabling it, review your DMARC reports and identify every legitimate service sending email for your domain. These services may include newsletter platforms, help desk software, payment systems, and customer relationship management tools.
Moving to enforcement too quickly could cause legitimate messages to fail authentication. DMARC should therefore be introduced gradually and monitored carefully.
3. Prepare a BIMI-compatible SVG logo
You cannot use an ordinary JPG, PNG, or standard SVG file for BIMI. The logo must use a secure SVG format called SVG Tiny Portable/Secure, also known as SVG Tiny PS.
The file must not contain:
- Scripts
- Animations
- Interactive elements
- External links or references
A square logo with a solid background is generally the safest choice. Different email applications may display it as a circle, square, or rounded shape, so important parts of the design should remain near the center.
The SVG file should also be small and simple. Keep it below 32 kilobytes and include a descriptive title for accessibility.
Host the logo at a publicly accessible HTTPS address. Confirm that the file can be downloaded without a login, access restriction, or complicated redirect.
4. Obtain a VMC or CMC when required
Some mailbox providers require a digital certificate that verifies the relationship between an organization and its logo.
A Verified Mark Certificate, or VMC, is generally used for eligible trademarked logos. It confirms that the organization owns the trademark connected to the displayed image.
A Common Mark Certificate, or CMC, can support certain logos that do not meet the trademark requirements for a VMC.
Approved certificate authorities issue these certificates after validating the organization’s identity and logo. Review the requirements early because the process can involve legal checks, additional costs, and waiting time.
5. Publish the BIMI TXT record
Once your authentication, logo, and certificate are ready, create a TXT record in your DNS zone.
The standard hostname is:
default._bimi.example.com
A record with both a logo and certificate may look like this:
default._bimi.example.com. TXT “v=BIMI1; l=https://example.com/bimi-logo.svg; a=https://example.com/certificate.pem;”
After publishing it, allow time for DNS caches to update. Then use a BIMI validation tool to check the record, DMARC policy, logo, and certificate.
You should also send test messages to supported mailbox providers and confirm that DMARC continues to pass for every legitimate email source.
Benefits of BIMI (Brand Indicators for Message Identification)
A successful setup can offer the following benefits:
- Better brand recognition: A visible logo can make your messages easier to recognize in a busy inbox.
- Stronger email security: BIMI encourages organizations to complete SPF, DKIM, and DMARC deployment.
- More consistent branding: The domain owner publishes the official logo instead of relying only on profile images or third-party databases.
- Greater customer confidence: A recognizable logo can give recipients an extra visual signal when they receive a legitimate email.
Still, the logo should support good security rather than replace it. Businesses must continue to protect their domains, monitor authentication reports, and follow responsible email practices.
Conclusion
BIMI (Brand Indicators for Message Identification) connects email branding with domain security. It allows supported email providers to display your official logo after your messages pass the required authentication checks.
The setup involves more than adding one DNS record. You need SPF, DKIM, an enforced DMARC policy, a compatible SVG logo, and sometimes a digital certificate.
Secure your email first. Then publish your BIMI TXT record and test the complete setup. The logo may catch the reader’s eye, but the authentication behind it does the important work.
