BIMI (Brand Indicators for Message Identification)

BIMI allows organizations to display their brand logo next to authenticated emails in supporting email clients.

How BIMI Works

The Benefit

When properly configured, your logo appears in email clients:

• Next to your emails in the inbox
• In the message view
• Increases brand recognition
• Signals email authenticity to recipients

Requirements

BIMI requires:

1. DMARC at p=quarantine or p=reject, applied to all mail (no pct below 100)
2. BIMI DNS record with logo URL
3. Logo in the SVG Tiny PS format
4. For some mailbox providers, a VMC (Verified Mark Certificate)

DMARC at enforce
      │
      ▼
  BIMI Record
      │
      ▼
  Logo URL ───> Logo File (SVG)
      │
      ▼
  VMC (optional) ───> Certificate Authority

BIMI Record Format

BIMI records are TXT records at:

default._bimi.example.com

Example:

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

Record Tags

Tag	Required	Description
v	Yes	Version (BIMI1)
l	Yes	Logo URL
a	No	VMC certificate URL

Tag Details

Version (v):

• Always BIMI1

Logo (l):

• HTTPS URL to your logo
• Must be publicly accessible
• SVG Tiny PS format preferred

Authority (a):

• URL to the VMC certificate (PEM format)
• Required by some providers, such as Gmail and Apple Mail
• Optional for others

Logo Requirements

Format: SVG Tiny PS

Most providers require SVG Tiny Portable/Secure:

• Vector format (not raster)
• No scripts or animations
• No external references
• Square aspect ratio
• Specific SVG profile

SVG Tiny PS Requirements

<?xml version="1.0" encoding="UTF-8"?>
<svg version="1.2" baseProfile="tiny-ps"
     xmlns="http://www.w3.org/2000/svg"
     width="512" height="512"
     viewBox="0 0 512 512">
  <title>Example Inc.</title>
  <!-- Logo content -->
</svg>

Must include:

• version="1.2"
• baseProfile="tiny-ps"
• A <title> element with your brand name

Must NOT include:

• x or y attributes on the <svg> element (Adobe Illustrator adds x="0px" y="0px")
• JavaScript
• External references
• Animations
• Embedded raster images

Recommended:

• Square dimensions. Mail apps show the logo as a square or a circle, so a wide logo shows up small.
• A solid background color

File Requirements

Requirement	Value
Format	SVG Tiny PS
Size	Max 32KB
Dimensions	Square recommended (e.g., 512x512)
Hosting	HTTPS required
Accessibility	Public, no authentication

Verified Mark Certificate (VMC)

What is a VMC?

A VMC is a certificate that verifies:

• You own the trademark for the logo
• The logo is registered
• Issued by a trusted Certificate Authority

When is VMC Required?

Requirements differ per mailbox provider and change over time, so check each provider's current documentation. At the time of writing:

Provider	Certificate required
Gmail	Yes: a VMC, or a Common Mark Certificate (CMC) for logos without a registered trademark
Apple Mail	Yes: a VMC
Yahoo Mail	No
Fastmail	No

Obtaining a VMC

1. Register your trademark, if it isn't registered yet
2. Choose an issuer: VMCs come from a small number of certificate authorities, such as DigiCert, GlobalSign and Sectigo. The BIMI Group lists the current issuers.
3. Apply with proof of your trademark
4. Receive the VMC as a PEM file
5. Host the VMC at an HTTPS URL and reference it in the a= tag

VMC Cost

VMCs are a paid, yearly product; prices vary by issuer. Issuers check:

• Your registered trademark
• Control of the domain
• Your organization's identity

Implementation Steps

Step 1: Ensure DMARC Compliance

BIMI requires DMARC at enforcement level:

v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

or

v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Step 2: Create Your Logo

1. Design or obtain your logo
2. Convert to SVG Tiny PS format
3. Ensure it meets all requirements
4. Test with BIMI validators

Step 3: Host Logo (and VMC)

1. Upload to your web server
2. Ensure HTTPS accessibility
3. Set correct Content-Type headers
4. Test public accessibility

Step 4: Add DNS Record

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg"

With VMC:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Step 5: Verify

1. Wait for DNS propagation
2. Send test emails to supporting clients
3. Verify logo displays correctly

Provider Support

Gmail, Apple Mail, Yahoo Mail and Fastmail show BIMI logos; see the table above for which need a certificate. Microsoft Outlook doesn't show BIMI logos. Support elsewhere varies.

Troubleshooting

Logo Not Displaying

1. Check DMARC: Must be p=quarantine or p=reject, with no pct below 100
2. Verify DNS record: Correct format and syntax
3. Test logo URL: Must be publicly accessible
4. Validate SVG: Must be SVG Tiny PS format
5. Check the certificate: required for Gmail and Apple Mail

SVG Validation Errors

Common issues:

• Wrong SVG profile (must be tiny-ps)
• Missing <title> element
• Contains scripts or animations
• External references
• x or y attributes on the <svg> element
• File too large

A logo that isn't square still passes the check, with a warning.

DNS Issues

• Record at wrong subdomain
• Missing v=BIMI1 version tag
• Invalid URL in l tag

BIMI Without VMC

For providers that don't require VMC:

v=BIMI1; l=https://example.com/logo.svg

This works with providers that don't require a certificate, such as Yahoo Mail and Fastmail.

Gmail and Apple Mail don't show the logo without a certificate. There's no error; the logo just doesn't appear.

Best Practices

Do

✅ Reach DMARC enforcement first
✅ Use SVG Tiny PS format
✅ Test with multiple providers
✅ Keep logo simple and recognizable
✅ Use HTTPS for all URLs \

Don't

❌ Deploy BIMI before DMARC enforcement
❌ Use complex SVG features
❌ Use raster images (PNG/JPG)
❌ Forget to renew VMC annually
❌ Use non-square logos

Example Configurations

Basic (No VMC)

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/logo.svg"

With VMC

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

Using a CDN

default._bimi.example.com  TXT  "v=BIMI1; l=https://cdn.example.com/bimi/logo.svg"

Tools and Resources

BIMI Validators

• BIMI Group Inspector
• MXToolbox BIMI Lookup
• MailShield BIMI check

SVG Converters

Several tools can convert logos to SVG Tiny PS:

• Adobe Illustrator (with export settings)
• BIMI-specific converters
• Professional design services

VMC Issuers

The BIMI Group keeps the list of certificate authorities that issue VMCs.

MailShield BIMI Features

MailShield checks BIMI for domains that send mail, under Checks → BIMI:

1. DNS validation: checks the record syntax
2. DMARC prerequisite: reports BIMI as invalid until DMARC is at p=quarantine or p=reject and applies to all mail (no pct below 100), since mailbox providers don't show the logo otherwise
3. Logo verification: fetches the logo and checks that it's served as SVG (image/svg+xml) and is valid SVG Tiny PS. Recommendations, such as a square logo, show as warnings
4. Monitoring: DNS change alerts when the record or logo location changes
5. VMC expiry: the Certificate expiry alert warns you 14 days before your VMC expires

Hosted BIMI Logo

Requires: Pro plan, a verified domain, and the owner or admin role.

MailShield can host your logo, so you don't need a web server for it:

1. Open the domain and go to Checks → BIMI.
2. In Host Your BIMI Logo, upload your SVG logo (32 KB at most). If it isn't SVG Tiny PS yet, MailShield converts it where it can and tells you what changed: it turns CSS styles into SVG attributes (so the colors survive), removes what the profile doesn't allow, uses your domain as the <title> if the logo has none, and centers a logo that isn't square on a square canvas.
3. Publish the DNS record MailShield shows at default._bimi.yourdomain.com. The l= tag points to your hosted logo on app.mailshield.app.