BIMIBrand Indicators for Message Identification
BIMI puts your company's logo next to your email in the recipient's inbox — in Gmail, Yahoo Mail, and Apple Mail — the same way a verified checkmark works on social media. It's the one piece of email authentication a customer actually sees.
The catch: BIMI isn't something you can just turn on. It only activates once your domain has DMARC enforcement in place, which means every other piece of authentication — SPF, DKIM, alignment — has to already be working. BIMI is the visible payoff for security work most people never notice.
The BIMI DNS record and prerequisites
BIMI is a TXT record at default._bimi.yourdomain.com, generally formatted v=BIMI1; l=<logo URL>; a=<certificate URL>. But receivers ignore it entirely unless your DMARC policy is at p=quarantine or p=reject, covers effectively all your mail (no weak pct= carve-out), and doesn't have a weaker subdomain policy undermining it. The logo itself must be an SVG in the SVG Tiny Portable/Secure profile, served over HTTPS.
VMC vs CMC: the two paths to a verified logo
A Verified Mark Certificate (VMC) requires a registered trademark and is what lights up Gmail's blue checkmark next to the sender name — the strongest signal, but gated behind trademark registration and cost. A Common Mark Certificate (CMC), introduced in 2024, covers logos in continuous use for 12+ months with no trademark registration required — it enables logo display without Gmail's checkmark. Current issuers include DigiCert, GlobalSign, and SSL.com. Which one makes sense depends on whether the trademark exists yet, not on preference.
Where BIMI actually shows the logo
Gmail, Yahoo Mail, and Apple Mail (iOS 16+/macOS Ventura+) support BIMI today with varying certificate requirements — Gmail currently requires a VMC for the verified checkmark, while some providers display the logo with a CMC alone. Coverage and requirements shift as providers update their policies, so a BIMI setup that worked at launch is worth re-checking periodically, not treated as permanent.
How Trustliant handles this
Trustliant validates BIMI record syntax, HTTPS logo URL reachability, and certificate presence today, and traces the DMARC enforcement prerequisites automatically — the moment a client domain reaches p=quarantine or p=reject with full coverage, it becomes a flagged "you qualify for BIMI now" opportunity rather than something a technician has to remember to check manually. Full SVG Tiny PS profile validation and Apple Business Connect–specific guidance are on the roadmap.
Questions we get about BIMI
- Why isn't my logo showing up even though I published a BIMI record?
- The most common cause is DMARC not yet at enforcement (p=quarantine or p=reject) with full mail coverage — receivers won't honor a BIMI record until that prerequisite is met, regardless of whether the BIMI record itself is correctly formatted.
- Do I need a trademark to use BIMI?
- Not necessarily. A Verified Mark Certificate (VMC) does require a registered trademark, but a Common Mark Certificate (CMC), available since 2024, covers logos with 12+ months of continuous use and no trademark requirement — it just doesn't unlock Gmail's blue checkmark.
- What format does the logo need to be in?
- BIMI requires an SVG image in the SVG Tiny Portable/Secure (PS) profile — a restricted subset of SVG, not a standard export from most design tools — served over HTTPS at the URL declared in the BIMI record.