BIMI Records: Setup, Requirements, and Value
A BIMI record is a DNS TXT entry that tells inbox providers where to find your brand logo and, in most cases, the certificate proving you own it. When it validates, supporting mailbox providers show your logo beside your messages in the inbox. BIMI requires DMARC at enforcement first, so it is a reward rather than a shortcut.
What BIMI actually does
BIMI stands for Brand Indicators for Message Identification. It is a specification that lets a mailbox provider pull an approved logo from your domain and render it in the avatar slot next to your sender name. Instead of a gray circle with the first letter of your brand, subscribers see the mark they already recognize from your website, your app, and your packaging.
The mechanism is deliberately boring. You publish a TXT record at a fixed subdomain, point it at a hosted SVG logo file, and optionally point it at a certificate that vouches for your right to use that logo. The mailbox provider checks your authentication first. If the message passes DMARC at an enforcing policy, and the logo and certificate check out, the logo renders. If any step fails, the provider quietly falls back to the default avatar. Nothing breaks — you just do not get the badge.
That fallback behavior is why BIMI is low-risk to attempt. The real cost is not technical risk, it is the certificate and the discipline required to get your authentication in order first.
Requirements before BIMI will validate
Most BIMI failures are not BIMI failures at all. They are DMARC problems that surface once you finally ask a provider to look closely at your domain. Work through this list in order.
| Requirement | What "done" looks like | Common blocker |
|---|---|---|
| SPF | Passing and aligned with the visible From domain | Too many DNS lookups, or sending from a subdomain not covered |
| DKIM | Signed with a key on your own domain, 1024-bit minimum | Third-party tools signing with their domain instead of yours |
| DMARC policy | p=quarantine or p=reject at the organizational domain | Still sitting on p=none after months of monitoring |
| DMARC percentage | pct=100 — partial enforcement does not qualify | Left at pct=25 during a cautious rollout |
| Logo file | SVG Tiny Portable/Secure, square, hosted over HTTPS | Standard SVG export from a design tool |
| Certificate | VMC or CMC issued by an approved authority | Trademark not yet registered in a recognized jurisdiction |
| Sending reputation | Consistent volume, low complaints, clean list | Sporadic sending from a cold domain |
If you are not sure where your domain stands today, generate and audit your records before spending money on a certificate. Our SPF, DKIM, and DMARC record generator will produce syntactically correct records you can compare against what is actually published.
VMC versus CMC: which certificate you need
Two certificate types exist, and the difference comes down to how you established rights to the logo.
Verified Mark Certificate (VMC) is for logos backed by a registered trademark in an accepted trademark office. This is the original path and the one most mailbox providers have supported longest. You need an active registration, not a pending application, and the registered mark has to match the artwork you want displayed.
Common Mark Certificate (CMC) was introduced for brands whose logo is in genuine prior use but is not registered as a trademark. Verification leans on evidence of use over time rather than a registration number. Support is narrower than for VMCs, so check current provider behavior before choosing this route if broad rendering is the goal.
Both are issued by a small number of certificate authorities, both involve identity verification of your organization, and both are annual expenses in the low four figures. That price tag is the single biggest reason small senders skip BIMI, and skipping it is a defensible decision.
Preparing the logo file
The logo must be SVG Tiny Portable/Secure — a restricted SVG profile that strips scripting, external references, and animation. Exporting an SVG from a standard design tool will almost never satisfy the profile on the first try.
- Square aspect ratio, centered artwork, with the mark filling most of the canvas
- A solid background color rather than transparency, since avatar slots crop to a circle
- No embedded raster images, no external font references, no
<script>or<a>elements - A
titleelement containing your brand name - Version attribute set to the Tiny PS profile, and a modest file size — kilobytes, not megabytes
Design for a small circle. Wordmarks that read fine on a billboard turn into illegible smudges at 40 pixels. If your brand has a standalone symbol, use it.
Publishing the DNS record
- Host the SVG at a stable HTTPS URL on a domain you control. Do not use a URL that redirects.
- Obtain your certificate and host the PEM file at a second stable HTTPS URL.
- Create a TXT record at
default._bimi.yourdomain.com. - Set the value to
v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/cert.pem; - Publish, wait for propagation, then send a test message to seed accounts at several major providers.
The selector is default unless you are running multiple logos across subdomains, in which case you can reference an alternate selector from your DKIM setup. Keep it simple until you have a reason not to.
Where the logo actually shows up
Rendering is inconsistent, and that inconsistency is central to the value question. Some major webmail clients display BIMI logos in the message list. Others display them only when a message is opened. Several popular desktop and mobile clients ignore BIMI entirely and use their own avatar sources — a contact photo, a favicon scrape, or a colored initial.
Assume a meaningful share of your audience will never see the logo, and that the share varies by list. A B2C list skewing toward consumer webmail will see it far more often than a B2B list on self-hosted corporate mail.
Is BIMI worth it?
Honest answer: it depends on who is already impersonating you.
BIMI is a strong investment if you are a recognizable brand in a phishing-prone category — finance, retail, healthcare, logistics — where a visible trust signal helps recipients distinguish you from a spoof. It also makes sense if you send high volume to consumer inboxes and can amortize the certificate cost across millions of impressions.
It is a weak investment if you are a small sender whose subscribers already know you by name, or if your list lives mostly in clients that do not render BIMI at all. In that case, spend the same money on list hygiene, better segmentation, and content that earns engagement. Those move deliverability directly; BIMI does not. Getting to DMARC enforcement is the part that improves your inbox placement, and you can do that for free.
If deliverability is what you are actually chasing, start with the fundamentals in our guide to email deliverability and treat BIMI as the optional final polish.
Troubleshooting a BIMI record that will not render
Logo does not appear anywhere. Check DMARC first. Run a test message through an authentication checker and confirm the policy is enforcing at full percentage on the exact domain in the From header, including subdomains.
Record parses but the certificate is rejected. Confirm the PEM file is served with the correct content type, is reachable without authentication, and has not expired. Certificates are annual and renewal is easy to forget.
Renders at one provider only. This is usually normal variation, not a fault. Confirm with a seed test across several providers before you start changing DNS.
Logo renders but looks wrong. Circular cropping is the usual cause. Re-export with more padding and a solid background.
Note that this article covers technical requirements, not trademark law. Trademark registration and the evidence standards behind mark certificates vary by jurisdiction — this is not legal advice, and you should consult a qualified trademark attorney before filing.
Frequently asked questions
Do I need a VMC to use BIMI?
For most major mailbox providers, yes — a VMC or CMC is required for the logo to render. A handful of providers have historically displayed logos without a certificate, but you should plan on needing one.
Does BIMI improve deliverability?
Not directly. BIMI does not change how filters score your mail. The DMARC enforcement required to qualify for BIMI does help, so senders often see improvement from the prerequisite work rather than from BIMI itself.
How much does a BIMI certificate cost?
Expect an annual fee in the low four figures from an approved certificate authority, plus the cost of registering a trademark if you do not already hold one. Prices vary by issuer and term length.
Can I use BIMI on a subdomain?
Yes. Publish the record at default._bimi.sub.yourdomain.com and make sure that subdomain is covered by an enforcing DMARC policy, either directly or through the organizational domain's subdomain policy.
How long does BIMI take to start working?
DNS propagation is usually under an hour, but certificate issuance can take days to weeks depending on how quickly you can supply verification documents. Budget several weeks end to end.
Ready to get your authentication right and your email into the inbox? IGSendMail configures SPF, DKIM, and DMARC automatically, includes free 24-hour migration, and starts at $19/mo with unlimited contacts. Launch your first campaign with IGSendMail.