BIMI
BIMI lets a verified brand logo appear next to authenticated mail, in the inboxes that support it. It's the only record on this site that changes how a message actually looks to the person reading it, rather than how it's handled behind the scenes.
| Name | Type | Value |
|---|---|---|
| default._bimi | TXT | "v=BIMI1; l=https://example.com/logo.svg" |
DMARC has to be enforced first
BIMI is deliberately unavailable to a domain that hasn't earned it. Mailbox providers require DMARC to already be at p=quarantine or p=reject, not p=none, before a logo will ever show. The logic is straightforward: a logo is a trust signal, and handing one to a domain that hasn't shown it can stop mail being spoofed in its name would defeat the point.
Not just any image file
The logo has to be an SVG, and not an ordinary one: BIMI requires the restricted "SVG Tiny Portable/Secure" profile, which strips out scripting and most of what makes a general-purpose SVG capable of anything unexpected. An everyday logo exported from a design tool almost never validates as-is and needs converting specifically for this.
The optional certificate that isn't really optional
The specification itself makes a Verified Mark Certificate (a a= value alongside the logo) optional. In practice, the largest inbox providers, Gmail among them, only display the logo at all when one is present, obtained from a small number of authorities and proving the logo is a registered trademark. Whether that's worth pursuing depends entirely on whether those providers are where the logo actually needs to show up.
The trademark itself isn't a formality
A Verified Mark Certificate doesn't just confirm a logo belongs to a domain, it confirms the logo is a registered trademark, and registering one is a genuine legal process with a real outcome that isn't guaranteed. Trademark offices refuse marks they consider too generic to tell one brand from another on their own, and a plain geometric shape in a single flat colour, a circle or a square with no further design added, is a textbook example of exactly that: distinctive enough to notice, not distinctive enough to register, unless years of prominent, exclusive use have earned it what trademark law calls acquired distinctiveness. It's entirely possible to build the DNS side of BIMI correctly and still have the certificate application itself stall for a reason that has nothing to do with DNS at all.
What it costs, and a cheaper alternative
A VMC is a genuine annual cost, not a one-off fee. Prices vary a good deal by issuer and reseller, from a few hundred dollars a year at the cheaper end up to around $1,500 a year at the more established issuers (DigiCert and Entrust among them), on top of whatever registering the trademark itself already cost. For a logo that's genuinely been in prominent use but was never registered, or couldn't be, a Common Mark Certificate is worth knowing about instead: cheaper, and validated against documented prior use rather than a registered mark. It doesn't unlock everything a VMC does, Gmail's blue verified checkmark specifically still asks for a VMC, but it's enough to get the logo itself showing in several other major inboxes.
Also worth knowing before assuming either certificate is unavoidable: not every mailbox provider requires one to show a BIMI logo at all, Yahoo Mail is a case in point. What's actually required varies enough between providers that it's worth checking current requirements rather than assuming the strictest provider's rules apply everywhere.
None of this is limited to companies with a registered brand to defend, either. A personal domain, no business or trademark behind it at all, can carry a BIMI record and a logo just the same, and show up the same way in whichever inboxes don't insist on a certificate. Worth trying before assuming BIMI is only for organisations with something to protect.
Building one
Expert Tools' BIMI wizard works the same way for a personal domain as it does for a business one, and verifies the record and the logo it points to, including the SVG profile restriction, which is a much faster way to find out a logo is invalid than waiting to see if it shows up in an inbox.