How to Implement BIMI in 2026: VMC Requirements, DMARC Enforcement, and Logo Setup

> TL;DR: Brand Indicators for Message Identification (BIMI) is an email security standard that displays your official brand logo next to authenticated emails in subscriber inboxes. Implementing BIMI requires strict DMARC enforcement (p=quarantine or p=reject), a properly formatted SVG Tiny P/PS logo, and optionally a Verified Mark Certificate (VMC). Following this step-by-step guide helps elevate inbox trust, improve brand recognition, and reinforce sender authentication.

In an increasingly noisy inbox, establishing visual brand recognition before a subscriber even opens your message provides a massive competitive advantage. Brand Indicators for Message Identification (BIMI) bridges the gap between email security and brand marketing by rendering your verified logo directly inside webmail interfaces like Gmail, Apple Mail, Yahoo Mail, and Fastmail.

However, learning how to implement bimi involves far more than simply uploading an image file to your web server and creating a basic DNS TXT record. Because BIMI relies on cryptographic trust and mailbox provider validation, it demands a rock-solid foundation of email authentication—specifically Domain-based Message Authentication, Reporting, and Conformance (DMARC) at strict enforcement levels. Without proper SPF, DKIM, and DMARC alignment, mailbox providers will silently reject your logo indicator.

Last updated: July 2026

What is BIMI and How Does It Work in 2026?

BIMI (Brand Indicators for Message Identification) is an open email specification that allows domain owners to publish a standardized visual indicator that participating mailbox providers display in subscriber inboxes alongside authenticated messages. Unlike traditional webmail avatars, which are controlled locally by individual email clients or user contacts, BIMI indicators are verified cryptographically and controlled centrally by the sending organization.

The mechanism operates through DNS lookups during email delivery. When a mailbox provider receives an inbound message, it performs standard authentication checks across SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail). If the message passes DMARC alignment and the domain's published DMARC policy is set to strict enforcement (p=quarantine or p=reject), the receiving mail server queries the sender's DNS for a BIMI TXT record published at default._bimi.yourdomain.com.

Upon discovering the BIMI record, the mailbox provider retrieves the specified SVG logo file (and optional VMC security certificate). The provider validates the file structure against strict SVG Tiny Portable/Secure standards, verifies the certificate chain if present, and renders the logo next to the sender name in the subscriber's inbox UI. By tying visual branding directly to DMARC enforcement, BIMI creates a powerful incentive for organizations to secure their sending domains against spoofing and phishing.

Implementing BIMI delivers three core operational benefits for modern email senders:

• Instant Inbox Recognition: Displaying your official logo in webmail list views increases brand recall and boosts open rates among engaged subscribers.
• Stronger Phishing Protection: Because BIMI mandates strict DMARC enforcement, completing the setup process protects your domain from domain spoofing and brand impersonation.
• Improved Subscriber Trust: Visible authentication badges (such as Gmail's blue verified checkmark for VMC-backed BIMI) reassure recipients that the message genuinely originated from your brand.

To maximize deliverability and ensure clean engagement, senders should also maintain pristine list hygiene using Sendgrove's Email Validation before deploying new authentication protocols across active broadcast campaigns.

Prerequisites for BIMI: SPF, DKIM, and Strict DMARC Enforcement

Before attempting to create or publish a BIMI DNS record, your organization must satisfy a strict set of technical prerequisites. Mailbox providers treat BIMI as a reward for demonstrating robust email security. If your sending infrastructure lacks proper authentication or operates under a relaxed DMARC monitoring policy, receiving servers will ignore your logo instructions entirely.

Understanding bimi email authentication requires auditing three core protocols that work in tandem to establish sender identity:

1. Sender Policy Framework (SPF)

SPF specifies which IP addresses and sending hosts are authorized to transmit email on behalf of your domain. To support BIMI, your domain's SPF record must be published in DNS as a valid v=spf1 TXT record and include all legitimate sending sources—such as marketing automation platforms, transactional email APIs, corporate mail servers, and third-party desk tools. Ensure your SPF record stays under the strict 10 DNS lookup limit to prevent PermError validation failures.

2. DomainKeys Identified Mail (DKIM)

DKIM applies a cryptographic signature to outgoing messages using a private key, allowing receiving servers to verify that the message content was not altered in transit. For BIMI compliance, every email sent from your domain must be signed with a valid DKIM key with a key length of at least 1024 bits (2048 bits is strongly recommended for modern compliance).

3. DMARC Enforcement Policy

The single biggest obstacle organizations encounter when implementing BIMI is DMARC compliance. DMARC ties SPF and DKIM checks together by evaluating identifier alignment and instructing receiving servers on how to handle unauthenticated messages.

To qualify for BIMI, your domain must have an active DMARC record published with an enforcement policy. Specifically, your DMARC TXT record at _dmarc.yourdomain.com must meet these conditions:

• Strict Policy Setting: The policy tag (p=) must be set to either quarantine or reject. A policy of p=none (monitoring mode) does not satisfy BIMI requirements.
• Full Percentage Rollout: If using p=quarantine, the percentage tag (pct=) must be set to 100 (or omitted, which defaults to 100%). Any pct value less than 100 will cause mailbox providers like Gmail and Yahoo to decline BIMI rendering.
• Subdomain Alignment: If sending from subdomains (e.g., news.yourdomain.com), the subdomain policy tag (sp=) must also be set to quarantine or reject, or inherit a strict root domain policy.

# Example BIMI-compliant DMARC TXT record
v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com; fo=1;

Before transitioning your DMARC policy from p=none to p=reject, perform a thorough audit of all legitimate outbound email streams. Transitioning prematurely without verifying third-party senders can cause business-critical transactional emails to be blocked. Running a comprehensive audit via an email deliverability guide allows you to map all active sending sources, resolve alignment gaps, and safely enforce DMARC.

Once DMARC enforcement is verified across all organizational sending domains, you can safely deploy automated marketing and newsletter campaigns using Sendgrove's Email Marketing Software while maintaining 100% DKIM and SPF alignment.

Navigating VMC and CMC Requirements

Once your DMARC enforcement policy is active, the next step in evaluating bimi vmc requirements is determining whether your brand requires a digital certificate to render your logo across major mailbox providers.

VMC vs. Self-Asserted BIMI: Provider Support Overview

Different mailbox providers handle BIMI logo rendering according to distinct security policies:

| Mailbox Provider | VMC Required? | BIMI Logo Display Behavior | Extra Authentication Badges | | :--- | :--- | :--- | :--- | | Google Gmail | Yes (Mandatory) | Renders logo in inbox list & email view | Displays blue "Verified Checkmark" | | Apple Mail (iOS/macOS) | Yes (Mandatory) | Renders logo in message header & inbox | Displays "Digitally Certified" badge | | Yahoo Mail / AOL | Optional | Renders logo if domain sender reputation is high | No special checkmark badge | | Fastmail | Optional | Renders self-asserted or VMC logos | Displays brand avatar |

As shown above, Google and Apple mandate a valid VMC certificate. If you publish a BIMI DNS record with a self-asserted logo URL (omitting the certificate location), Yahoo Mail and Fastmail may render your logo, but Gmail and Apple Mail will ignore the record.

Steps to Obtain a Verified Mark Certificate (VMC)

Acquiring a VMC involves legal and technical validation steps that can take anywhere from a few days to several weeks:

1. Secure a Registered Trademark: Your brand logo must be officially registered as a wordmark or figurative mark with an approved intellectual property office (such as the USPTO in the United States, EUIPO in Europe, UKIPO in the United Kingdom, or equivalent national offices). Unregistered logos, common law marks, or pending applications are generally ineligible for a standard VMC.
2. Convert Logo to BIMI-Compliant SVG: Format your registered logo as a strict SVG Tiny Portable/Secure file (detailed in the next section). The visual design in your SVG file must match your registered trademark logo exactly.
3. Select an Accredited Certificate Authority: VMCs are currently issued by approved Mark Verifying Authorities, primarily DigiCert and Entrust.
4. Complete Organizational Validation: The CAs perform identity verification, confirming your business registration documents, corporate authority, domain ownership, and active trademark status.
5. Receive Your PEM Certificate: Upon approval, the CA issues a Privacy-Enhanced Mail (.pem) certificate file containing your VMC certificate chain. Upload this file to a publicly accessible HTTPS web server alongside your SVG logo file.

For brands without a registered trademark, the BIMI Group introduced Common Mark Certificates (CMCs). CMCs allow organizations that have used a distinctive logo consistently for prior years (or hold non-registered marks) to obtain certificate validation for participating providers, though Gmail currently maintains strict VMC requirements for its verified checkmark program.

How to Format Your SVG Logo for BIMI (SVG Tiny PS)

One of the most technically challenging aspects of BIMI implementation is preparing your logo in the correct SVG (Scalable Vector Graphics) format. BIMI does not accept standard SVG files. Instead, it requires a highly restrictive subset known as SVG Tiny Portable/Secure (SVG Tiny PS). This standard removes all interactive elements, external references, and scripting capabilities from the SVG XML to mitigate security risks. In short, a valid svg logo for bimi is often much simpler than your typical web logo file.

Strict Requirements for BIMI SVG Tiny PS:

• Version and Base Profile: The SVG file must declare version="1.2" and baseProfile="tiny-ps" in the <svg> root element.
• Secure HTTPS URL: The logo image must be hosted on a publicly accessible web server via an https:// URL. The server must support TLS 1.2 or higher.
• Square Aspect Ratio: The logo must be perfectly square (1:1 aspect ratio). While the SVG itself is vector, mailbox providers often render it within a square bounding box. Optimize your visual design to fit a square.
• Static XML: No scripting (<script>), external references (<xlink:href>), animations (<animate>), or interactive elements (<a>, <onclick>) are permitted. All styles must be inlined within the SVG document.
• Solid Background (Optional but Recommended): While not strictly enforced, using a solid, non-transparent background helps ensure consistent rendering across diverse email clients, preventing unexpected layering issues with inbox UIs.
• Size Optimization: While SVG is vector, keep the internal complexity and file size minimal. Larger files can lead to slower loading times or rejection by some providers.

Example BIMI SVG Tiny PS XML Structure

<svg width="100" height="100" viewBox="0 0 100 100" version="1.2" baseProfile="tiny-ps" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <rect x="0" y="0" width="100" height="100" fill="#FFFFFF"/>
  <path fill="#1A73E8" d="M50 10 L80 40 L50 90 L20 40 Z"/>
</svg>

Key steps for converting your logo:

1. Start with a High-Quality Vector: Use your original vector logo file (.ai, .eps, .svg from design software).
2. Export to SVG: Most design tools can export to SVG. During export, look for options like "flatten CSS" or "inline styles." Avoid generating unnecessary IDs or classes.
3. Manual XML Editing: Open the exported SVG in a text editor. Manually remove any <script>, <style>, <a>, <defs>, <g>, or other non-essential tags. Ensure all style attributes are inlined or converted to fill attributes on paths/shapes. Critically, update the version and baseProfile attributes in the <svg> tag.
4. Validate: Use an online SVG validator that specifically checks for SVG Tiny PS compliance. Tools like the official BIMI Group SVG Checker are invaluable.
5. Host Publicly: Upload the validated .svg file to a secure, HTTPS-enabled web server (e.g., your CDN, web host, or cloud storage with proper CORS headers). Copy the full HTTPS URL for use in your BIMI DNS record.

Failing to meet these exacting SVG Tiny PS requirements is a common reason for BIMI implementation failures. Even a single unsupported XML attribute can cause your logo to be ignored by mailbox providers. For seamless email marketing operations, ensuring all technical standards are met, including robust authentication and a clean email list, is crucial. This is where comprehensive platforms like Sendgrove can help manage your entire email ecosystem. You can also review best practices for designing emails that render well on all devices with our mobile-first email marketing guide.

Publishing Your BIMI DNS TXT Record (with VMC)

Once you've met the DMARC enforcement prerequisites, secured an optional VMC (if needed for Gmail/Apple), and prepared your BIMI-compliant SVG logo, the final step is to publish your BIMI DNS TXT record. This record tells participating mailbox providers where to find your logo and, if applicable, its corresponding VMC.

Your BIMI record will be published as a TXT record for the hostname default._bimi.yourdomain.com (replace yourdomain.com with your actual sending domain).

BIMI TXT Record Fields Explained:

• v= (Version Tag): Must be BIMI1. This indicates the version of the BIMI standard.
• l= (Logo URL Tag): Specifies the HTTPS URL of your BIMI-compliant SVG logo file. This URL must be publicly accessible and serve the SVG with the correct Content-Type: image/svg+xml header.
• a= (Authority URL Tag - Optional, for VMC): Provides the HTTPS URL of your Verified Mark Certificate (VMC) file. This is typically a .pem file containing your VMC and its certificate chain. If you do not have a VMC and are relying on self-asserted BIMI (only supported by some providers), you will omit this tag.

Example BIMI DNS TXT Record with VMC

default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourcdn.com/your-brand-logo.svg; a=https://yourcdn.com/your-brand-vmc.pem;"

Example BIMI DNS TXT Record without VMC (Self-Asserted)

default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourcdn.com/your-brand-logo.svg;"

Steps to Publish Your BIMI DNS Record:

1. Access Your DNS Provider: Log in to your domain's DNS management interface (e.g., Cloudflare, GoDaddy, AWS Route 53, Namecheap).
2. Add a New TXT Record: Create a new TXT record.

• Host/Name: Enter default._bimi (your DNS provider will usually append your domain name automatically).
• Value/Text: Paste the complete BIMI TXT record string, including v=, l=, and a= (if applicable) tags.
• TTL (Time To Live): Set a reasonable TTL, typically 3600 seconds (1 hour), or a lower value initially for faster propagation during testing.

1. Save the Record: Save your new DNS record. Allow for DNS propagation, which can take a few minutes to several hours, depending on your DNS provider's settings.

Verifying Your BIMI Implementation

After publishing your BIMI DNS record, it's crucial to verify that it's correctly configured and that your logo is rendering as expected. Use online BIMI validators (e.g., BIMI Group's official validator, Valimail's BIMI checker) to confirm your DNS record syntax, SVG Tiny PS compliance, and VMC chain validation. Send test emails to various mailbox providers (especially Gmail and Apple Mail if using VMC) to observe logo rendering in different inbox environments. Consistent dmarc enforcement for bimi is critical for ongoing success.

If you encounter issues, systematically check each prerequisite: DMARC policy, SPF/DKIM alignment, SVG file format, VMC validity, and DNS record syntax. For continuous monitoring of email deliverability and authentication across your entire sending infrastructure, a platform that provides comprehensive analytics and reporting is invaluable. Sendgrove's analytics features give you clear insights into your email performance and help identify potential issues with authentication that could impact your BIMI display.

FAQ

What are the main benefits of implementing BIMI?

Implementing BIMI enhances brand visibility and recognition in the inbox, provides stronger anti-phishing protection by requiring DMARC enforcement, and builds subscriber trust through visual authentication.

Is a DMARC p=reject policy absolutely necessary for BIMI?

Yes, for most major mailbox providers like Gmail and Apple Mail, a DMARC policy of p=quarantine or p=reject with a pct=100 is mandatory. A p=none policy will not enable BIMI.

Do I need a Verified Mark Certificate (VMC) for BIMI?

A VMC is mandatory for BIMI logos to display in Gmail and Apple Mail. For other providers like Yahoo Mail or Fastmail, a self-asserted BIMI record without a VMC may be sufficient, but it offers less authentication assurance.

What is SVG Tiny PS and why is it required for BIMI logos?

SVG Tiny PS (Portable/Secure) is a highly restricted subset of the SVG format. It is required for BIMI logos because it removes scripting, external references, and interactive elements, making the logo file more secure and reducing potential attack vectors in the email client.

How long does it take for BIMI to become active after publishing the DNS record?

After publishing your BIMI DNS TXT record, it can take anywhere from a few hours to 48 hours for DNS changes to propagate globally. Once propagated, mailbox providers will begin to recognize and display your logo, provided all other BIMI prerequisites are met.

Can I use any SVG logo for BIMI?

No. The SVG logo must comply with the strict SVG Tiny PS specification, be square, and be hosted on a secure HTTPS server. If using a VMC, the SVG logo must also match your registered trademark exactly.

What if my BIMI logo isn't showing up in Gmail?

First, verify your DMARC policy is at p=quarantine or p=reject with pct=100. Second, ensure you have a valid VMC issued by an accredited MVA and that its URL is correctly specified in your BIMI DNS record. Finally, confirm your SVG logo meets all SVG Tiny PS requirements.

How does BIMI relate to SPF, DKIM, and DMARC?

BIMI builds upon the foundation of SPF, DKIM, and DMARC. It requires that SPF and DKIM are properly configured and pass authentication, and most importantly, that DMARC is enforced with a policy of p=quarantine or p=reject. Without these underlying authentication protocols, BIMI cannot function.