What is BIMI? Setup, VMC costs and requirements

BIMI (Brand Indicators for Message Identification) is a standard that lets a domain display its logo next to its messages in supporting inboxes. It is not an authentication mechanism itself; it is a reward layer sitting on top of one. A receiver shows the logo only when the message passes DMARC under an enforcement policy and the domain publishes a valid BIMI record, usually backed by a certificate proving logo ownership. The visible effect is small and brand-shaped: your mark where recipients otherwise see initials in a colored circle.

The prerequisite: DMARC at enforcement

No provider renders a BIMI logo for a domain at p=none. The requirement is DMARC at quarantine or reject (Gmail additionally requires the policy to cover subdomains and rejects pct-weakened setups), because the logo is a trust signal that would otherwise decorate spoofable mail. In practice this makes BIMI a byproduct of finishing the DMARC rollout: domains that cannot yet enforce have a prerequisite project, not a BIMI project.

The moving parts

The DNS record lives at default._bimi.yourdomain.com and carries two URLs: l= pointing to the logo and a= pointing to the certificate. The logo must be an SVG in the Tiny PS profile, square, with a solid background and no scripts or external references; exporting a compliant file from a standard brand mark is a designer task with tooling support, not a redraw. The certificate is where the money goes.

A VMC (Verified Mark Certificate) attests that the logo is a registered trademark you own, issued by DigiCert or Entrust after verification, at roughly 1,000 to 1,500 EUR per year. Since 2024, CMCs (Common Mark Certificates) offer a cheaper path for logos with at least a year of documented prior use instead of a trademark, at the cost of reduced treatment at some providers (Gmail shows the logo with a CMC but reserves the blue verified checkmark for VMCs). Yahoo and Apple Mail render BIMI with certificates; a few smaller providers render the record alone, uncertified.

Setting it up

BIMI deployment

1
Reach DMARC enforcement
p=quarantine or p=reject, with subdomain coverage, verified stable in aggregate reports. This is most of the work and all of the security value.
2
Produce the compliant SVG
Square, Tiny PS profile, solid background. Validate with the BIMI Group's SVG conversion tooling and host it at a stable HTTPS URL.
3
Obtain the certificate
VMC with a registered trademark (weeks of verification), or CMC with documented prior logo use. Host the PEM at the a= URL.
4
Publish the record and verify
TXT at default._bimi.yourdomain.com with l= and a=. Check with a BIMI inspector, then send to Gmail and Yahoo test accounts; logos typically appear within a day or two once everything validates.

The honest ROI conversation

BIMI does not change filtering: placement is decided before the logo question arises, and providers treat it as presentation, not reputation. The measurable effects are recognition-shaped, modest open-rate lifts and phishing-resistance at the margins, because attentive recipients learn that the genuine sender carries the mark. Those effects concentrate where consumer audiences on Gmail, Yahoo, and Apple Mail dominate. B2B senders whose recipients live in Outlook see almost nothing, because Outlook does not render BIMI, which is the single fact that decides most B2B ROI calculations.

The sensible framing: the DMARC enforcement that BIMI requires is unconditionally worth it and costs nothing but work. The certificate is a brand-visibility purchase on top, justified by consumer audience share and logo recognition value, and skippable without any deliverability consequence.

Frequently asked questions

Does BIMI improve deliverability?

No. It renders only after placement is decided and passes no signal into filtering. Indirect benefits run through recipient recognition and engagement, not through the filters.

Can I do BIMI without a trademark?

Since 2024, yes: a CMC accepts a year of documented prior logo use in place of a registration. Gmail displays the logo with a CMC but reserves its blue verification checkmark for VMC holders. Without either certificate, coverage shrinks to the few providers that render bare records.

Which inboxes show BIMI logos?

Gmail, Yahoo Mail, Apple Mail (iOS 16 and later), Fastmail, and several regional providers. Outlook does not support BIMI, which matters greatly for B2B audience math.

Why is my logo not showing despite a valid record?

Work the gate list: DMARC must be at enforcement including subdomains, the SVG must pass Tiny PS validation, the certificate must be current and match the logo, and providers also apply sender reputation thresholds before rendering. New setups can also simply need a few days.

Key takeaways

BIMI displays a verified logo next to mail that passes DMARC at enforcement; it is a reward layer, not authentication
The record needs a Tiny PS SVG plus, at major providers, a VMC (trademark) or cheaper CMC (prior use) certificate
DMARC at quarantine or reject with subdomain coverage is the non-negotiable prerequisite
Filtering and placement are unaffected; the value is recognition, concentrated in consumer inboxes
Outlook does not render BIMI, which decides the ROI question for most B2B senders