BIMI
A verified brand logo shown in supported inboxes, which needs strong DMARC enforcement and a verified logo certificate before it renders.
BIMI displays a verified brand logo in supported inboxes. It requires strong DMARC enforcement and a verified logo certificate.
BIMI displays a verified brand logo in supported inboxes. It requires strong DMARC enforcement and a verified logo certificate.
Related
The short version
- BIMI, Brand Indicators for Message Identification, is a DNS-published claim that ties a sending domain to a verified logo, so a supporting inbox can show that logo beside the message.
- It is not a deliverability fix and not a ranking signal. It is a display feature that depends on authentication being genuinely enforced first.
- Three prerequisites: DMARC at enforcement with full coverage, aligned SPF or DKIM, and a certificate that verifies the logo, plus an SVG in the Portable/Secure profile.
- The certificate is where Indian brands stall. A Verified Mark Certificate requires a registered trademark, and Indian registration can take a year or more, so many teams cannot use BIMI when they first want it.
- Display is not universal. Gmail and Apple Mail show logos with a valid certificate; Outlook has not shipped support, so a large share of corporate inboxes show nothing.
- Measure complaints, authentication pass rates and brand recall, not a claimed open-rate lift that mailbox privacy features make impossible to attribute.
BIMI, defined by what it publishes
BIMI is a mechanism for publishing a brand logo in DNS and having a receiving mailbox provider display it next to messages from that domain. The domain owner publishes a TXT record at a defined subdomain containing a version tag, a URL to an SVG logo and, where required, a URL to a certificate. The receiving provider fetches those resources, checks the certificate against the domain, and decides whether to render the logo.
The specification is stewarded by the BIMI Group and has been published as an IETF internet-draft rather than a ratified standard. That matters for procurement: no RFC number exists, support is a matter of each mailbox provider’s implementation, and the rules have changed several times. It is a real, working mechanism with real adoption among large providers, not a formal internet standard.
What BIMI is not: it is not a replacement for SPF, DKIM or DMARC, and it does not repair a domain with weak authentication. It is not a spam-filter signal that guarantees the inbox, and it is not a universal feature that every recipient will see. It is a display layer on top of an authentication posture that has to be correct already. Nor is it an AI capability: an Agent OS can draft a better subject line, and an AI SDR can choose a better audience, but neither puts a logo in the inbox. That requires DNS, a policy and a certificate.
The three prerequisites, in order
First, DMARC must be at enforcement. In practice that means a policy of quarantine or reject with the percentage set to one hundred, applied to the domain in the From header. A policy of none, or a policy that only covers part of the mail, disqualifies the domain. Some providers also require the policy on the organisational domain, so a subdomain with its own relaxed policy may not qualify.
Second, the messages must pass authentication with alignment. SPF must pass against a domain aligned with the From domain, or DKIM must have a valid signature with a d equals value aligned to it. In practice most senders rely on DKIM alignment because it survives forwarding better, and because SPF breaks when a message is relayed. Both should be configured; the requirement is that at least one is aligned and passing.
Third, the logo and its certificate. The logo must be an SVG in the SVG Tiny Portable/Secure profile, a restricted subset with no scripts, no external references and a square viewBox. The certificate, where the provider requires one, is issued by an authorised certificate authority after verifying that the logo is a registered trademark owned by the requesting organisation. Without that certificate, Gmail will not display the logo.
Getting DMARC to enforcement without losing mail
Most Indian senders start at p=none because they are afraid of breaking invoice mail, and many stay there for years. The path out is a sequence, not a switch. Publish the record with rua reporting, collect aggregate reports for a few weeks, identify every source that sends as your domain, and fix or retire the ones you do not recognise. Only then move to quarantine with a partial percentage and raise it.
The sources are usually more numerous than expected: the marketing platform, the transactional provider, the ERP that sends invoices, the support desk, the website’s contact form, a forgotten agency tool and someone’s local mail client. Each needs SPF authorisation or its own DKIM signature, and each needs to be in the inventory before enforcement. A surprise at this stage is a business email outage, not a marketing inconvenience.
Subdomains deserve their own policy. A common pattern is p=reject on the organisational domain with sp=reject for subdomains, plus separate records for any subdomain that legitimately sends. The safest configuration is one where every sending source has a name you can point to, and where a new source is added through a change process rather than discovered through a failed delivery.
The Verified Mark Certificate, and what a CA checks
A VMC is issued by a certificate authority that has been authorised for the BIMI programme. The authority verifies two things: that the requesting organisation controls the domain, and that it owns a registered trademark for the logo being published. The certificate is then bound to that logo, so a lookalike mark cannot be substituted later without invalidating it.
The trademark requirement is the crux. It is not enough to have used a logo for years, to have a copyright registration, or to have a pending application. The certificate authority expects a registered mark in the relevant jurisdiction, with a registration number it can check. A wordmark registration may not cover a figurative logo, so the mark on the certificate has to match what is displayed.
There is a lower bar called the Common Mark Certificate, which some providers accept for logos without a registered trademark. It is cheaper and faster, and support is narrower. For an Indian company that wants a logo in Gmail quickly and does not yet hold a registration, the CMC is the pragmatic route, provided the target provider accepts it. Checking that before paying for anything is the first step.
Why Indian brands get stuck
Trademark registration in India is not fast. An application is examined, published for opposition, and only then registered. Where there is no opposition and no objection, the process can still take many months, and an objection adds months more. A brand that has been trading for a decade may hold a registration; a brand that launched last year usually does not, and a pending application does not satisfy the certificate authority.
Cost is the second obstacle, and it is a foreign currency cost. The certificate is an annual fee set by the authority, quoted in dollars, and it sits on top of the trademark cost and the design work for a compliant SVG. For a mid-sized Indian company the total is not enormous, but it is a line item that has to be approved, renewed and owned, and it is priced per logo rather than per campaign.
The third obstacle is organisational. BIMI cuts across email infrastructure, brand and legal, and nobody owns all three. Infrastructure owns DMARC, brand owns the mark, legal owns the trademark evidence. Without a named owner the project stalls at the point where someone has to ask legal for a registration certificate, which is exactly where most stalled BIMI projects sit.
Making a logo that survives the profile
The Portable/Secure profile is deliberately restrictive. It is a subset of SVG Tiny 1.2 with no scripting, no external fonts, no raster images and no references to remote resources. The canvas must be square, the artwork must be legible at small sizes, and the file should contain a title element for accessibility. A logo exported from a design tool at 1200 by 400 pixels will be rejected by the validator before any provider sees it.
Design for the inbox, not the brand book. A mark that depends on fine gradients, thin strokes or a strapline will turn to mush at twenty-four pixels. Test the SVG at the actual rendered size on a light and a dark background, because some clients render the logo on white and others on a coloured header. A mark that only works on white is a mark that disappears for half the audience.
Validation is a step, not a hope. The BIMI Group publishes a validator, and certificate authorities check the file before issuing. Keep the source file and the exported SVG in version control alongside the DNS record, because the logo URL is referenced by the certificate and changing the artwork without reissuing invalidates the claim.
Publishing the records without breaking the domain
The BIMI record lives at a reserved subdomain, typically default dot underscore bimi dot your domain, as a TXT record with a version tag, a logo URL and a certificate URL. The logo and certificate must be served over HTTPS from a host that is publicly reachable and does not block the provider’s fetcher. A record that points at an internal host, a redirect chain or a file behind a bot challenge fails silently.
Rollout should be staged. Publish the record on a subdomain used for a small sending stream, confirm that the logo renders in a test mailbox at each supporting provider, and only then move to the main domain. Keep the record in configuration management with the rest of DNS, and set a reminder for certificate renewal, because an expired certificate removes the logo without any error message reaching the sender.
Two operational details catch teams. The first is caching: providers may cache the logo and certificate, so a change can take time to appear. The second is the interaction with DMARC reporting addresses, which must remain valid or you lose the visibility that got you to enforcement in the first place.
What changes in the inbox, and what does not
Where it is supported, BIMI puts a small logo beside the sender name in the message list. That is the entire user-visible change. It does not add a verified badge with a tick, it does not change the subject line, and it does not reorder the inbox. Any agency promising a verified sender treatment in every mailbox is describing something BIMI does not do.
Does it improve deliverability? Not directly, and there is no published mechanism by which a logo changes spam filtering. What it can do is make a genuine message easier to recognise, which matters in a category where impersonation is common, such as banking, lending, logistics and government-adjacent services. That is a trust effect, not a reputation effect, and the two should not be conflated in a business case.
Provider support is uneven and changes. Gmail requires a verified certificate and displays the logo in its apps and web interface. Apple Mail supports BIMI on recent OS versions. Yahoo supports it. Outlook has not shipped support, so a large share of corporate recipients see nothing. Indian mailbox providers vary, and none of them publishes a guarantee.
The Indian inbox mix and the fallback plan
Gmail is the dominant consumer inbox for most Indian brands, which is fortunate because Gmail is also one of the providers that supports BIMI with a certificate. Apple’s Mail app matters for a smaller, higher-income segment. Corporate recipients are more likely to be on Outlook or on a Google Workspace tenant with its own policies, and the Outlook share is where the logo disappears.
A fallback is therefore part of the plan, not an admission of failure. On WhatsApp, the business profile carries a verified name and a logo, and that surface reaches more Indian consumers than email for many categories. On the website and in the app, consistent use of the same mark builds the recognition that BIMI is trying to borrow. None of these is a substitute for authentication, and all of them are cheaper than a certificate.
There is also a reputational argument for doing the DMARC work even if BIMI never ships. Enforcement stops domain spoofing, which is the actual harm. The logo is a nice outcome of that work. Teams that frame BIMI as the goal often abandon the project when the trademark stalls, and lose the security benefit along with the display.
Measuring the effect honestly
Open rates are a poor outcome measure because mailbox privacy features pre-fetch images and inflate opens unpredictably. If you must report opens, report them with the caveat and alongside a metric that is not affected, such as complaint rate, unsubscribe rate, reply rate on a human-monitored inbox, or the share of authentication failures in DMARC reports.
The measurements that actually describe the programme are authentication pass rate, the count of unauthorised senders attempting to use the domain, and certificate and record validity. Those are verifiable. Brand recall can be measured with a survey, but it needs a baseline before rollout and a sample large enough to say anything, which most teams do not have.
What should never appear in a report is a claimed percentage lift in opens or revenue attributed to BIMI alone. In the same quarter the team also changed the sending cadence, the subject lines and the segmentation. A logo is not observable in isolation, and pretending otherwise is the kind of metric that makes a marketing team stop trusting its own dashboards.
Worked example: a D2C brand in eight weeks
A Pune skincare brand sends about four hundred thousand marketing emails a month and wants its logo in the inbox. DMARC sits at p=none with reports going to an unread mailbox. The brand owns a wordmark registration but the logo it uses on packaging is a figurative mark that was never registered. Engineering has never inventoried its sending sources.
Weeks one to three go to DMARC. Reports reveal six sources, two of which nobody recognises and one of which is an agency sending on a subdomain. Both are retired or given proper DKIM. Policy moves to quarantine at fifty percent, then one hundred, then reject, with alerts on failure spikes. Week four fixes the SVG: a square, simplified version of the packaging mark, validated against the profile and tested at twenty-four pixels.
Weeks five to eight are legal. The registered wordmark does not cover the figurative mark, so the team applies for the logo as a device mark and, in parallel, applies for a Common Mark Certificate to cover the gap. Gmail displays the logo once the CMC is issued and the DNS record is live, on the main marketing subdomain first. The new trademark registration will replace the CMC at renewal. The report at the end states authentication pass rate, spoofing attempts blocked and the certificate path, and makes no claim about open rates.
Frequently asked questions
Do I need DMARC to use BIMI?
Yes, and it has to be at enforcement. A policy of none, or a policy applied to only part of the mail, disqualifies the domain. Most providers also want the policy on the organisational domain. The practical order is reporting, source clean-up, quarantine, then reject, before any BIMI work begins.
What is a VMC and why does it matter in India?
A Verified Mark Certificate is issued by an authorised authority after checking that the logo is a registered trademark owned by the domain owner. Indian trademark registration can take many months, often a year or more, so brands without a granted registration cannot obtain one quickly. That is the main reason Indian BIMI projects stall.
Is there an alternative if we do not have a trademark?
The Common Mark Certificate is a lower-bar option that some providers accept without a registered trademark. Support is narrower than the VMC and it is not universal, so check the provider you care about before paying. A pending trademark application does not satisfy either certificate.
Does BIMI improve deliverability?
No published mechanism exists by which a logo changes spam filtering, and no provider promises placement in exchange for BIMI. The work that precedes it, namely enforced DMARC and aligned authentication, does reduce spoofing and improves the domain’s standing. Attribute the benefit to authentication, not to the logo.
Which inboxes actually display the logo?
Gmail displays it with a valid certificate, Apple Mail supports it on recent OS versions, and Yahoo supports it. Outlook has not shipped support, so corporate recipients typically see nothing. Indian providers vary and none guarantees display. Treat coverage as partial and plan a fallback for the rest.
What format does the logo need?
An SVG in the SVG Tiny Portable/Secure profile: square viewBox, no scripts, no external references, no embedded raster images, and a title element. It must be legible at around twenty-four pixels and work on light and dark backgrounds. Validate it before applying for a certificate, because the certificate binds to that exact file.
Where does the BIMI record go?
A TXT record at the reserved default underscore bimi subdomain of the domain, containing the version, the HTTPS URL of the logo and the URL of the certificate. The resources must be publicly reachable without a redirect or a bot challenge. A misconfigured host fails silently, with no logo and no error to the sender.
Does BIMI work on subdomains?
Each domain and subdomain needs its own record, and the certificate must cover the domain that appears in the From header. Marketing subdomains are common, so publish there first and extend to the organisational domain once the rendering is confirmed. Remember that DMARC alignment applies to the From domain, not the envelope.
How should we measure success?
Use authentication pass rate, the number of unauthorised senders blocked, and certificate validity. Complaint and unsubscribe rates are reasonable secondary signals. Avoid claiming an open-rate or revenue lift from the logo alone, because privacy features distort opens and other campaign changes usually move at the same time.