BIMI Explained: What It Is, Where It Came From, and Why It's Worth It for Your Brand

TL;DR: BIMI (Brand Indicators for Message Identification) puts your verified logo next to your organisation’s name in Gmail, Apple Mail, and Yahoo Mail — a trust signal at the exact moment a recipient decides whether to open an email, before they’ve even read the subject line. It isn’t a design setting you switch on: it only works once your domain enforces DMARC, and Gmail and Apple Mail additionally require a Verified Mark Certificate (VMC) — a paid, audited proof that the logo is a registered trademark. This article covers what that’s worth to a brand, where the standard came from, exactly what each provider requires, and — because getting there is a joint project — who on your team needs to do what.

Why this is worth five minutes of your time

If you’ve ever noticed a competitor’s logo sitting next to their name in your Gmail inbox — not attached to the email, not in the signature, but right there in the inbox list before you’ve even opened anything — that’s BIMI. It’s one of the few brand-trust mechanisms that shows up before a recipient makes the open/ignore decision, which is exactly the moment first impressions get made.

It’s also not a checkbox. Getting your logo to actually appear requires your domain to pass a real authentication bar, and — for the two mailbox providers most B2B senders care about most — proof that you’re legally entitled to the trademark you’re displaying. None of that is a reason to skip it. It is a reason to know, before you ask IT to “just set this up,” what you’re actually asking for and roughly how long it takes.

Where it came from: DMARC’s overlooked reward

BIMI was developed by the AuthIndicators Working Group, later formalised as the BIMI Group — a coalition of mailbox providers, email security vendors, and brand-protection companies. The motivation was straightforward: DMARC gives organisations a real, if unglamorous, reason to enforce strong email authentication — covered in full in Email Domain Health: What IT Admins Should Be Monitoring — but the payoff for actually reaching enforcement was invisible to anyone outside IT. BIMI changes that calculus: it’s a visible, brand-facing reward for doing the authentication work properly, rather than a compliance box nobody outside the security team ever sees the benefit of. That’s also why this is genuinely a joint project rather than either team’s alone — IT does the authentication work, and marketing is who the payoff is actually for.

The standard piloted with Yahoo and (then) Verizon Media around 2019–2020, before Gmail brought it to general availability in 2021 and Apple Mail added support on iOS and macOS the following year. That rollout order matters for what comes next, because the three providers didn’t converge on identical requirements.

What it actually takes: the two-tier trust model

Here’s the plain-English version before the technical detail: your logo doesn’t show up just because you publish it somewhere. It shows up only once two separate bars are cleared, and mailbox providers disagree on how high the second one is set.

Bar one — DMARC enforcement — is non-negotiable everywhere. Your domain’s DMARC policy has to be at p=quarantine or p=reject, evaluated at (or close to) full enforcement, not sitting at the default monitoring-only p=none that most domains start at. A domain that hasn’t reached enforcement will not get its logo shown by any major provider, no matter how correctly everything else is configured. This is IT’s part of the project, and it’s covered step by step in the domain-health article linked above — it’s also frequently the longest step, since it can take months if your organisation sends from several third-party services that all need authenticating first.

Bar two — a Verified Mark Certificate (VMC) — depends which inbox you care about. A VMC is a paid, audited certificate, issued by one of a small number of certificate authorities after they verify your logo corresponds to a trademark registered with an approved intellectual property office. Gmail and Apple Mail both require one before they’ll render your logo at all, even with DMARC fully enforced. Yahoo Mail doesn’t require it — a domain enforcing DMARC gets its logo shown there without a VMC. For most B2B senders, whose audience skews heavily Gmail and Apple Mail, a VMC is effectively required in practice — and for an organisation without an existing registered trademark, that’s a real prerequisite to weigh, not a formality.

Once both bars are cleared, the technical shape of what gets published is a single DNS TXT record, at a default._bimi.yourdomain.com selector, pointing to your logo and your certificate:

default._bimi.yourdomain.com IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem"

Two details that trip people up even at this stage, worth flagging so nothing stalls the project on a technicality: the logo has to be in SVG Tiny Portable/Secure (SVG Tiny PS) format — a restricted subset of SVG built specifically for this purpose, not a file exported straight from a design tool — and publishing a correctly formatted record still shows nothing at all if DMARC enforcement (bar one) isn’t actually in place yet.

What it’s actually worth — and what it isn’t

Worth being direct about what BIMI does and doesn’t do. It is not a deliverability mechanism — a BIMI record has no effect on whether your mail lands in the inbox or gets filtered to spam; that’s governed by the authentication and sender-reputation factors covered in the domain-health article, entirely independently of whether a logo displays. What it buys you is the trust signal described above, and that’s a complementary, but distinct, brand mechanism from the in-body brand consistency Email Signature Branding covers: one is what the recipient sees before opening an email, the other is what they see once they have.

It’s also worth sizing the effort honestly rather than treating it as a quick win. Getting to DMARC enforcement is real work, sometimes running months if multiple sending services need authenticating. A VMC is a genuine cost and process, not a checkbox, and only clears the bar for Gmail and Apple Mail specifically. None of that makes BIMI not worth doing — for a brand that sends meaningful volume to Gmail and Apple Mail addresses, inbox logo placement is a distinctive, hard-to-fake signal competitors without it simply don’t have — but it’s a project with real prerequisites and a realistic timeline, not an afternoon’s DNS change.

Who does what: a practical readiness checklist

BIMI fails as a project more often from unclear ownership than from any technical step being genuinely hard. Splitting it explicitly avoids that:

Marketing’s part:

Decide whether a VMC is worth commissioning, based on which providers your recipients actually use — Gmail and Apple Mail audiences make it close to essential; a Yahoo-heavy audience makes it optional.
Commission your logo in SVG Tiny PS format — flag this explicitly to whoever designs it, since it’s a specialist format most design tools don’t export directly, and a standard SVG export will be rejected.
If a VMC is in scope, confirm the trademark registration it depends on is actually in place — this can be the longer pole than the certificate process itself if it isn’t yet.

IT’s part:

Confirm DMARC is actually enforced (p=quarantine or p=reject, close to full pct=100), not just published at the default p=none — see the domain-health article for the rollout path if you’re not there yet. This usually sits with the same team running the broader signature and domain-health rollout covered in How to Manage Email Signatures Across a Company.
Use the BIMI Group’s own record generator to build the DNS TXT record rather than hand-writing the selector syntax.
Publish the record, then verify it actually renders in a real Gmail and Apple Mail inbox — not just that the DNS record resolves, since a correctly published record with unenforced DMARC will silently show nothing.

Neither side can finish this alone — the project stalls if marketing waits on a logo format nobody told them about, or if DMARC enforcement sits unstarted because nobody thought to ask IT to prioritise it.

Frequently asked questions

I’m not in IT — what do I actually need to do for BIMI?

Two things: commission your logo in SVG Tiny PS format (not a standard export — tell your designer explicitly), and decide whether to commission a Verified Mark Certificate based on whether your recipients are mostly on Gmail and Apple Mail (where it’s effectively required) or Yahoo (where it isn’t). Everything else — DMARC enforcement and publishing the DNS record — is IT’s side of the project; see the checklist above for the full split.

Does BIMI improve email deliverability?

No. BIMI has no effect on spam filtering, inbox placement, or sender reputation — those are governed by SPF, DKIM, DMARC, and sending behaviour, covered in Email Domain Health: What IT Admins Should Be Monitoring. BIMI is a brand-trust display mechanism layered on top of an already-authenticated domain, not a deliverability tool in its own right.

Do I need a Verified Mark Certificate to use BIMI?

It depends which mailbox providers you care about. Gmail and Apple Mail both require a VMC before they’ll display your logo, even with DMARC fully enforced. Yahoo Mail will show a BIMI logo from a domain enforcing DMARC without a VMC. If your audience is concentrated in Gmail and Apple Mail — the likely case for most B2B senders — a VMC is effectively required in practice, not optional.

What’s the difference between BIMI and just putting a logo in an email signature?

An email signature’s logo is part of the message body — it displays once the recipient has already opened the email, and any sender can include one regardless of authentication status. A BIMI logo displays in the inbox listing itself, before the message is opened, and only for domains that have proven, cryptographically, both that they’re authenticated (DMARC enforcement) and — for Gmail and Apple Mail — that they’re entitled to the trademark shown (a VMC). The two are complementary, not substitutes for each other.

Can I get BIMI working without enforcing DMARC?

No. Every major mailbox provider that supports BIMI checks DMARC enforcement status before evaluating the BIMI record at all. A domain at p=none (the default, monitoring-only starting policy) will not display a BIMI logo in any supporting inbox, regardless of how correctly the BIMI TXT record itself is formatted.

Is BIMI only relevant to large enterprises?

No — the trademark-registration and VMC cost are the main barriers, not company size. A smaller organisation with an already-registered trademark and an enforced DMARC policy can adopt BIMI as readily as a large one. The more common blocker at smaller organisations is simply not yet being at DMARC enforcement, which is a prerequisite regardless of BIMI.

SigHQ is building an add-in-first email signature management tool for Microsoft 365 organisations of 50–250 employees — signatures applied in Outlook at compose time, without email routing through third-party infrastructure. Join the waitlist to follow progress.