BIMI: Your Brand Logo Next to Your Emails
Brand Indicators for Message Identification (BIMI) lets mailbox providers show your logo next to messages from your domain, in the avatar spot of the inbox. It is not a security control in itself. It is a reward for having strong email authentication: providers only show the logo when your domain’s mail passes DMARC under an enforcing policy, so the logo signals that mail really comes from you.
BIMI is optional. We report it for information only, and it does not affect your score.
Before you start: DMARC enforcement
BIMI builds on SPF, DKIM and DMARC (see the email authentication guide). Your DMARC record must enforce:
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
p=quarantineorp=reject;p=noneis not enough.- The policy should apply to all mail; do not set
pctbelow 100. - Getting there safely means reading DMARC reports first and fixing every legitimate sender (newsletter tools, CRMs, ticketing systems) so their mail passes SPF or DKIM with your domain.
The logo
The logo must be an SVG in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, a restricted
form of SVG without scripts, external references or animation. Most design tools do not export it
directly; convert a clean, square SVG with a BIMI converter or follow the profile’s rules by hand
(among them version="1.2", baseProfile="tiny-ps" and a title element).
Design for a small circle or square: a centred mark on a solid background works best, because providers crop it.
Serve the file over HTTPS at a stable URL, for example https://example.com/bimi/logo.svg.
The mark certificate
Some providers only show a logo backed by a certificate that proves you have the right to use it:
- A Verified Mark Certificate (VMC) requires a registered trademark for the logo.
- A Common Mark Certificate (CMC) is an alternative for logos without a trademark that have been in public use for some time.
Both are issued by a small number of certificate authorities after verification, and are paid. Gmail requires one of the two. Requirements differ between providers and change over time, so check the current documentation of the providers that matter to your audience.
The DNS record
Publish a TXT record at default._bimi:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"
l=is the logo URL.a=is the URL of the certificate (VMC or CMC) in PEM format. Leave it empty (a=;) if you do not have one; providers that do not require a certificate may still show the logo.
default is the selector. Senders can use other selectors for different brands, but default is
what providers look up unless the message asks for another.
Even with everything in place, providers decide whether to show the logo, and some only do so for senders with enough volume and a good reputation.
How PerfoMetrix checks this
We look up the DNS TXT record at default._bimi.<domain>; we send no requests to your site.
- Pass: a record starting with
v=BIMI1exists. - Information: no record, or the domain has no MX records.
We do not download the logo or certificate, and we do not check that your DMARC policy enforces. The DMARC check elsewhere in the report covers that.
Further reading: Google Workspace: set up BIMI.