Brand Indicators for Message Identification, or BIMI, let organizations display their verified logo directly in the inbox next to authenticated emails – but getting that logo to actually render takes a lot more than dropping a TXT record into your zone file. Most teams that attempt a BIMI rollout hit a wall somewhere between DNS publication and the logo actually appearing in Gmail or Yahoo Mail, usually because a prerequisite further down the authentication chain was never solid to begin with.
What Has to Be True Before BIMI Works
BIMI is not a standalone control. It’s the last step in a chain that starts with SPF and DKIM and depends heavily on DMARC enforcement. If any link in that chain is loose, the logo simply won’t show – mailbox providers give no error message, no debug console, nothing. The logo either appears or it doesn’t.
Specifically, a domain needs a DMARC record at a policy of p=quarantine or p=reject, not p=none. Monitoring-only DMARC policies are the single most common reason BIMI rollouts stall. A domain running p=none for eight months while the security team “gathers data” is a domain that will never render a logo, no matter how correct the BIMI TXT record looks.
Alongside DMARC, SPF and DKIM both need to be passing consistently – not occasionally, not for most sending sources, but for the overwhelming majority of mail volume from that domain. Marketing platforms, transactional email tools, and any shadow IT sending service that fires off mail under the corporate domain all need to be accounted for in SPF and properly signing with DKIM. A single unauthenticated bulk sender can be enough to tank alignment rates and quietly disqualify a domain from BIMI eligibility, even while the DMARC policy itself looks correctly configured on paper.
The DNS Record Itself
Once the authentication chain is solid, the actual BIMI record is a TXT entry published at a selector-based subdomain, structured like this:
default._bimi.yourdomain.com IN TXT “v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem”
The l= tag points to a Scalable Vector Graphics file meeting the BIMI Group’s tight formatting rules – square aspect ratio, specific SVG Tiny Portable/Secure profile, no scripts, no external references, hosted over HTTPS with a valid certificate. A logo file that fails validation against the SVG P/S profile is a frequent stumbling block; standard SVG exports from Illustrator or Figma often include metadata or styling that the spec rejects outright.
The a= tag is optional in the spec but functionally required if the goal is broad rendering. It points to a Verified Mark Certificate, a document issued by an authorized certificate authority – currently DigiCert and Entrust are the two active issuers – that cryptographically ties the logo to a registered trademark. Gmail has required a VMC for logo display since it rolled BIMI support out in 2021 for Workspace customers, and expanded eligibility further in 2023. Yahoo and Fastmail have historically been more lenient, sometimes rendering self-asserted logos without a VMC, but that leniency isn’t something to design a rollout around since provider behavior shifts without notice.
Getting the Verified Mark Certificate
This is the part that catches security teams off guard, because it isn’t a DNS or email task at all – it’s a legal one. A VMC requires an active, registered trademark for the logo mark in question, filed with a national or regional trademark office (USPTO, EUIPO, etc.). No trademark, no VMC, no logo in Gmail. Getting a mark filed and approved can take 8 to 14 months in the US if starting from scratch, which means BIMI needs to be on the roadmap well before a campaign launch, not two weeks before.
Once the trademark is in hand, requesting the VMC from DigiCert or Entrust is comparatively fast – typically a few business days once documentation is submitted, priced in the range of a few hundred to over a thousand dollars annually depending on the issuer and certificate scope (some offer Common Mark Certificates for logos without registered trademarks, covering a narrower set of receivers).
Common Mistakes Teams Make
Three patterns show up repeatedly in BIMI rollouts that stall out:
Publishing the BIMI record while DMARC is still at p=none, then wondering why nothing renders months later. Treating the SVG logo as a design asset to be handled once and forgotten, without validating it against the actual BIMI SVG Tiny P/S spec – browser-viewable SVGs are not automatically spec-compliant. Assuming BIMI itself blocks spoofing – it doesn’t. BIMI is a visual reward for domains that already enforce strong authentication; the enforcement is coming entirely from the underlying DMARC policy, not from BIMI.
Busting the Biggest Misconception
The most persistent myth is that adding a BIMI record is itself a security control. It isn’t. BIMI is a branding and deliverability feature that sits on top of authentication infrastructure that must already be doing the real work. A domain can publish a flawless BIMI record and still be fully exposed to spoofing if its SPF and DKIM configuration is riddled with gaps or if DMARC is sitting in monitor-only mode indefinitely. The logo in the inbox is a signal to recipients that authentication is strong – it isn’t the mechanism that makes it strong.
A Practical Rollout Sequence
A security engineer approaching this correctly usually works the problem in order: first, get DMARC to p=quarantine with a high enough percentage to be meaningful, monitoring aggregate reports for at least 60 to 90 days to catch unauthenticated senders. Second, lock down SPF and DKIM for every legitimate sending source, including third-party marketing and support tools. Third, move DMARC to p=reject once alignment rates are consistently above roughly 98 percent. Only then does it make sense to pursue the trademark filing, request the VMC, and publish the BIMI TXT record. Skipping ahead just produces a record that sits inert in DNS while the team waits for a logo that will never appear.
FAQ
Does BIMI work without a Verified Mark Certificate?
Some providers, including Yahoo and Fastmail, have at times displayed self-asserted logos without a VMC, but Gmail – the largest consumer inbox by volume – has required one since its 2021 rollout. Relying on VMC-free display is not a stable long-term strategy.
Can a domain use BIMI with a DMARC policy of p=none?
No. Every major receiver requires enforcement-level DMARC, meaning p=quarantine or p=reject with a pct value that covers the bulk of mail flow, before a BIMI logo will render.
How long does a full BIMI rollout typically take?
For an organization starting from an unenforced DMARC record, 12 to 18 months is realistic once trademark filing time is included. Organizations that already run DMARC at p=reject with clean SPF and DKIM alignment can often go from trademark approval to a live logo within a few weeks.
Treat BIMI as the finishing touch on an authentication program that’s already mature, not a shortcut to look more legitimate in the inbox. Get DMARC enforcement solid first – the logo will follow on its own timeline.