BIMI Implementation: How to Get Your Verified Brand Logo Into the Inbox in 2026

You have spent months getting DMARC to enforcement, your SPF and DKIM are clean, and marketing asks the inevitable question: can we get our logo to show up in Gmail? That is BIMI, and the connection is simpler than most guides make it sound, as long as you avoid the pitfalls that break roughly half of all published BIMI records.

That failure rate is the headline. Analysis of published BIMI records finds that of the domains that even have one, the split between valid and invalid is nearly even, meaning about half of everyone who tried got it wrong. BIMI looks like a simple DNS record, but it is really a cleanup project with a DNS record at the end. This guide walks the implementation in the order that works, and names the specific traps that produce all those invalid records.

What BIMI Is and What It Is Not

BIMI is a standard that lets a domain owner publish a logo to be displayed by mailbox providers next to authenticated mail from that domain. Instead of a blank avatar or an initial, the recipient sees your actual brand logo, and at supporting providers, a verification indicator alongside it. It turns the invisible work of email authentication into something your recipients can see and recognize.

What BIMI is not is a deliverability mechanism. This is the single most important thing to understand before investing in it. A message that fails DMARC still fails DMARC with or without BIMI. A message that lands in spam still lands in spam. BIMI does not improve your placement; it rewards senders who have already done the authentication work with a stronger visual identity in the inbox. The theory is that recipients trust and engage more with mail carrying a recognized brand logo, and there is measured evidence of engagement lifts, but the mechanism is brand visibility, not filtering.

The Hard Prerequisite: DMARC at Enforcement

Before anything else, BIMI requires DMARC at an enforcement policy. Your DMARC policy must be p=quarantine or p=reject; p=none, the monitoring-only starting policy, does not qualify. This single requirement is what keeps BIMI adoption low, because most domains have not yet reached DMARC enforcement, and there is no shortcut around it.

The reason is logical: BIMI depends on the guarantee that only authenticated mail can display your logo. If your DMARC policy is not enforcing, unauthenticated mail claiming to be from your domain would not be rejected, so a logo would not be a reliable trust signal. Enforcement is what makes the logo meaningful, so providers require it.

This is why teams underestimate BIMI. They want the visual upside without the operational discipline of full DMARC enforcement, and providers do not allow that trade. Getting to enforcement is itself a project:

• Inventory every system that sends mail as your domain.
• Confirm each is properly aligned on SPF or DKIM.
• Move DMARC from p=none to p=quarantine, monitoring aggregate reports for 2 to 4 weeks to catch any legitimate source that is failing before you tighten further.
• Reach p=quarantine (at full coverage) or p=reject.

The Logo: SVG Tiny P/S, and Why Your Website Logo Fails

Once DMARC is enforced, the next hurdle is the logo file, and this is where many technically-correct setups still miss the inbox. BIMI does not accept a regular SVG. The logo must meet strict requirements:

• Format: SVG Tiny Portable/Secure (P/S), a specific, restricted SVG profile. A standard SVG exported from a design tool will be rejected even if it looks identical in a browser.
• Shape: square (1:1 aspect ratio), since the logo renders in a circular or square avatar slot.
• Hosting: over HTTPS, at a stable URL referenced in your BIMI DNS record.
• Small and simple, with a title element naming your company.

The reason a website logo fails is that a normal SVG carries extra baggage, scripts, external references, unsupported elements, that the SVG Tiny P/S profile forbids for security and predictability. A logo that looks perfect in a browser can still be rejected by a provider's parser. The practical test is not whether the logo looks right in a brand deck; it is whether mailbox providers can fetch it, parse it, and render it without guessing. BIMI rewards boring, predictable assets. Validate your SVG against a BIMI validator before publishing rather than assuming it passes.

The Certificate: VMC and CMC

For the largest providers, a valid logo and enforced DMARC are still not enough; you need a certificate that verifies your right to the logo. There are two types:

Historically the VMC's trademark requirement excluded many organizations. The arrival of the Common Mark Certificate widened eligibility by not requiring a registered trademark, while preserving the verification step, so more organizations can now qualify. We cover the full comparison in our guide to VMC versus CMC certificates, but the key point for implementation is knowing which providers demand a certificate at all.

Provider Support in 2026

BIMI support has grown substantially but is not universal, and the certificate requirement varies by provider. As of 2026:

• Gmail and Apple Mail support BIMI display but require a verified certificate (VMC or CMC) to show the logo. These are the two largest clients, so a certificate is effectively necessary for broad logo display.
• Yahoo, Fastmail, and AOL can display your logo based on DMARC compliance and a valid BIMI record, without necessarily requiring a certificate.
• Providers that do not support BIMI simply ignore the DNS record and show no logo, with no negative effect.

The practical implication is that there is no downside to publishing a valid BIMI record even if your audience is split across supporting and non-supporting clients: supporters show your logo, and non-supporters ignore the record harmlessly. The upside varies by how much of your audience is on certificate-requiring providers like Gmail, which is where the certificate cost earns its return.

Reputation Still Gates the Logo

One subtle point that catches even careful implementers: a technically perfect BIMI setup can still fail to display if your domain has deliverability problems. Mailbox providers evaluate your Sender Reputation before showing your logo, and some apply reputation thresholds to logo display. BIMI rewards already-authenticated senders with good reputation; it does not rescue a domain with poor standing.

The Implementation Order That Works

Pulling it together, here is the sequence that avoids the common failures:

1. Get SPF, DKIM, and DMARC clean and passing across every sending source, verified with an SPF checker, DKIM checker, and DMARC checker.
2. Move DMARC to enforcement (p=quarantine at full coverage or p=reject), monitoring reports to confirm no legitimate mail breaks.
3. Create a compliant SVG Tiny P/S logo, square, hosted over HTTPS, and validate it with a BIMI validator.
4. Obtain a certificate (VMC or CMC) if your audience includes Gmail or Apple Mail.
5. Publish the BIMI DNS record pointing to your logo and certificate.
6. Test and monitor, confirming display across providers and continuing to watch DMARC reports, since logo display depends on ongoing authentication and reputation health.

Logo display is gradual, not instant; even with a perfect setup, it can take weeks and varies by provider. But once it lands, it compounds: consistent logo exposure in the inbox builds recognition over time. Fold BIMI into your broader authentication practice as the visible payoff for authentication done right, and it becomes a durable brand asset rather than a one-time configuration.

Frequently Asked Questions