Most of email security is invisible. IP reputation, cryptographic signatures, header parsing, DNS lookups, none of it ever reaches the person opening the message. From the inbox, a genuine email from your bank and a convincing fake look almost identical: a sender name, a subject line, and the same grey placeholder avatar. BIMI is the standard that finally puts something visible on that surface.
BIMI stands for Brand Indicators for Message Identification. In plain terms, it lets a domain owner display an official logo next to their messages in supported inboxes, Gmail, Apple Mail, Yahoo Mail, and Fastmail among them. The catch is that you only earn that slot if your email authentication is already locked down. If you want to check what a domain is currently publishing, the BIMI record lookup reads the record straight from DNS and explains what each part means.
How BIMI actually decides to show a logo
BIMI does not stand on its own. It sits on top of SPF, DKIM, and DMARC, and a mailbox provider will not even look for your logo until those checks are satisfied. When a message arrives at a supporting provider, roughly this sequence runs:
- Authentication. The message has to pass SPF and/or DKIM, and the passing result has to align with the visible
From:domain. - DMARC at enforcement. This is the gate that trips most people. Your DMARC policy must be
p=quarantineorp=reject. A monitoring policy ofp=none, or apctbelow 100, disqualifies you no matter how good the rest of your setup is. - BIMI DNS lookup. The provider queries a TXT record at
default._bimi.yourdomain.com. - Logo and certificate. That record points at an SVG logo and, for most providers, a Verified Mark Certificate.
- Render. If everything holds up, the logo appears next to your name.
Skip or fumble any one of those and the logo simply does not show. There is no error message in the recipient's inbox, which is part of what makes BIMI frustrating to debug.
Reading a BIMI record
A published record at default._bimi.yourdomain.com is short and looks like this:
v=BIMI1; l=https://yourdomain.com/assets/logo.svg; a=https://yourdomain.com/assets/vmc.pem;
Three tags do the work:
v=BIMI1is the version, and it always comes first.l=is the location: the HTTPS URL of your logo image.a=is the authority: the HTTPS URL of your Verified Mark Certificate.
The logo at l= cannot be any old SVG. It has to be in the SVG Tiny Portable/Secure profile (SVG Tiny PS), a stripped-down flavour of SVG with no scripts, external references, or animation. Hand a provider a standard SVG exported from your design tool and BIMI fails quietly, which is exactly the kind of trap worth knowing about before you publish.
The lookup tool shows you these tags and translates them into plain language, so you can confirm the record exists, parses correctly, and points where you expect. What it does not do is fetch the SVG file to confirm it meets the Tiny PS profile, or open the certificate at a= to inspect its contents, so treat the image and certificate requirements below as things you verify on your own before you publish.
Why the certificate matters
You can technically run BIMI with just a logo and no a= tag, and Yahoo will display it. Gmail and Apple Mail will not. They require a Verified Mark Certificate, or VMC, referenced through the a= tag.
A VMC is a specialised certificate issued by an authorised authority such as DigiCert or Entrust. Getting one is deliberately hard. You have to prove two things: that the logo is a registered trademark, filed with an office like the USPTO, EUIPO, or CIPO, and that your organisation is who it claims to be, through an identity check similar to the old EV SSL process. When a valid VMC is in place, Gmail adds a blue checkmark next to your name alongside the logo, which is the strongest visual trust signal currently available in a consumer inbox.
That difficulty is the point. Because a spoofer cannot register your trademark or pass the identity vetting, they cannot mint a VMC for your brand, and so they cannot ride your logo into someone's inbox.
The mistakes that quietly break BIMI
BIMI has strict rules spread across DNS, HTTP hosting, image encoding, and certificates, and any single violation causes a silent failure. The most common ones are worth calling out:
- DMARC not at enforcement. By far the biggest one. If your policy is still
p=none, nothing downstream matters. You can check the live policy with the DMARC record lookup, and if you need to build or tighten one, the DMARC Generator walks you through a record you can move towardp=reject. - A standard SVG instead of SVG Tiny PS. The record looks fine, the URL loads, and the logo still refuses to appear.
- Weak underlying authentication. DMARC enforcement is only trustworthy if the SPF and DKIM beneath it are solid. Confirm your sending sources with the SPF record lookup and your signing keys with the DKIM record lookup.
The lookup tool focuses on the parts it can see reliably from DNS: whether a record exists at default._bimi (or a custom selector), whether its syntax is valid, and whether the DMARC prerequisite is actually at enforcement. That last check catches the single most common reason BIMI never lights up.
Where security meets marketing
BIMI is one of the few controls that pays off on both sides of the house. On the security side, because it demands DMARC enforcement plus trademark validation, an impersonator cannot display your logo on a forged message. Their mail either gets blocked by your DMARC policy or arrives with no badge at all, which is itself a signal to a careful reader.
On the marketing side, a verified logo sitting in the inbox lifts recognition and, by most reports, open rates, and it keeps reinforcing your brand even on the messages nobody opens. It is rare for a DNS change to help the security team and the marketing team in the same afternoon, but this one does.
Getting started
If you already run DMARC at p=quarantine or p=reject, you are most of the way there: produce an SVG Tiny PS version of your logo, obtain a VMC if you want placement in Gmail and Apple Mail, and publish the TXT record. If you are not at enforcement yet, start there, because nothing else about BIMI works until you are. Either way, run the domain through the lookup to confirm the record parses and the DMARC gate is open before you wait on the providers to catch up.