Email Authentication & Trust

BIMI Guide: What It Is, Why It Matters, and How to Publish a Valid Record

BIMI (Brand Indicators for Message Identification) is a DNS TXT record that lets supporting mailbox providers render your verified brand logo next to the from-line of your email — and, at Microsoft, the blue verified-sender check mark. BIMI is not a placement signal on its own, but it is the brand-trust layer on top of a healthy SPF, DKIM, and DMARC setup, and the visible engagement it drives feeds the reputation loop the providers actually score.

← All resources

What BIMI Is and Why It Matters

BIMI was drafted at the IETF as the drafts/bimi-working-group track and has been implemented in the wild since 2021. The idea is simple: a receiving mail server should be able to look up, in DNS, the brand logo the sender wants shown next to their messages in the inbox — and that lookup should only succeed when the visible From: domain has been authenticated by DMARC.

In other words, BIMI turns "From: acme.com" from a string into a brand. Gmail, Apple Mail (iOS 16+, macOS Ventura+), and Yahoo Mail render the SVG logo inline next to the from-line in the inbox once DMARC passes. Microsoft Outlook displays the blue verified check mark after DMARC alignment plus an a= assertion of logo-control resolves.

Support tiers today look like this. Gmail has rendered the BIMI logo since 2021 for any sender with a valid DMARC p=quarantine record — a Verified Mark Certificate (VMC) is no longer required. Yahoo followed. Apple Mail renders the SVG for the same DMARC floor. Microsoft introduced the verified check mark in 2024 for senders that publish an a= self-assertion (the 2024 self-assertion path) or a DMARC-ARC VMC for the stricter certified path.

The brand-trust story is the heart of it. Logo and check mark are what a human scans in the inbox in under a second; companies that publish BIMI consistently see higher open rates, higher reply rates, and fewer "is this a phish?" reports from recipients. The render is the visible win — the unstated win is that any brand sending email has to have tightened DMARC to p=quarantine or stricter before the BIMI lookup even resolves, which alone cuts spoofing exposure at the source.

Check your BIMI now

Run the free BIMI checker against your domain — looks up default._bimi.yourdomain.com, validates the SVG, checks for the required DMARC p=quarantine floor, and tells you exactly what the rendering providers will see.

Check your BIMI now →

How BIMI Ties to Inbox Placement

The honest answer is nuanced: BIMI is not a placement signal at Gmail. Googles spam-filter ranking is fed by DMARC alignment, SPF/DKIM pass rates, IP and domain reputation, engagement metrics, and complaint rates. BIMI does not enter that ranking directly — Gmail does not reward a domain for having BIMI with a better inbox placement.

But BIMI drives the engagement signals the providers DO score. The verified logo + from-line combination consistently lifts open rates, reply rates, and moves-from-spam actions at every supporting provider, and those actions feed Postmaster Tools domain reputation directly. In practice the loop is: publish BIMI → users trust your message more → opens and replies climb → Postmaster Tools domain reputation climbs → inbox placement improves. BIMI is the brand layer; DMARC is the policy; engagement is the feedback Postmaster actually measures.

Postmaster Tools is the downstream engagement metric you should be reading while you measure whether BIMI is working for you. Domain reputation ("High" / "Medium" / "Low"), IP reputation, spam complaint rate, and the domain-vs-IP traffic split show up there within 24–48 hours of enrolment at postmaster.google.com. On the Microsoft side, SNDS shows the per-IP filter colour that BIMI rendering helps move from yellow back to green.

The other tier of placement signal is content + structural: subject lines, HTML balance, list hygiene, and known-good link domains. BIMI is the visible wrapper around all of that, not a substitute.

How to Publish a Valid BIMI Record

A valid BIMI setup has three layers. Get each one right and the rendering providers (Gmail, Apple Mail, Yahoo, Microsoft) will pick up your logo or check mark automatically.

  1. Tighten DMARC to p=quarantine or stricter first. Every single supporting provider gates BIMI on a passing DMARC check, and every one of them treats p=none as a no-pass. The standard move is p=none for 2–4 weeks while you audit RUA reports, then p=quarantine at pct=10, then pct=100, then p=reject — and only then do you publish BIMI. Worked example for the floor:
    _dmarc.yourdomain.com  TXT
  v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100
  2. Host a square SVG logo at an HTTPS URL you control. The SVG must be a single-path square (TinyPS-style "BIMI-conformant"). HTTPS-only serving, no third-party CDN that strips the Content-Type header, and a stable URL — providers cache it aggressively, so do not point at a URL that will return 404 in six months. The minimum SVG header looks like this (the SVG-Pandoc-style header that BIMI validators expect):
    <svg xmlns="http://www.w3.org/2000/svg" version="1.1" viewBox="0 0 100 100">
  <rect width="100%" height="100%" fill="#ffffff"/>
  <text x="50%" y="55%" text-anchor="middle" font-size="60" fill="#0b3d91" font-family="Helvetica">AC</text>
</svg>
  3. Publish the BIMI TXT record at default._bimi.yourdomain.com. The label default is the spec-mandated selector — providers only look at this exact host. The record must start with v=BIMI1 and point at your SVG. Worked example for self-asserted senders (no VMC):
    default._bimi.yourdomain.com  TXT
  v=BIMI1; l=https://logo.yourdomain.com/bimi/acme.svg; a=https://logo.yourdomain.com/bimi/acme.pem
    The l= tag is the SVG URL (required). The a= tag is the PEM-encoded Assertion of logo-control — required for Microsofts verified check mark and recommended for everyone else. Replace the a= with v= (VMC URL) if you have gone through a Mark Certificate Authority for the 2024+ DMARC ARC certified path. Validate with dig TXT default._bimi.yourdomain.com +short from any external resolver, or run the free BIMI checker.

Common Mistakes

  • Publishing BIMI before tightening DMARC. A monitoring-only p=none policy will not pass at Gmail — your logo will never render. Always run p=none → p=quarantine → p=reject on a known-clean stream before you publish BIMI.
  • Putting the TXT record at the wrong DNS location. It must live at default._bimi.yourdomain.com, not at the apex, not at _bimi.yourdomain.com, and not at a custom selector. Providers only look at the default label.
  • Serving the SVG from HTTP instead of HTTPS. BIMI requires HTTPS. A self-signed certificate is fine; HTTP or a mixed-content HTTPS URL is not. Most providers also require a stable Content-Type and will refuse to render if the URL returns a redirect or a 404 after the initial lookup.
  • Using an SVG that is not square or has embedded raster. The BIMI spec calls for a square SVG with vector content only. Logos that embed PNGs via <image> tags, or that are non-square, will fail validation at most providers and will never render.
  • Skipping the a= assertion on a Microsoft-focused list. Gmail and Yahoo will render BIMI with just l= and a passing DMARC, but Microsoft requires the a= PEM assertion or a VMC URL to show the verified check mark. If your audience includes Outlook.com recipients, add the a= tag.

Related Tools and Guides

FAQ

Frequently asked questions

Next steps

Related resources

Continue with related guidance
Check a sending domain against DNS blocklists

Run a free, point-in-time lookup and review which configured providers report a listing, return a clean result, or are unavailable. No account is required.

Results cover only the configured DNS blocklists that return a usable response. A clean result does not cover every blocklist or establish inbox placement; an unavailable provider remains unchecked.

Open the public domain checker →

Land more email in the inbox by treating BIMI as the brand layer on top of authentication

ReputaPilot monitors your SPF, DKIM, and DMARC configuration continuously and surfaces the engagement signals Postmaster Tools and Microsoft SNDS score — so you know whether your BIMI work is moving the needle on inbox placement.

Run the free BIMI checker →Start monitoring free →See pricing