Set Up BIMI: Make Your Brand Recognizable in the Inbox

An invoice, appointment confirmation or newsletter arrives alongside plenty of unfamiliar senders. When recipients recognize a brand straight away, it is easier to tell a legitimate message apart from a phishing attempt. BIMI can display a brand indicator next to an email in supported inboxes. It is not, however, a quick logo upload. It is the visible result of dependable email authentication.

Anyone looking to set up BIMI should therefore review their sending paths, domain and brand rights first. This guide explains when the effort makes sense for a business, what the requirements are and how to introduce BIMI in a controlled way.

What BIMI does — and what it does not

BIMI stands for Brand Indicators for Message Identification. The standard lets participating email providers associate a verified brand indicator with a message. The recipient’s mailbox provider ultimately decides whether and how a logo is displayed. Publishing a BIMI record is not a guarantee that every inbox will show it.

The main benefit is sender identity. Recurring transactional and marketing emails are easier to associate with a known organization in the inbox. The project also requires a business to put SPF, DKIM and DMARC in order. That foundation is often more valuable than the logo itself.

BIMI does not replace spam prevention or make an unwelcome newsletter trustworthy. Deliverability still depends on authentication, sending behavior, complaints and technical reputation. The Gmail sender guidelines clearly distinguish these requirements from an optional brand indicator.

Set up BIMI: get these foundations right first

A BIMI project reaches across four areas. If one is missing, a logo in the inbox is usually not the next useful step.

Area	What it covers	Practical question
Sending	All systems send from a controlled sender domain.	Have newsletter, shop, CRM, website forms and invoices been captured?
Authentication	SPF and DKIM pass and align with the visible sender domain.	Which domain actually signs each email?
DMARC	The domain is protected with an enforced policy.	Are p=quarantine or p=reject realistic after a monitoring phase?
Brand	Logo, certificate and rights fit together.	Is the intended brand mark eligible for the chosen certificate?

For a broadly supported setup, the BIMI Group requires SPF, DKIM and DMARC with an enforced policy for the organizational domain and subdomains. A monitoring-only policy using p=none, or a pct value below 100 percent, is not enough. Its implementation guide also explains the requirements for the logo and BIMI DNS record.

Gmail adds an important requirement: Google names a VMC (Verified Mark Certificate) or CMC (Common Mark Certificate) as a prerequisite for BIMI. A standalone hosted SVG is not supported there. Google’s BIMI setup guide covers the file format, certificate and DNS record.

This makes the order of work important. The in-depth guide to setting up DMARC explains how a business first captures known senders and then tightens its policy in stages. The article on SPF records covers the foundation for authorized sending servers.

Certificate, SVG and DNS: the three visible components

A BIMI logo is not an ordinary web SVG. The standard requires SVG Tiny PS; Google also specifies technical details such as absolute pixel dimensions and the tiny-ps profile. A design file often needs to be prepared for BIMI and then validated by the brand or design team. An SVG that looks right on a website is not automatically suitable for BIMI.

Before choosing a certificate, a business should check whether its intended mark is eligible:

Proof	Typical use	Important consideration
VMC	Verified brand indicator with a registered trademark	The logo must meet the issuing authority’s requirements.
CMC	An alternative when no registered trademark is available	Availability and acceptance depend on the issuer and mailbox provider.
No certificate	A self-asserted BIMI record	It may work in isolated cases, but important providers do not have to display it.

A VMC or CMC is not just an IT formality. It ties the domain, organization and logo together through an external verification process. The BIMI Group notes that participating providers can accept certificates differently, while the list of issuers and the rules can change. Before buying a certificate, the issuer, brand owner and email administrator should agree on the exact mark they intend to use.

The business then publishes a TXT record at default._bimi.<domain>. Its basic form looks like this:

v=BIMI1; l=https://assets.example.com/brand/bimi-logo.svg; a=https://assets.example.com/brand/certificate.pem

These URLs show the structure only; they are not a production record to copy. Depending on the certificate, the l value can be empty because the logo and certificate chain are already provided through the PEM file. The precise record, HTTPS availability and certificate chain should be part of a documented test case.

A practical rollout for businesses

This can be managed as a focused infrastructure project. Avoid experimenting with the visible sender domain in the middle of a live campaign.

1. Define goals and sending domains. Decide which business-critical emails should benefit: receipts, customer communication, newsletters or appointment confirmations. Document the From: domain in use and any separate subdomains.
2. Refresh the sender inventory. List every system that creates email for each domain, including website forms, support systems and rarely used recruiting or invoicing services.
3. Test SPF, DKIM and DMARC. For every system, verify that at least SPF or DKIM aligns with the visible sender domain. A strict policy is only realistic once DMARC reports show no unknown legitimate senders.
4. Approve the brand indicator. Establish which logo will be used, who can demonstrate the rights to it and which certificate type is practical. Avoid alternate designs created for a single campaign.
5. Provide files and DNS. Host the logo and certificate files permanently over HTTPS. A second pair of eyes should check the DNS record before publication; one incorrect hostname can prevent validation.
6. Validate externally and test real inboxes. Check DNS resolution, file availability and the certificate chain. Send tests to both supporting and non-supporting providers to confirm that mail still works and to see how the indicator is presented.
7. Define ongoing ownership. Record owners, certificate expiry dates, the location of source files and the procedure for logo, domain or email-service changes.

BIMI becomes reliable only when its email processes are maintained in day-to-day operations. A new CRM or a changing newsletter provider can affect DMARC alignment again. Include the check in the process for new sending tools and domain changes.

Common issues that hold a BIMI project back

Not every missing indicator is a DNS issue. The cause is often upstream of the BIMI record itself:

• The From: domain does not match the domain that SPF or DKIM authenticates successfully.
• DMARC is still in monitoring mode, or a subdomain is covered by a policy that is too weak.
• A newsletter or shop system sends from its own domain rather than the business’s domain.
• The uploaded SVG does not meet SVG Tiny PS requirements or does not match the certificate.
• The certificate file is not publicly reachable, is incomplete or has expired.
• The recipient’s mailbox does not support BIMI or applies its own display rules.

The last point is easy to overlook. BIMI is an interoperability standard, not a contract for uniform presentation. Do not plan around a blanket increase in open rates or measure brand effect by one visible symbol alone. Stable deliverability, clear sender attribution and less uncertainty around important messages are more meaningful goals.

When the effort is worthwhile

BIMI is especially useful when a domain regularly sends customer communications and the brand is already protected or clearly managed. That can apply to retailers, insurers, SaaS providers, education businesses or organizations that send many digital receipts. A company that only sends a few personal emails, or still has disorganized sending paths, should invest in the authentication foundation first.

A website relaunch or an email and newsletter-system change can also be a good time to introduce it. DNS, sender roles and brand assets are often being reorganized then anyway. For larger campaigns, online marketing connects landing pages, consent, tracking and campaign operations; email sender identity should be treated as a technical prerequisite within that work.

Conclusion: brand visibility follows reliable sender identity

BIMI can make a company’s brand visible in supported inboxes. Its greater value is that it requires the business to organize its email landscape: who sends from which domain, how is that sending authenticated, and which mark represents the organization?

Start with SPF, DKIM and DMARC. Once that foundation is stable, move to the BIMI SVG, certificate, hosting and DNS record. That keeps the visible brand indicator from becoming an isolated marketing detail and turns it into a controlled part of digital business communication.