How BIMI gets a brand logo into the inbox, and what Gmail requires first

Brand Indicators for Message Identification, or BIMI, lets a sender's logo appear next to its email in supporting inboxes. It is a display feature, and it sits on top of authentication that a sender already has to get right.

For a team about to spend on email, the useful questions are what the requirements are, which certificate fits the brand, and what the logo does and does not change. The details below come from Google's Workspace documentation, the BIMI Group's implementation guide and DigiCert's certificate documentation.

What BIMI is and where it sits in the stack

BIMI is a DNS-based standard. A sender publishes a TXT record at default._bimi.[domain] in the form "v=BIMI1; l=[SVG URL]; a=[PEM URL]". The l= tag points to the logo file. The a= tag points to a certificate file and is reserved for Verified Mark Certificates and Common Mark Certificates, according to the BIMI Group.

The record does nothing alone. The BIMI Group says to authenticate all of the organization's email with SPF, DKIM and DMARC, and to align all three. Authentication is Step 1 in the BIMI Group's guide.

The BIMI Group also notes that a self-asserted record, with no certificate, has limited support across mailbox providers. Google goes further for Gmail: its documentation says a standalone SVG is not supported and that BIMI requires third-party certification.

The DMARC condition requires full enforcement

Both Google and the BIMI Group require DMARC enforcement. The policy must be quarantine or reject. A policy of none does not qualify.

The percentage tag matters too. Google states that pct must be 100, and the BIMI Group says a pct value below 100 is not accepted. The BIMI Group adds that enforcement must cover the organizational domain and its subdomains, written as p=quarantine; sp=quarantine or p=reject; sp=reject.

A sender that has published DMARC at none for monitoring, or that is ramping enforcement in stages, therefore does not yet meet the condition. The monitoring stage has to finish before BIMI can work.

VMC or CMC: which certificate a brand can get

Gmail needs a certificate from a third-party Mark Verifying Authority. Google recommends a Verified Mark Certificate, or VMC, and also accepts a Common Mark Certificate, or CMC.

A VMC validates ownership of a logo based on a registered trademark. Google's documentation says the trademark must be registered with an intellectual property office that VMC issuers recognize. It says the trademark process can take 6 to 12 months.

A CMC is the route for logos without that registration. DigiCert lists two eligible logo types: a Prior Use Mark and a Modified Registered Trademark. For a Prior Use Mark, the logo must have been used for at least 12 months before the verification date, on a domain the applicant controls. DigiCert says it can verify that use through Archive.org.

The BIMI Group says CMCs allow some flexibility in displaying logos, such as seasonal colour changes or stacked words instead of a single line, though some limitations apply.

What the logo file and hosting must look like

The logo must be an SVG in the Tiny PS profile, with baseProfile "tiny-ps" and version 1.2. Google says the file must not contain external links, scripts, animations, or x and y attributes on the root svg element. DigiCert notes that most image editors do not support this profile, so a conversion tool or manual editing is often needed.

Google sets a minimum of 96 × 96 pixels, with dimensions in absolute pixels rather than percentages. It recommends centring the logo in a square on a solid background, keeping the file at 32 KB or smaller, and including a desc element.

Gmail supports BIMI only with PEM files. The PEM embeds the SVG logo and the VMC or CMC, with any intermediate and root certificates appended in order. The server hosting the files must use HTTPS, and Google recommends TLS 1.2 or later.

Once the TXT record is published, Google says the logo can take up to 48 hours to appear in recipients' mailboxes.

A sender that has published DMARC at none for monitoring, or that is ramping enforcement in stages, therefore does not yet meet the condition.

What the checkmark adds, and where it shows

Gmail shows a checkmark beside senders verified with a VMC. A CMC displays the logo without it, according to DigiCert's documentation.

Google says the checkmark does not appear in non-Gmail web apps. DigiCert's page says the blue checkmark is currently only available on webmail, and that Google will expand it to mobile Gmail on iOS and Android.

The BIMI Group says future BIMI programs may require certificates and that the steps may change. Senders relying on a self-asserted record face limited support across mailbox providers, according to the BIMI Group.

What to change first

Start with DMARC. If the policy is still none or pct is under 100, moving to quarantine or reject at full coverage is the gating step, and it also applies to subdomains.

Next, decide the certificate by trademark status. A registered mark points to a VMC and the checkmark. An unregistered logo with 12 months of use on the sender's own domain points to a CMC. A brand with neither has to wait for a trademark or accumulate the prior-use history.

Last, build the Tiny PS logo and the PEM file, host both over HTTPS, and publish the record.