Email authentication
What is BIMI? Brand Indicators for Message Identification explained
BIMI lets mail clients such as Gmail or Apple Mail show the brand logo next to a message – but only if the domain is strictly protected by DMARC.
How BIMI works
The BIMI record is a TXT record at default._bimi.<domain>. With l= it points to the logo in SVG Tiny PS format (a restricted, secure SVG profile) and optionally with a= to a mark certificate.
DMARC with p=quarantine or p=reject is required. Gmail shows the logo only with a Verified Mark Certificate (VMC, which requires a registered trademark) or a Common Mark Certificate (CMC). Which providers show the logo without a certificate varies.
BIMI does not directly improve deliverability, but it makes messages recognisable and rewards clean authentication. That is why BIMI has a weight of only 1 in the Domain Trust Check.
Example
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"Logo and certificate must be reachable via HTTPS.
Common mistakes
- DMARC is still at p=none – BIMI is then ignored.
- The logo is a regular SVG instead of SVG Tiny PS.
- The logo in the certificate and the logo at l= do not match.
How the Domain Trust Check rates BIMI
Criterion “BIMI” (weight 1 of 5): BIMI record at default._bimi, logo in SVG Tiny PS format, mark certificate (VMC/CMC) and the DMARC quarantine or reject prerequisite.
Standard: BIMI specification of the AuthIndicators Working Group (Internet-Draft)