In some inboxes a round company logo appears next to the sender name, instead of the grey circle with an initial. That is BIMI — Brand Indicators for Message Identification. It looks like a small matter of appearance, and in a sense it is. What is interesting is not the logo but the chain of prerequisites in front of it.
What BIMI technically is
A DNS record, nothing more. It points at an image file and optionally at a certificate:
default._bimi.company.com. TXT "v=BIMI1; l=https://company.com/logo.svg; a=https://company.com/vmc.pem"The l= names the logo, the a= the certificate confirming you are entitled to use it. The receiving provider fetches both and displays the image — if everything upstream is in order. And there is a fair amount upstream.
Step one is the real hurdle
BIMI requires an enforced DMARC policy: p=quarantine or p=reject, and for the whole of the traffic, meaning pct=100. A p=none is not enough, not even "for the time being".
That is where most attempts come to a halt, and it is why BIMI is not really a design project. Anyone still on p=none usually has sending sources without alignment left in the estate — the newsletter service, the ticket system, the invoicing software. Configuring all of those is the work. The logo afterwards is an hour.
Steps two and three: the logo is fussy
An arbitrary SVG will not do. What is required is a narrow profile, SVG Portable/Secure, built on SVG Tiny 1.2. What has to be absent:
- no scripts, no animation, no external references,
- no embedded raster images,
- a
titleelement carrying the brand name is mandatory, - a
viewBoxwith a square aspect ratio, because the display fits the image into a circle or a square.
The last point costs the most time in practice. A wordmark at a 4:1 ratio becomes an illegible smear inside a circle. BIMI almost always needs a purpose-built square variant — usually the symbol without the lettering.
Step five: the certificate and its price
For Gmail and Apple Mail to display the logo, the DNS record is not enough. A Verified Mark Certificate is required, issued by one of the few authorities approved for it. It attests that the mark is yours.
The precondition is a registered trademark at a recognised office, and the logo in the certificate must match the registered mark. Without trademark rights this step cannot be passed — and a trademark application takes many months depending on the office.
Costs run from several hundred to over a thousand euros a year for the certificate, trademark registration not included. For a small picture in an inbox that is a lot. For an organisation that already maintains a registered trademark and has DMARC enforced, it is a modest additional line item.
Who displays it at all
| Provider | Certificate required |
|---|---|
| Gmail | yes |
| Apple Mail | yes |
| Yahoo | yes |
| Fastmail | no, DMARC enforcement is enough |
| Most desktop mail programs | do not show it at all |
The last row puts the arithmetic in perspective. A recipient using Thunderbird or desktop Outlook sees nothing of the whole exercise.
What BIMI is not
It is not a security signal for the reader. The logo means: this message passed DMARC and the sender paid for a certificate. It does not mean the content is harmless. A taken-over domain keeps sending with valid DMARC — and therefore keeps sending with a logo.
The second and more uncomfortable point: readers learn visual rules quickly. Anyone who gets into the habit of thinking "logo means genuine" has trained themselves on a marker an attacker can also satisfy, with their own similar-sounding domain and their own trademark. The markers that actually reveal a forged message are different ones — and none of them is a picture.
Is it worth it?
As a goal: rarely. As a by-product: quite possibly. Anyone taking DMARC through to enforcement anyway — and every domain that sends invoices should — gets BIMI for the price of a certificate on top. Conversely, BIMI is an expensive detour to a result you can have directly: a domain no stranger can send under.
The best argument for BIMI is therefore often an internal one. It is the first visible result of a project that otherwise consists entirely of DNS records — and that makes it easier to get the work on the earlier steps approved in the first place.