BIMI Records: Getting Your Logo Into the Inbox After DMARC

SPF, DKIM, and DMARC all work toward the same goal: proving a message actually came from who it claims to. BIMI is what turns that proof into something a recipient actually sees. Get it configured correctly, and your logo shows up next to your messages in a supporting inbox. Get any of its several prerequisites wrong, and it just doesn't appear, with no error message telling you why.

What a BIMI record publishes

BIMI (Brand Indicators for Message Identification) lives at a fixed location, similar to how DMARC always lives at _dmarc:

default._bimi.example.com.    TXT    "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

v=BIMI1 is the version tag. l= points at the logo itself. a= points at a certificate authenticating that logo, covered below, and can be omitted for providers that don't require one.

The DMARC prerequisite

A BIMI record with everything else configured correctly still won't display anywhere unless DMARC is at enforcement, p=quarantine or p=reject, not p=none. This isn't an arbitrary gate: BIMI is a reward for a domain that's already proven it's actively rejecting or quarantining mail that fails authentication, not something available to a domain that's merely collecting DMARC reports without acting on them yet. A domain still working through the DMARC rollout path from none to reject won't see a logo until it actually gets there.

The logo requirements

The logo has to be an SVG in the Tiny PS profile specifically, a constrained subset of SVG, not just any SVG file exported from a design tool, and it has to be served over HTTPS. Most everyday SVGs use features outside that profile and need to be specifically validated or re-exported before they'll be accepted.

The certificate wrinkle: VMC and CMC

This is the part that surprises people. Several major providers won't display a BIMI logo at all without a certificate proving the domain owner actually controls that logo, similar in spirit to a TLS certificate but for a trademark rather than a domain.

A VMC (Verified Mark Certificate) requires a registered trademark and typically costs somewhere in the $900 to $1,700 per year range, depending on the issuing authority. A CMC (Common Mark Certificate) is a newer, cheaper alternative, roughly $100 to $950 per year, for logos in active use that aren't a registered trademark.

Who actually requires what

Support isn't uniform, which matters when deciding whether the certificate cost is worth it. Gmail and Apple Mail require a VMC or CMC before they'll display a logo at all. Yahoo, Fastmail, and some other providers accept a self-asserted BIMI record with no certificate whatsoever. That means the exact same BIMI setup can display cleanly in one inbox and not appear at all in another, depending entirely on which certificate, if any, backs it.

Checking a domain's BIMI record

dig TXT default._bimi.example.com

An empty response means no BIMI record exists yet, or that DMARC enforcement isn't in place, which is worth ruling out first since it's the more common blocker than the record itself being misconfigured.

How DNS monitoring fits in

A BIMI TXT record is easy to overlook once it's working, since nothing about it changes on a routine basis the way an _acme-challenge record does. OneDollarDNS monitors it alongside every other TXT record, so a change or removal, whether from a logo update or a migration that dropped it, shows up as an alert. What monitoring won't catch is a VMC or CMC quietly expiring: the DNS record stays exactly the same, but the logo can stop displaying in provider inboxes that require a valid certificate, a failure mode that lives entirely outside DNS and needs its own separate tracking.