BIMI Explained: Inbox Logos and Brand Trust

BIMI Explained: Inbox Logos and Brand Trust

When all your email authentication ducks are in a row, mailbox providers may reward you with a "gold star": your company logo appearing next to your messages in the inbox instead of a letter inside a circle. That star is BIMI (Brand Indicators for Message Identification).

What is BIMI

BIMI is, at its core, a DNS TXT record. Like SPF, DKIM, and DMARC, it lives on your sending domain; when configured correctly, Gmail, Apple Mail, Yahoo, and others display the brand logo you designate next to your messages.

In the past, mailbox providers often guessed which avatar to show and sometimes got it wrong. BIMI hands control back to the brand: you supply an official, approved logo for inbox display. That is why many early adopters come from financial services — for messages where "is this really from the company?" matters most, a logo is the clearest visual trust anchor.

The DMARC and BIMI connection

BIMI is not a standalone security protocol; it is built on top of DMARC. To qualify for a BIMI logo, your DMARC policy must be p=quarantine or p=reject with pct=100. A record that still includes sp=none does not qualify.

This points to a real industry gap: although millions of senders use DMARC, according to DMARC.org roughly 66% still run p=none — which means they do not actually qualify for BIMI. Only about 34% of DMARC senders are even eligible for BIMI logos. BIMIRadar, which tracks more than 67 million sending domains, shows just 2.2% of them are considered "BIMI-ready."

Mailbox providers designed BIMI with a "carrot-on-a-stick" approach: brands want inbox logos, and BIMI encourages senders to take DMARC enforcement seriously, which in turn reduces brand spoofing and phishing.

How to set up BIMI

A typical BIMI record looks like this:

default._bimi TXT "v=BIMI1; l=https://your-domain.com/your-logo.svg; a=https://your-domain.com/path-to-vmc/VMC.pem;"

Three prerequisites must be in place:

1. Confirm authentication alignment: SPF and DKIM work correctly, and DMARC policy is quarantine or reject with pct=100.
2. Logo and certificate: The logo must be an SVG file in Tiny 1.2 format, and you need a Verified Mark Certificate (VMC) for a copyrighted logo from DigiCert or Entrust — currently the only two approved issuers.
3. Publish the DNS TXT record: Check for typos and confirm the record points to both the logo file and the VMC file.

High-volume senders with multiple brands can use BIMI selectors to specify different logos for various brands and subdomains, which is handy when transactional and promotional messages come from different domains.

Verifying your setup

After publishing the records, confirm they actually resolve before waiting on inboxes to update:

# Check the BIMI record (the default selector is default)
dig TXT default._bimi.your-domain.com

# Check your DMARC policy meets BIMI's bar (quarantine/reject with pct=100)
dig TXT _dmarc.your-domain.com

# If you use a selector, query it by brand name
dig TXT brand._bimi.your-domain.com

If dig returns nothing, the record has a typo, or it exceeds the single TXT length limit, validate with BIMI's official generator tool before republishing. After the record is live, it typically takes a week or two for logos to start appearing across mailbox providers — do not keep re-editing just because you cannot see it the same day.

Support across mailbox providers

BIMI is not a "publish once, show everywhere" feature — support and presentation vary by provider:

Before configuring, find out which mailbox your audience actually uses and put the budget where coverage is broadest. For most B2B scenarios, Gmail plus Apple Mail coverage is already valuable.

A scenario: multiple brands and domains

Say a SaaS platform runs two product lines, with transactional mail from notify.example.com and promotional mail from marketing.example.com. If both subdomains should show logos, arrange it like this:

• Align SPF/DKIM/DMARC for both subdomains first, with DMARC set to p=quarantine; pct=100 for each;
• Configure an independent BIMI selector per subdomain (for example app._bimi and promo._bimi), each pointing to its own logo and VMC;
• Prioritize deliverability for transactional mail and give promotional mail a logo that matches each brand's look, so inboxes do not show conflicting identities.

This matters most for multi-brand groups: when users see mail from two different "identities" in the same inbox carrying the same logo, trust actually drops.

The real value of a BIMI logo

Technically, BIMI does not make your emails more secure, and it does not directly improve deliverability. But it correlates strongly with both: a BIMI logo is proof that you enforce strong email authentication, which supports a good sender reputation with mailbox providers.

At the brand level, a logo makes your messages stand out in a crowded inbox, raising brand awareness and open rates — Verizon Media's Yahoo Mail trials suggested inbox logos could lift engagement by around 10%. At the trust level, subscribers learn to look for your logo and notice when it is missing, so they know which messages to trust. Gmail also shows a checkmark for BIMI adopters, making it easy to distinguish real brands from impersonators.

16IDC Take

The barrier to BIMI is modest: solid authentication, a copyrighted logo, and one VMC certificate. For e-commerce, SaaS, and cross-border sites, it is a low-cost way to earn an "inbox trust marker." Start by laying the SPF/DKIM/DMARC foundation, then combine it with deliverability optimization and transactional email APIs. See more in the Email Service category.

Reference: BIMI Group specification https://bimigroup.org/ · AuthIndicators Workgroup https://emailauth.org/

Source: https://www.mailgun.com/blog/deliverability/bimi-more-than-funny-name/