What Is BIMI? How to Show Your Logo in Gmail and Apple Mail

Do your emails still land in the inbox with a gray initial instead of your logo? BIMI is the standard that changes that. In this guide, Talha Aslan and team walk through BIMI setup in the order it actually works: DMARC enforcement, the logo file, the certificate decision, Gmail and Apple Mail requirements, and the mistakes we see most often.

In other words, BIMI is not a design setting. The BIMI Group describes it as a display signal on top of strong authentication. It does not change delivery on its own. Still, it becomes the visible face of a well configured email program. Recipients scanning their inbox recognize your logo in the avatar spot, so a spoofed sender stands out more clearly.

That said, BIMI comes with no guarantee. Logo display always stays at the provider's discretion. So we will not promise that your logo will appear. Instead, we show you how to meet every requirement on your side.

Which conditions must line up before a BIMI logo appears?

Think of BIMI as a chain with four links. If one link breaks, the logo simply does not show, and you usually get no error message. That is why it helps to see all four requirements together first:

1. Authentication: your SPF and DKIM records work, and DMARC passes with alignment.
2. An enforced DMARC policy: the policy is quarantine or reject; a policy of none does not qualify.
3. A compliant logo file: a square SVG that follows the SVG Tiny PS profile.
4. The evidence the provider wants: Gmail and Apple Mail expect a mark certificate such as a VMC or CMC.

On top of that, the recipient's mailbox provider has to support BIMI. For example, your logo may show for a Gmail user and stay hidden for someone on a corporate mail server without BIMI support. That difference is normal, even when your own setup is flawless.

In short, BIMI asks your email infrastructure and your brand assets to be in good shape at the same time. The next sections cover each link in turn.

What email authentication does BIMI need first?

The first step of a BIMI rollout is authentication, not the logo. Google Workspace Admin Help spells out the order: set up SPF or DKIM first, then DMARC. The BIMI Group implementation guide goes further and asks for SPF, DKIM and DMARC that are all aligned. Aligned means the domain in the visible From address matches the domain that passed the check.

If you have not configured these records yet, our guide to setting up SPF, DKIM and DMARC walks through the basics. To check your current records, you can also run our SPF, DKIM and DMARC checker.

Third party senders deserve special attention. If your CRM, ecommerce platform or newsletter tool sends mail for you, it also needs to sign with DKIM using your domain. Otherwise, those messages risk rejection the moment you tighten DMARC. In Gmail, this problem sometimes shows up as the 550 5.7.26 unauthenticated email error.

Why can't your DMARC policy stay at p=none?

BIMI only rewards domains that actually block spoofing. According to Google Workspace Admin Help, the DMARC policy must use quarantine or reject, and BIMI does not support a policy of none. The same page requires a pct value of 100. Applying the policy to only part of your mail is not enough.

The BIMI Group guide adds one more condition: enforcement has to cover the organizational domain and its subdomains. Therefore, you also need to move the subdomain policy (the sp tag) to quarantine or reject.

Should you jump straight from none to reject? We recommend a staged approach instead:

• Start with a policy of none, collect DMARC reports and list every service that sends mail as you.
• Next, fix SPF or DKIM alignment for each of those services.
• Once reports show no failures other than unauthorized sources, move to quarantine.
• After a monitoring period, step up to reject if you want.

This way, you avoid pushing real customer emails into spam just to get a logo. You can always roll back a DMARC change. Even so, patience is the cheapest option.

Reading reports sounds technical, but the goal is simple: see who sends email in your name. When an unknown source appears, ask your team first. It often turns out to be a forgotten form plugin or an old newsletter account. Fixing or shutting down those sources is the most important job before you tighten the policy.

What file format does a BIMI logo need?

A BIMI logo is not just any SVG. It has to follow the SVG Tiny Portable/Secure profile, usually shortened to SVG Tiny PS. Google Workspace Admin Help lists the core rules: the file declares the tiny-ps base profile and version 1.2, and it contains no external references, scripts or animations. Gmail also recommends a centered logo on a solid background and a small file size.

In practice, a standard SVG export from your design software rarely passes as is. It often carries an embedded PNG, a linked font or extra metadata. You need to convert the file to the Tiny PS profile and then test it with the BIMI Group validator.

The bigger question here is a design question: does your logo still read inside a tiny square? A wide wordmark or a thin line emblem often disappears in that space. If your brand never had a square, small size version, it pays to settle that variation through brand identity design work before you start BIMI. That step prevents a second round of design and certificate work later.

How do you design a logo that works in the square inbox avatar?

The BIMI Group reminds senders that the logo has to stay recognizable at roughly 20 to 24 pixels. Most email clients render the avatar as a circle or a rounded square. So your logo lives in a space that may crop its edges.

Example scenario: a furniture brand uses a long wordmark with a small symbol beside it. Squeezed into a square, the word turns illegible. The right fix is not to shrink the word but to create a version that uses only the symbol or a monogram.

Use this checklist when you prepare the square version:

• Does the symbol or monogram represent the brand without any text?
• Does the logo keep a safe margin inside a circular crop?
• Is the background a solid color with enough contrast?
• Do thin lines and small details survive at small sizes?
• Does this version match the registered trademark and the image you will certify?

We cover the broader logic of logo variations in our post on responsive logo variations from favicon to signage. If your mark includes lettering, the small size tests in our guide on how to choose a logo font also help at this stage.

What is the difference between a VMC and a CMC?

A VMC (Verified Mark Certificate) and a CMC (Common Mark Certificate) are digital certificates that confirm your right to use a logo. You get either one from an authorized issuer on the BIMI Group list. The core difference is the legal basis of your logo.

Google Workspace Admin Help recommends a VMC whenever possible for the most secure setup. The BIMI Group also notes that a VMC can earn a logo plus a trust indicator, while a CMC may only earn the logo. Certificate prices and validity periods vary by issuer, so check the current figures on the issuer's official page.

What does the trademark requirement mean for BIMI?

If you want a VMC, your logo has to be a registered trademark in the same form you plan to certify. The critical question is which logo. The certificate issuer compares the image in the trademark record with the image you will publish. A registered word mark does not mean your symbol is registered too.

In the United States, the USPTO trademark basics page explains how federal registration works, including drawings of a mark. Filing fees and timelines change over time, so check the current figures on the official site. If an AI tool helped create your logo, we address the separate registration questions in can you trademark an AI generated logo.

Before you file, it also makes sense to check whether your logo is similar to another trademark. Our trademark search tool offers a quick first look.

Without a registration, you have two paths: start the trademark process and consider a CMC meanwhile, or postpone BIMI until registration is complete. The right choice depends on how long you have used the logo in the same form and which providers your audience uses.

Note: this section is not legal advice; talk to a trademark attorney about registration and certificate eligibility.

How does Gmail display a BIMI logo?

Gmail shows a qualifying sender's logo next to the sender details, both in the message list and inside the open message. According to Google Workspace Admin Help, Gmail requires either a VMC or a CMC for BIMI. Senders verified with a VMC also get a checkmark next to their name.

Keep these Gmail specific details in mind:

• You publish the certificate as a PEM file that combines the entity certificate, any intermediate certificates and the root certificate.
• You host the PEM file at a public HTTPS address.
• The logo has to meet the minimum pixel size listed on Google's help page, defined in absolute pixels rather than relative units.
• After you publish the DNS record, the logo may take some time to appear; check Google's help page for the current estimate.

Treat Google Workspace Admin Help: Set up BIMI as the source of truth for current requirements. The Gmail interface changes over time. That is why we suggest relying on the requirements themselves rather than on screen details.

When does Apple Mail show a BIMI logo?

Apple Mail supports BIMI on iOS 16, iPadOS 16, macOS Ventura 13 and later, and on iCloud.com. However, Apple handles it a bit differently from Gmail. According to Apple's developer support page, the recipient's mail provider manages BIMI compliance on its servers.

So two sides must be ready before your logo shows for an Apple Mail user. On your side, DMARC, the logo and the certificate must all be in place. On the recipient's side, the mail provider must appear on the BIMI Group list, pass Apple's verification and add headers that vouch for its checks. Apple names a VMC as an example of the evidence document it trusts.

As a result, two people using the same Mail app may see different things. One reads an iCloud address; the other connects a provider without BIMI support. That is a provider difference, not a setup error.

Apple also offers a separate feature for businesses called Branded Mail. According to Apple's own guide, it requires your organization to complete verification with Apple and authenticate mail with DKIM. Keep it distinct from BIMI and plan it as its own channel.

Do other mailbox providers require a certificate for BIMI?

No, providers set their own rules. The BIMI Group FAQ for senders explains that each provider decides which certificate types it accepts and whether it needs one at all. For example, Yahoo accepts a self-asserted BIMI record without a certificate. It still requires a quarantine or reject DMARC policy, shows logos on bulk mail and also weighs sender reputation.

Gmail and Apple, on the other hand, require a certificate. So a "publish without a certificate and see" approach can work at Yahoo but will not put your logo in Gmail.

Knowing which providers your audience uses drives this decision. For instance, if most of your recipients use Google Workspace business addresses, a certificate makes sense. If they mostly sit on self hosted corporate servers, the visible effect of the logo may stay limited. Even then, an enforced DMARC policy is valuable on its own for deliverability and spoofing protection.

Check the current support list on the BIMI Group site, because it changes over time.

How do you set up BIMI step by step?

Combining the order from Google Workspace Admin Help and the BIMI Group implementation guide gives you this sequence:

1. List your sending sources. Identify every service that sends mail with your domain.
2. Fix SPF and DKIM. Make sure each service passes with alignment.
3. Move DMARC to enforcement. Set p and sp to quarantine or reject and keep pct at 100.
4. Pick the logo variation. Choose a square image that reads at small sizes and matches your trademark record.
5. Prepare the SVG Tiny PS file. Convert it to the profile and test it in a validator.
6. Get the certificate. Apply for a VMC or CMC with a listed issuer, based on your trademark status.
7. Publish the files. Host the SVG and the PEM file at public HTTPS addresses.
8. Add the BIMI DNS record. Publish the TXT record that points to the logo and the certificate.
9. Test and monitor. Check the record with a validator and send test messages to different providers.

The logic is simple: each step depends on the one before it. For example, buying a certificate before DMARC is ready means paying for a document that sits unused for months.

What does a BIMI DNS record look like, conceptually?

A BIMI record is a TXT record you add to your domain's DNS zone. According to the BIMI Group guide, it lives at a location called default._bimi under your domain. Here, "default" is the selector name; for most brands with a single logo, the default selector is enough.

The record carries three main tags:

• v: the version tag, with the value BIMI1.
• l: the HTTPS address of your SVG Tiny PS logo.
• a: the address of the PEM file that holds your VMC or CMC.

The BIMI Group notes that the a tag is optional in the standard. In practice, though, Gmail and Apple Mail require a certificate, so leaving it empty means no logo in those two clients.

Typing the domain twice, pasting curly quotes or starting an address with http instead of https are the typos we see most often. So always check the record with a BIMI validator after you publish it.

Why might your logo still not show after BIMI setup?

The most frustrating BIMI moment is when you have done everything and the logo still does not show. Narrow it down in this order:

1. DMARC result. Do the headers of a test message show a DMARC pass? Without alignment, BIMI never kicks in.
2. Policy level. Do p, sp and pct meet the standard?
3. Record location. Is the TXT record on the right host, free of typos?
4. File access. Do the SVG and PEM addresses open over HTTPS without a redirect chain?
5. SVG profile. Does the file pass Tiny PS checks in a validator?
6. Certificate match. Is the logo inside the PEM file the same as the SVG you publish?
7. Recipient side. Does the provider you test with support BIMI?

Your overall sender reputation also plays a role, since providers may weigh it before showing a logo. If you have a broader inbox placement problem, our guide on how to improve email deliverability summarizes what to fix before BIMI.

What should you do with BIMI when your logo changes?

A logo refresh creates a chain of tasks for brands that use BIMI. The certificate ties to a specific logo, so you cannot launch a new logo just by swapping the SVG file. When the old certificate and the new image disagree, the logo may stop showing.

Follow this order when the logo changes:

• Check the trademark status of the new logo; with a VMC, the new image may need its own registration.
• Prepare and validate a new SVG Tiny PS file.
• Request a certificate that matches the new image from your issuer.
• Update the SVG and PEM files together, then confirm the addresses in the DNS record.

So if a refresh is on the horizon, put BIMI at the start of the timeline. We explain the broader decision criteria in when do you need a logo redesign. Also remember that certificates expire, so add the renewal date to your calendar even if the logo stays the same.

Does an inbox logo stop phishing emails on its own?

No, a logo is not a shield by itself. The real protection comes from an enforced DMARC policy: receiving servers quarantine or reject messages that spoof your domain and fail authentication. The logo is the visible sign of that protection.

However, scammers often skip your domain and register a lookalike instead. A domain with one swapped letter or an added hyphen can set up its own authentication perfectly well. Getting your logo to show for that domain is much harder, because the certificate issuer asks for proof of rights to the mark.

That is why it helps to tell your customers a few simple things:

• Our official emails always come from the same domain.
• If you get an unexpected payment or password request without our logo, contact us before clicking anything.
• Report suspicious messages with your mail provider's reporting option.

In short, the logo supports your trust message. It does not replace customer education or good security habits.

Which BIMI path fits your situation?

No single path fits every brand. This decision table shows where to focus based on where you stand today:

The table supports a decision; it is not a final verdict. Specialists should have the last word on trademark and certificate eligibility.

Example scenario: how does an ecommerce brand prepare for BIMI?

Example scenario: picture an apparel brand that sends order confirmations, shipping updates and promotional newsletters from its own domain. The brand wants to look more trustworthy in the inbox and protect customers from fake promotions.

A first review finds three sending sources: the business email service, the ecommerce platform and the newsletter tool. The newsletter tool signs with its own domain, so DMARC alignment fails. The team first moves that service's DKIM signature to the brand domain, then watches DMARC reports.

Once the reports look clean, the policy moves to quarantine. Meanwhile, the design team prepares a square symbol variation and compares it with the image in the trademark record. The symbol is registered, so the brand applies for a VMC. When the certificate arrives, the team publishes the SVG and PEM files and finally adds the DNS record.

The real lesson: most of the work is not writing the DNS record. It is cleaning up sending sources and choosing the right logo variation.

Final BIMI checklist before you apply for a certificate

Before you pay for a certificate, you should be able to answer yes to every item below:

• You know every service that sends mail with your domain.
• Each of those services passes SPF or DKIM with alignment.
• Your DMARC policy is enforced on the organizational domain and its subdomains.
• Your logo has a square version that reads at small sizes.
• That version matches your trademark record or your prior use evidence.
• Your SVG Tiny PS file passes a validator.
• You can host files at public HTTPS addresses.
• Someone owns the certificate renewal date.

If any answer is no, fix that first. Then you will not pay for a certificate only to wait on unfinished groundwork.

Where does BIMI fit in your corporate identity?

Many teams treat BIMI as an IT task. In reality, it extends your brand identity into email. That small circle in the inbox is one of the places where people meet your brand most often. Therefore, define the inbox logo in your brand guidelines with the same logic as your favicon and social profile image.

If your identity started in print, our guide on taking a print brand identity digital helps you spot the need for a square variation early.

When your square logo, its fit with the trademark record and your digital usage rules sit in scattered files, corporate identity design support can pull them into one system. As Talha Aslan and team, we build logo variations, color and file rules with technical uses such as BIMI in mind.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.