BIMI: The Next Step to Email Security After DMARC

Once your DMARC policy is fully enforced, there’s another layer of protection and trust you can add to your email program: BIMI.

BIMI, or Brand Indicators for Message Identification, allows organizations to display their official logo next to authenticated messages in supported inboxes like Gmail, Yahoo, and Apple Mail.

It’s both a brand and security enhancement. BIMI helps recipients instantly recognize legitimate emails while proving that your domain is protected by modern authentication standards.

What Is BIMI?

BIMI is a standard that uses DNS records to associate a brand’s logo with authenticated email messages.

When an email passes SPF, DKIM, and DMARC checks, supported mailbox providers retrieve the brand’s logo from its BIMI record and display it beside the message in the inbox.

In other words, BIMI adds a visual layer of trust to technical authentication. It confirms that the sender is genuine and not an impersonator.

Here’s what happens behind the scenes:

1. Your domain publishes a BIMI record in DNS that links to your logo.
2. The receiving mail server confirms the message passes DMARC.
3. If everything aligns, the server displays your logo next to your email.

How BIMI Builds on DMARC

DMARC is the foundation for BIMI. Without DMARC, BIMI can’t function.

To qualify for BIMI, your domain must:

• Have a valid DMARC record.
• Use an enforcement policy (p=quarantine or p=reject).
• Pass SPF or DKIM with domain alignment.

DMARC provides the proof of authenticity. BIMI turns that proof into visible identity.

It’s a natural progression for any organization that already enforces DMARC and wants to strengthen both email security and brand recognition.

For a complete overview and roadmap of DMARC setup and monitoring, see our DMARC monitoring and compliance guide.

Benefits of BIMI

BIMI offers more than just a visual touch. It creates confidence in every message you send.

1. Improves Brand Recognition

Your logo appears directly in inboxes, making your emails stand out and easier to identify.

2. Builds User Trust

Recipients can immediately tell that a message is legitimate, reducing confusion and phishing risk.

3. Reinforces Your DMARC Investment

Because BIMI only works when DMARC is enforced, it rewards proper implementation with a clear, visible benefit.

4. Strengthens Deliverability Signals

Consistent authentication and verified identity improve how mailbox providers evaluate your domain reputation, thus increasing your email deliverability.

How to Set Up BIMI

Once you’ve reached full DMARC enforcement, setting up BIMI involves only a few extra steps. If you're not a developer, you'll need assistance from the developer(s) in charge of managing your DNS.

1. Confirm Your DMARC Policy

BIMI requires a DMARC record with p=quarantine or p=reject.
Example:

2. Prepare Your Logo

BIMI requires a specific image format: SVG Tiny Portable/Secure (SVG P/S).

• Use your official, trademarked logo.
• Make sure it’s square with a solid (non-transparent) background.
• Host it securely over HTTPS, for example:
  https://yourdomain.com/bimi/logo.svg

3. Obtain a Verified Mark Certificate (VMC)

Some providers (including Gmail) require a Verified Mark Certificate (VMC) to verify that your logo is registered and trademarked. Trusted VMC issuers include:

• DigiCert
• Entrust

This certificate proves ownership of your logo and links it to your domain identity.

4. Publish Your BIMI Record in Your DNS

Add a TXT record to your DNS under:

With the value:

• l= URL of your logo file
• a= URL of your VMC certificate

If you don’t have a VMC yet, you can omit the “a=” tag, but your logo will only display in providers that allow unverified BIMI.

5. Test and Verify

Use a BIMI validator or lookup tool to ensure your record, logo, and DMARC setup are correct. Recommended tools:

• BIMI Group Validator
• MxToolbox BIMI Lookup

Supported Providers

BIMI support is growing rapidly. As of now, these providers display verified BIMI logos:

• Gmail
• Yahoo Mail
• Apple Mail (macOS Ventura and iOS 16+)
• Fastmail
• Cloudmark

Even where logos don’t appear yet, having BIMI implemented signals that your domain meets modern security standards.

Common BIMI Setup Mistakes

Many organizations struggle with BIMI because of small technical errors. Check for these before going live:

• Transparent or non-square logo files.

• Incorrect file type (must be SVG Tiny P/S).

• DMARC still in monitoring mode (p=none).

• Missing HTTPS links in your DNS record.

• Invalid or expired VMC.

Testing your record before rollout prevents these issues and speeds up logo approval.

How DMARCeye Helps You Prepare for BIMI

BIMI only works if your DMARC setup is consistent and fully enforced. If your DMARC record or authentication sources are misaligned, your logo will not display, even if everything else is configured correctly.

That’s where DMARCeye makes the process easier. DMARCeye continuously monitors your DMARC performance and reports on:

• Which mail sources pass or fail authentication.
• Whether your domain alignment meets BIMI requirements.
• The progress of your policy enforcement across all sending systems.

Once your reports show that everything is authenticating properly, you can confidently move to BIMI knowing your email ecosystem is verified, stable, and compliant.

BIMI is the visual proof of DMARC done right, and DMARCeye helps you get there.

Get a free trial of DMARCeye today and start protecting your email domain.