What is BIMI? Your verified logo in the inbox

BIMI (Brand Indicators for Message Identification) puts your verified logo next to your emails in supporting inboxes. It's the visible payoff of getting email authentication right, and it only works once you're at full DMARC enforcement.

What BIMI shows

In a supporting inbox, BIMI displays your brand's logo as the avatar beside your messages — instead of a generic initial. It's a trust and recognition signal: recipients see at a glance that a message is from the real you.

Why it requires authentication first

BIMI is deliberately the last step. A provider will only show your logo on mail that is provably yours, so BIMI requires your domain to be at DMARC enforcement (most expect p=reject). If you're still at p=none, BIMI does nothing — which is why it's the finishing touch after the rest of the stack is in place.

What you need

  • DMARC at enforcement across the sending domain.
  • A BIMI-compliant logo — a specific SVG profile (SVG Tiny 1.2, Portable/Secure), square, on a solid background.
  • A Verified Mark Certificate (VMC) for most major providers — an approved authority verifies you own the (typically trademarked) logo. It's an annual certificate at real cost.
  • A BIMI DNS record at default._bimi.yourdomain.com pointing to your logo and certificate.

How setup works

  1. Reach DMARC enforcement (the prerequisite that takes the most work).
  2. Produce the logo in the required SVG profile.
  3. Obtain a VMC (this involves trademark verification and lead time).
  4. Publish the BIMI record and confirm display across providers.

Is it worth it?

BIMI won't protect you on its own — it's a visibility and brand-trust layer on top of authentication you've already done. If you're enforced and send meaningful volume to customers, it's a strong finishing move. If you're not enforced yet, your effort belongs there first.

Frequently asked questions

Does BIMI require DMARC?

Yes. BIMI only takes effect when your domain is at DMARC enforcement (p=quarantine or p=reject, with most providers expecting reject). Authentication is the whole point — the logo is a reward for mail that's provably from you.

Do I need a VMC for BIMI?

For most major providers, yes. A Verified Mark Certificate (VMC) is issued by an approved authority after they verify you own the trademarked logo. Gmail and others require it to display the logo; it's an annual certificate with a real cost.

Which inbox providers support BIMI?

Support includes Gmail, Apple Mail (iOS 16+/macOS Ventura+), Yahoo, Fastmail and others, and it continues to grow. Exact display rules vary by provider, and several require a VMC.

BIMI starts with enforcement — check yours

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

Related guides: DMARC p=none vs p=reject: which policy actually protects you? · What is DKIM and how does it work?

← All guides