BIMI

How it works

BIMI (Brand Indicators for Message Identification) is a standard that lets a domain owner publish a logo in DNS and lets mailbox providers display it next to authenticated messages. The record is a TXT entry at default._bimi.<domain> holding two values: l=, an HTTPS URL to an SVG Tiny PS logo, and a=, an HTTPS URL to a PEM-encoded mark certificate. BIMI sits on top of the existing authentication stack rather than replacing it. A receiver checks SPF and DKIM, confirms DMARC passes at an enforcement policy, then fetches and validates the logo and certificate. Only then does anything render.

When it matters

BIMI matters when your brand sends enough mail that a logo in the message list is a real impression, and when impersonation of your domain is a live risk. It also matters as a forcing function: you cannot publish a working BIMI record without first reaching DMARC enforcement, which means inventorying every system that sends as your domain. Coverage in 2026 is Gmail, Apple Mail, Yahoo, and Fastmail. Outlook does not support the standard. See Gmail Blue Checkmark: What BIMI Actually Costs.

Common misconceptions

• "Publishing a BIMI record shows my logo." At Gmail and Apple Mail it does nothing without a VMC or CMC. Yahoo and Fastmail will display a self-asserted logo.
• "BIMI is a security control." It is a display standard. The security comes from the DMARC enforcement it requires.
• "If it validates, it displays." Receivers apply their own reputation gating on top. A perfect record can still render nothing, with no error reported to you.