BIMI — Brand Indicators for Message Identification

BIMI is the visible payoff at the top of the email authentication pyramid. The foundation is SPF + DKIM + DMARC at enforcement; BIMI is what your customer sees when all of that is working correctly. It's also the primary business-side justification many organizations use for the engineering investment in proper email authentication that should already exist — putting a logo in the inbox is a tangible deliverable that marketing teams understand even when SPF alignment is abstract.

Most published BIMI material falls into one of two categories: vendor pages from certificate authorities promoting their VMC products, or surface-level "what is BIMI" guides that skip the operational reality. This entry synthesizes the current 2026 state — VMC vs CMC tradeoffs, real CA pricing across all five authorized issuers, the 53.6% real-world failure rate from URIports analysis, the SVG Tiny PS spec with explicit forbidden elements, mailbox provider compatibility matrix, and how BIMI fits with the rest of the auth stack.

Why BIMI matters: the engagement numbers

Industry research consistently shows measurable engagement uplift from BIMI implementations. The numbers from Validity research and TalkTalk's public case study:

Three implementation tiers: self-asserted vs CMC vs VMC

BIMI exists at three levels of trust, each with different prerequisites, costs, and provider support. The strategic decision is which tier matches your organization's brand investment and audience profile:

Mailbox provider compatibility matrix

BIMI support varies dramatically by mailbox provider — both in terms of which certificate types are accepted and what visual treatment is given. The current state as of early 2026:

Prerequisites: what you need before BIMI works

Six requirements that must all be met for BIMI to display. Missing any single requirement and the logo silently won't appear:

1. DMARC enforcement on the organizational domain — policy must be p=quarantine or p=reject, NOT p=none. The pct=100 attribute is implicit if not specified. Most providers require the domain to be at enforcement for at least 30 consecutive days before they pull and display your BIMI logo.
2. DMARC enforcement on the sending domain (if different from organizational). E.g., DMARC enforced on example.com AND on mail.example.com if mail goes from the subdomain.
3. Working SPF and DKIM with alignment — DMARC requires either SPF-aligned or DKIM-aligned authentication to pass. Both passing without alignment is not sufficient. See the DMARC entry for alignment mechanics.
4. SVG Tiny PS logo file hosted via HTTPS — must conform to the SVG Tiny 1.2 Portable/Secure profile (covered next section).
5. BIMI DNS TXT record at default._bimi.<your-domain> containing v=BIMI1, l=<https-logo-url>, and (for VMC/CMC) a=<https-certificate-url>.
6. For VMC/CMC: a valid certificate from one of five authorized CAs (DigiCert, Entrust, Sectigo, GlobalSign, SSL.com), in PEM format, hosted via HTTPS.

The first three prerequisites are typically the longest-leading-time work — bringing a domain from p=none to enforcement requires monitoring DMARC aggregate reports, identifying and fixing legitimate-but-unauthenticated senders, and progressively tightening policy. Expect 6-8 weeks for a typical organization with mature email infrastructure, longer for organizations with legacy senders that need consolidation.

The BIMI DNS record syntax

BIMI is published as a DNS TXT record at a specific subdomain. The full syntax for VMC/CMC implementations:

# BIMI DNS TXT record — VMC or CMC implementation
default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://www.example.com/logo.svg; a=https://www.example.com/cert.pem"

# BIMI DNS TXT record — self-asserted (no certificate, omit a=)
default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://www.example.com/logo.svg"

# BIMI opt-out (publish empty record to override organizational policy)
default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=; a="

The three parameters:

• v=BIMI1 — declares the BIMI protocol version. Only valid value is BIMI1. Required and must come first.
• l=<url> — (lowercase L) HTTPS URL of your SVG Tiny PS logo file. Required for visible logo. Empty (l=) for explicit opt-out.
• a=<url> — HTTPS URL of your VMC or CMC PEM-encoded certificate file. Required for Gmail and Apple Mail; optional for Yahoo (which accepts self-asserted).

The selector default applies to all messages from the domain. You can use other selectors (sales._bimi, marketing._bimi) by adding a BIMI-Selector header in the message itself, but most deployments use only default. ISPs cache BIMI records aggressively (3-7 days), so allow a few days for visible changes after publishing.

The SVG Tiny PS specification

BIMI doesn't accept just any SVG. The format must be the SVG Tiny Portable/Secure (SVG Tiny PS) profile — a strict subset of SVG Tiny 1.2 with additional security restrictions. This is where 80% of implementations stall. The complete spec:

For VMC submissions specifically, the SVG must exactly match what's filed at the trademark office — same colors, same proportions, no extra text elements. Color shade variations or minor design tweaks lead to rejection. This is one of the leading causes of VMC application delays per SSL.com's documentation.

Certificate Authority comparison

Five authorized certificate authorities issue BIMI certificates as of early 2026. They all follow the same BIMI Working Group requirements, so the validation process is nearly identical — what differs is pricing, timeline, and customer support quality. Real 2026 pricing data:

The choice between CAs is rarely about technical differences — all five validate to the same BIMI Working Group spec. Differentiators: Sectigo for budget-conscious SMBs; DigiCert and Entrust for enterprise relationships and integration with deliverability platforms (Red Sift OnDMARC, Valimail); GlobalSign for organizations with existing GlobalSign PKI investments. Pricing reflects market positioning rather than product differentiation.

Why 53.6% of BIMI implementations fail

Per a 2025 URIports analysis, more than half of domains attempting to display their logo in the inbox fail validation. The failure modes, in order of frequency:

The 53.6% failure rate is why managed BIMI services exist — the technical surface area is real and the operational tax is non-trivial. Red Sift, Valimail, PowerDMARC, and EasyDMARC all offer integrated DMARC + BIMI workflows that handle these failure modes systematically. For organizations attempting BIMI without that tooling, plan for 2-3 deployment iterations before reaching consistent display.

How BIMI fits with the rest of the auth stack

BIMI sits at the top of the email authentication pyramid. The foundation layers all need to be working before BIMI can do anything visible:

• SPF — authenticates the envelope MAIL FROM domain (RFC 7208). One of two paths DMARC alignment can take.
• DKIM — cryptographic signature on selected message headers (RFC 6376). The other path DMARC alignment can take.
• DMARC — alignment policy connecting envelope identifiers to From: header (RFC 7489). Must be at enforcement (p=quarantine or p=reject) for BIMI.
• BIMI — the visible signal that DMARC enforcement is working. The payoff layer.

Transport-layer authentication (MTA-STS, DANE, TLS-RPT) isn't a BIMI prerequisite but reflects the same authentication-and-trust posture that BIMI rewards. Organizations with mature MTA-STS + DANE deployments typically also have BIMI-ready DMARC. The reverse isn't always true — some organizations adopt BIMI before completing the transport security work.

BIMI in Cloud Server for Email infrastructure

Our managed email infrastructure handles BIMI as the final layer in a full email authentication deployment:

• DMARC enforcement journey for clients starting from p=none — DMARC aggregate report monitoring, identification of legitimate unauthenticated senders, progressive policy tightening (none → quarantine → reject) over 6-8 weeks. BIMI prerequisites met before any logo work begins.
• SVG Tiny PS conversion and validation — converting Adobe Illustrator exports to compliant SVG Tiny PS, removing forbidden elements, validating against BIMI Working Group spec before submission. Most common workflow: client provides existing vector logo, we deliver compliant .svg + hosting.
• VMC and CMC certificate procurement through partner CAs (DigiCert, Sectigo, Entrust) with vendor selection based on client's trademark status, budget, and timeline preferences. End-to-end coordination of trademark validation, organization validation, and DNS deployment.
• BIMI DNS record publication and validation — TXT record creation at default._bimi, HTTPS hosting of SVG and PEM files on infrastructure we control, post-publication validation across Gmail, Apple Mail, Yahoo to confirm logo display.
• Multi-domain BIMI strategies — organizational domain plus marketing subdomains, each with appropriate DMARC enforcement. Common pattern for enterprises with separate sending domains for transactional vs marketing vs corporate email.
• Brand refresh coordination — when a logo changes, the VMC must be reissued and DNS record updated. We handle the SVG re-conversion, certificate replacement, and parallel-run validation to avoid display gaps.

For clients with PowerMTA-based outbound infrastructure, BIMI integrates cleanly because the underlying DMARC enforcement is typically already in place — most ESP-grade infrastructure has DMARC at p=quarantine or p=reject by default. The bottleneck is usually trademark + SVG conversion rather than authentication work.

Related glossary concepts

• DMARC — the prerequisite that BIMI builds on. Must be at enforcement (p=quarantine or p=reject) for BIMI to work.
• SPF — one of two paths to DMARC alignment, which is the BIMI prerequisite.
• DKIM — the other path to DMARC alignment. Most BIMI-compliant senders rely on DKIM alignment for ESP-sent mail.
• MTA-STS — transport-layer auth that complements BIMI's content-layer auth.
• TLS-RPT — reporting layer for transport-layer auth, parallel to DMARC's reporting for content-layer auth.
• DANE — DNSSEC-anchored TLS validation. Same authentication-and-trust posture as BIMI but at the transport layer.
• Sender Reputation — even with BIMI configured, mailbox providers won't display the logo on mail flagged as spam. Reputation matters.

Frequently asked questions

Last updated: May 2026 · Sources: BIMI Group official, CMC announcement, Google BIMI documentation, Red Sift BIMI 2026 guide, CaptainDNS VMC/CMC comparison, Validity BIMI guide, SSL.com VMC requirements, URIports 2025 BIMI failure analysis.