BIMI Logo: The Complete Setup Guide for 2026
You've got SPF, DKIM, and DMARC configured. Your emails authenticate cleanly. But your brand still shows up as a grey silhouette in the inbox - right next to a competitor whose logo pops in full color. That's the gap, and closing it is more straightforward than most guides make it sound.
What You Need (Quick Version)
Three paths, depending on budget and ambition:
- Free path (self-asserted): DMARC at enforcement + SVG P/S (Tiny-PS) logo + DNS TXT record. Works on Yahoo, Fastmail, and LaPoste. No certificate needed.
- Budget path (CMC): Everything above + a [Common Mark Certificate](https://docs.digicert.com/en/certcentral/manage-certificates/verified-mark-certificates - vmc-/common-mark-certificate - cmc-.html) at roughly $100-$950/year. Covers prior-use marks and modified registered marks. Works on most BIMI-supporting providers.
- Full path (VMC): Everything above + a Verified Mark Certificate at roughly $900-$1,700/year. Requires a registered trademark. Gets you Gmail's blue "authenticated" checkmark.
Pick the path that matches your trademark status and budget.
What Is BIMI?
BIMI stands for Brand Indicators for Message Identification. It's an email standard that lets your brand logo appear next to your messages in the recipient's inbox - a verified avatar for your sending domain.
The mechanics are simple. When your email arrives, the mailbox provider checks whether it passes DMARC authentication. If it does, the provider looks up a DNS TXT record at default._bimi.yourdomain.com, fetches the SVG logo file hosted at the URL in that record, and displays it alongside your message. No DMARC pass, no logo. The authentication chain is non-negotiable.
Does a BIMI Logo Boost Open Rates?
Yes, and the numbers aren't subtle. Blockworks saw opens jump from 20.7% to 52.1% within weeks of implementing a DigiCert CMC. Haypp reported a 10% lift in opens with a VMC. Yahoo's original BIMI pilot measured a 10% engagement increase across participating senders.
Red Sift and Entrust data pushes even further - up to 39% open-rate increase and 34% higher purchase likelihood for BIMI-enabled senders. Are these cherry-picked case studies? Probably. But even the conservative end of the range - a 10% lift - pays for a VMC certificate many times over if you're sending at any real volume.
The Reddit sentiment on BIMI is more skeptical. Practitioners on r/email and r/DMARC regularly call VMC pricing a "money grabbing scheme" and question whether the ROI is real. Here's the thing: the skeptics are usually comparing the certificate cost against deliverability improvements, which misses the point entirely. BIMI is a branding play, not a deliverability play. The deliverability improvement comes from the DMARC enforcement you need anyway.
Which Providers Support BIMI in 2026?
Per the BIMI Group's infographic:
| Provider | BIMI Support | Certificate Required? |
|---|---|---|
| Gmail | ✅ Yes | VMC for blue checkmark |
| Apple Mail | ✅ Yes | Varies by provider policy |
| Yahoo / AOL | ✅ Yes | No (self-asserted OK) |
| Fastmail | ✅ Yes | No (self-asserted OK) |
| LaPoste | ✅ Yes | No (self-asserted OK) |
| Microsoft Outlook | ❌ No | N/A |
The fact that Microsoft still doesn't display brand indicators is genuinely frustrating. Outlook is the dominant inbox in enterprise B2B, and its absence means BIMI's impact skews heavily toward consumer and SMB audiences. If your recipients are mostly on Outlook, temper your expectations.
Let's be honest: most B2B teams agonize over BIMI when their recipient base is 70%+ Outlook. If that's you, skip the VMC and spend the $1,500 on better outbound data instead. BIMI matters most when Gmail and Yahoo dominate your recipient mix.
BIMI Prerequisites
Before you touch a DNS record or buy a certificate, lock down four things:
- SPF configured and passing for all sending sources (use these SPF patterns to avoid syntax mistakes)
- DKIM signing active on every outbound mail stream (here’s how to verify DKIM is working)
- DMARC at
p=quarantineorp=rejectwithpct=100- anything less and major BIMI providers won't display your logo (more on DMARC alignment) - Clean sender reputation - low bounce rates, minimal spam complaints, consistent sending patterns (see how to improve sender reputation)
DMARC enforcement is where most teams stall. Moving from p=none to p=reject requires confidence that every legitimate sending source is authenticated, and that confidence only comes from clean data flowing through clean infrastructure.
We've seen teams stuck at the DMARC enforcement step for months because their outbound lists were bouncing 15-20%. High bounce rates from bad contact data damage sender reputation, which undermines DMARC pass rates and prevents your inbox logo from displaying. Prospeo's 98% email accuracy and 7-day refresh cycle keep bounce rates under control so the email auth setup works as intended - fix the data quality and the authentication problems tend to resolve themselves. (If you want benchmarks and fixes, start with email bounce rate.)
BIMI only works when DMARC passes - and DMARC only passes consistently when your bounce rates stay low. Teams stuck at 15-20% bounces never reach enforcement. Prospeo's 98% email accuracy and 7-day data refresh cycle keep bounces under control so your authentication stack actually works.
Clean data is the foundation your BIMI logo stands on.
VMC vs CMC vs Self-Asserted
| Feature | Self-Asserted | CMC | VMC |
|---|---|---|---|
| Annual cost | Free | ~$100-$950 | ~$900-$1,700 |
| Trademark needed? | No | No (prior-use OK) | Yes (registered) |
| Gmail blue check? | No | No | Yes |
| Supported providers | Yahoo, Fastmail, LaPoste | Most BIMI providers | All BIMI providers |
The CMC is the most underrated option in the ecosystem. If you don't have a registered trademark - or your trademark is pending - a Common Mark Certificate lets you display your logo on most BIMI-supporting providers at a fraction of the VMC cost. It covers Prior Use Marks and Modified Registered Marks, so most established businesses qualify even without formal registration.
For Gmail's blue checkmark specifically, you need the VMC and a registered trademark. For everyone else, the CMC path gets you 80% of the value at 30-60% of the cost.
The self-asserted path is free and works on Yahoo, Fastmail, and LaPoste - a solid starting point before committing to a certificate. If your audience is primarily on those providers, you don't need to spend a dime.
Certificate Pricing
| Certificate | DigiCert Official | Reseller Range | Typical Market |
|---|---|---|---|
| VMC | $1,416/yr | $780-$1,200/yr | $900-$1,700/yr |
| CMC | $950/yr | $650-$950/yr | $100-$950/yr |
| Self-Asserted | Free | Free | Free |
Multi-year terms from resellers reduce the effective annual cost. DigiCert and Sectigo are the primary issuers. Once DMARC is at enforcement and documentation is verified, DigiCert can usually issue the certificate within the same day.
Don't forget the hidden costs: trademark registration at $250-$400+ per class if you don't already have one, DMARC monitoring tools running $50-$500/month depending on complexity, SVG design and conversion time, and annual certificate renewal. One detail that catches multi-brand companies off guard - you need one certificate per unique logo and per unique base domain. The certificate itself is often the smallest line item in the total budget.
SVG Requirements for BIMI
This is where 80% of implementations stall. Your logo must be in SVG Portable/Secure format, also called SVG Tiny-PS - a stricter subset of SVG Tiny 1.2 that strips out anything interactive or dynamic.
The requirements are specific and unforgiving:
baseProfile="tiny-ps"andversion="1.2"on the root `
Watch out for Adobe Illustrator's export quirk: it frequently adds `x="0px"` and `y="0px"` attributes to the root `<svg>` element when exporting SVG Tiny 1.2. These must be manually removed or your logo will fail validation. In our experience, the SVG conversion step consistently takes longer than teams expect - budget an afternoon, not 20 minutes.
## How to Create and Publish Your Logo
**Step 1:** Export your logo as SVG Tiny 1.2 from Adobe Illustrator (File > Export > SVG, then select "SVG Tiny 1.2" as the profile). If you're using free tools, Inkscape's Trace Bitmap function converts raster logos to vector.
<figure class="article-image my-8" itemscope itemtype="https://schema.org/ImageObject"><meta itemprop="name" content="Seven-step BIMI logo setup process flow" /><img src="https://static.prospeo.io/directory-assets/images/new_images/bimi-logo/bimi-logo-setup-seven-step-flow.png" alt="Seven-step BIMI logo setup process flow" loading="lazy" decoding="async" class="w-full rounded-lg shadow-sm" style="max-height:500px;width:auto;display:block;margin:0 auto;cursor:zoom-in;" itemprop="contentUrl image" /><figcaption class="mt-3 text-sm text-gray-500 text-center" itemprop="description caption">Seven-step BIMI logo setup process flow</figcaption></figure>
**Step 2:** Open the SVG source in a text editor. Remove any `x=` and `y=` attributes from the root `<svg>` element. Confirm `baseProfile="tiny-ps"` and `version="1.2"` are present.
**Step 3:** Run the file through [SVGO](https://github.com/svg/svgo) to strip metadata, comments, and unnecessary attributes.
**Step 4:** Validate with the [BIMI Group's SVG checker](https://bimigroup.org/bimi-generator/). Fix any errors before proceeding. The BIMI Group also offers a record generator tool that builds the DNS TXT record for you.
**Step 5:** Host the validated SVG at a stable HTTPS URL. Don't put it behind authentication or a CDN that blocks automated fetches.
**Step 6:** Publish a DNS TXT record at `default._bimi.yourdomain.com`:
v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/cert.pem;
For self-asserted BIMI, leave the `a=` value empty or omit it entirely.
**Step 7:** Wait up to 48 hours for DNS propagation. Mailbox providers cache aggressively, so give it a few days before panicking. (If you’re sending at scale, also watch [email velocity](/s/email-velocity) so reputation doesn’t lag your rollout.)
## Troubleshooting: Logo Not Showing?
Start with this six-point diagnostic, adapted from Valimail's troubleshooting guide:
<figure class="article-image my-8" itemscope itemtype="https://schema.org/ImageObject"><meta itemprop="name" content="BIMI troubleshooting decision tree for logo not displaying" /><img src="https://static.prospeo.io/directory-assets/images/new_images/bimi-logo/bimi-troubleshooting-decision-tree.png" alt="BIMI troubleshooting decision tree for logo not displaying" loading="lazy" decoding="async" class="w-full rounded-lg shadow-sm" style="max-height:500px;width:auto;display:block;margin:0 auto;cursor:zoom-in;" itemprop="contentUrl image" /><figcaption class="mt-3 text-sm text-gray-500 text-center" itemprop="description caption">BIMI troubleshooting decision tree for logo not displaying</figcaption></figure>
1. Is DMARC at `p=quarantine` or `p=reject` with `pct=100`?
2. Is the BIMI TXT record at the correct hostname (`default._bimi.yourdomain.com`)?
3. Is a valid certificate present and reachable, if required by the provider?
4. Does the SVG meet Tiny-PS spec?
5. Does the recipient's provider actually support BIMI?
6. Have you waited at least 48 hours since publishing?
If all six check out and the logo still isn't appearing, work through this:
| Failure Category | Common Cause | Fix |
|---|---|---|
| DMARC | `p=none`, `pct<100`, subdomain misalignment | Set `p=reject`, `pct=100`, align From domain |
| DNS | Wrong hostname, malformed syntax, high TTL | Use `default._bimi.`, check semicolons, lower TTL |
| SVG | Embedded bitmap, file >32KB, unsupported elements | View source, search for `data:image/png;base64`, run SVGO |
| Certificate | Expired cert, unreachable URL, logo changed without reissue | Renew, verify URL accessibility, reissue after logo changes |
To detect embedded bitmaps, open the SVG in a browser, view page source, and search for `data:image/png;base64`. If you find it, your "SVG" is actually a raster image wrapped in an SVG container - you need a true vector conversion.
One more thing: provider-side caching adds another layer of unpredictability. Gmail in particular can delay display based on reputation and anti-abuse checks - factors outside the BIMI spec entirely. If you’re debugging broader inboxing issues, use an [email deliverability guide](/s/email-deliverability-guide) to isolate auth vs reputation vs content problems.
<div class="cta-block" style="display:flex;flex-direction:column;align-items:center;justify-content:center;padding:3rem 20px 3.5rem;margin:3rem 0;border-radius:1rem;background-image:url('https://static.prospeo.io/directory-assets/images/home/general-cta-bg.webp');background-size:cover;background-position:center;background-repeat:no-repeat;"><img src="https://static.prospeo.io/directory-assets/images/prospeo_images/prospeo-logo.png" alt="Prospeo" style="display:block;height:40px;width:auto;margin-bottom:1.25rem;" /><h2 style="text-align:center;color:#1a1a1a;font-size:1.35rem;font-weight:400;line-height:1.5;margin:0 0 1.5rem 0;max-width:640px;">If your recipients are 70%+ Outlook, skip the $1,500 VMC and invest in data that actually moves pipeline. Prospeo gives you 300M+ verified contacts at $0.01/email - teams book 26% more meetings than with ZoomInfo.</h2><p style="text-align:center;color:#1a1a1a;font-size:1rem;font-weight:600;line-height:1.5;margin:0 0 1.25rem 0;max-width:640px;">Spend your BIMI budget where it drives revenue instead.</p><div style="display:flex;align-items:center;flex-wrap:wrap;gap:0.75rem;justify-content:center;"><a href="https://prospeo.io/sign-up" rel="nofollow noopener" class="cta-primary" style="display:inline-flex;align-items:center;justify-content:center;gap:0.5rem;padding:12px 24px;background:#FF1A26;color:#fff;border:2px solid #FF1A26;border-radius:0.5rem;font-size:15px;font-weight:500;line-height:1.5;text-decoration:none;white-space:nowrap;transition:all 0.2s ease;"><svg stroke="currentColor" fill="currentColor" stroke-width="0" viewBox="0 0 24 24" aria-hidden="true" style="width:20px;height:20px;flex-shrink:0;" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" d="M9 4.5a.75.75 0 0 1 .721.544l.813 2.846a3.75 3.75 0 0 0 2.576 2.576l2.846.813a.75.75 0 0 1 0 1.442l-2.846.813a3.75 3.75 0 0 0-2.576 2.576l-.813 2.846a.75.75 0 0 1-1.442 0l-.813-2.846a3.75 3.75 0 0 0-2.576-2.576l-2.846-.813a.75.75 0 0 1 0-1.442l2.846-.813A3.75 3.75 0 0 0 7.466 7.89l.813-2.846A.75.75 0 0 1 9 4.5ZM18 1.5a.75.75 0 0 1 .728.568l.258 1.036c.236.94.97 1.674 1.91 1.91l1.036.258a.75.75 0 0 1 0 1.456l-1.036.258c-.94.236-1.674.97-1.91 1.91l-.258 1.036a.75.75 0 0 1-1.456 0l-.258-1.036a2.625 2.625 0 0 0-1.91-1.91l-1.036-.258a.75.75 0 0 1 0-1.456l1.036-.258a2.625 2.625 0 0 0 1.91-1.91l.258-1.036A.75.75 0 0 1 18 1.5ZM16.5 15a.75.75 0 0 1 .712.513l.394 1.183c.15.447.5.799.948.948l1.183.395a.75.75 0 0 1 0 1.422l-1.183.395c-.447.15-.799.5-.948.948l-.395 1.183a.75.75 0 0 1-1.422 0l-.395-1.183a1.5 1.5 0 0 0-.948-.948l-1.183-.395a.75.75 0 0 1 0-1.422l1.183-.395c.447-.15.799-.5.948-.948l.395-1.183A.75.75 0 0 1 16.5 15Z" clip-rule="evenodd"/></svg>Try Prospeo Free</a><a href="/contact" rel="nofollow noopener" class="cta-secondary" style="display:inline-flex;align-items:center;gap:4px;padding:12px 24px;background:#fff;color:#1a1a1a;border:1.5px solid #d1d5db;border-radius:0.5rem;font-size:15px;font-weight:400;line-height:1.5;text-decoration:none;white-space:nowrap;transition:all 0.2s ease;">Contact Sales <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="width:16px;height:16px;flex-shrink:0;"><path d="m9 18 6-6-6-6"/></svg></a></div></div>
## BIMI vs Google Profile Images
These aren't the same thing, and the confusion trips up a lot of teams.
A Google profile image is managed through your Google account settings, works only within the Google ecosystem, and can be an animated GIF. It requires no email authentication whatsoever. BIMI is an email-wide standard backed by DMARC enforcement, uses SVG only, and works across any supporting mailbox provider. In Gmail, a Google profile image appears in certain contact views even without BIMI - but it doesn't carry the blue checkmark or the authentication guarantee that a verified brand indicator provides.
Google Annotations - the promotional tab cards with images and deals - are yet another non-BIMI approach that sometimes gets confused with inbox logos. Annotations enhance Gmail's Promotions tab but carry no authentication or brand verification benefits.
## FAQ
### Can I use BIMI without a trademark?
Yes. Self-asserted BIMI requires no certificate or trademark and works free on Yahoo, Fastmail, and LaPoste. Common Mark Certificates cover prior-use marks that aren't formally registered, expanding coverage to most BIMI-supporting providers at $100-$950/year. Only Gmail's blue checkmark demands a registered trademark via VMC.
### How long does a BIMI logo take to display?
DNS propagation typically takes up to 48 hours, but mailbox providers cache aggressively - allow 3-5 days for consistent display. If it's still missing after a week, the issue is almost always DMARC misconfiguration (`p=none` or `pct<100`) or an SVG that fails Tiny-PS validation.
### Is BIMI free?
Self-asserted BIMI is completely free but limited to Yahoo, Fastmail, and LaPoste. CMCs start around $100/year for broader provider support. Gmail's blue checkmark requires a VMC at $900-$1,700/year plus a registered trademark - so the full implementation ranges from $0 to roughly $2,100 annually.
### Does BIMI improve email deliverability?
BIMI itself doesn't directly affect deliverability - it's a visual branding layer on top of DMARC. The DMARC enforcement required for BIMI does improve deliverability, though, and the brand visibility can [lift open rates by 10-50%](https://bimicertifications.com/insights/quantifying-bimi-benefits-metrics-that-matter-beyond-open-rates) depending on audience and volume.
### Does BIMI work on subdomains?
Yes. Publish a BIMI TXT record at `default._bimi.subdomain.yourdomain.com` for each sending subdomain. Each subdomain needs its own DMARC alignment and can reference a different SVG. For companies sending from `marketing.company.com` and `support.company.com`, that means two separate records and potentially two certificates.