@ @inbox.consulting
I inbox.consulting avatar inbox.consulting

BIMI Explained: How to Get Your Logo — and Gmail's Blue Checkmark — Into Every Inbox

BIMI Email Security DMARC Branding Email Authentication

Your competitor’s logo is in the inbox. Yours is a grey circle.

Open your own inbox and look at the senders. Some show a crisp little logo next to the name. Most show a plain initial in a grey circle, or nothing at all. That difference isn’t random — it’s a DNS record.

It’s called BIMI, and it’s quietly becoming the standard that decides whether your brand shows up before a single email is even opened.

What BIMI actually is

BIMI — Brand Indicators for Message Identification — is a DNS-published standard that displays your logo next to your name in supporting inboxes: Gmail, Yahoo, Apple Mail, Fastmail, AOL.

It doesn’t replace SPF, DKIM, or DMARC. It sits on top of them. BIMI is a reward for having your authentication stack already in order — mailbox providers only show your logo if they can first confirm the email genuinely came from you.

Why a “branding feature” is worth your attention

It’s tempting to file this under marketing and move on. The numbers say otherwise. Research from Red Sift, in partnership with Entrust, surveyed over 1,000 US and UK consumers and found that visible sender logos increased open rates by up to 39% and improved brand recall by as much as 44% — with stronger brands seeing even bigger gains. Other studies, including an earlier Verizon study, found smaller but still meaningful lifts.

There’s also a quieter benefit: mailbox providers increasingly treat fully-authenticated mail — the kind that qualifies for BIMI — as a trust signal that helps with inbox placement generally, not just logo display.

The prerequisite nobody gets to skip: DMARC enforcement

BIMI will not display anywhere until your DMARC policy is enforced — p=quarantine or p=reject. No exceptions. If you’re still sitting at p=none, BIMI isn’t your next move; closing that gap is, and we’ve written about exactly why that’s the highest-leverage thing you can do for your domain.

Once enforcement is in place, BIMI is a relatively small lift on top of work you’ve already done.

How it actually works under the hood

A BIMI record is a TXT record published at default._bimi.yourdomain.com:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/cert.pem
  • l= — the URL of your logo, which must be a square image in the SVG Tiny 1.2 PS profile, hosted over HTTPS
  • a= — the URL of a certificate proving you’re authorised to use that logo

The a= tag is where most of the real decision-making happens.

VMC vs CMC: the certificate that decides whether you get the checkmark

There are two certificate types, and the difference matters:

  • VMC (Verified Mark Certificate) — requires a registered trademark on your logo. This is the only certificate type that unlocks Gmail’s blue verified checkmark next to your logo.
  • CMC (Common Mark Certificate) — no trademark required, and meaningfully cheaper. It displays your logo just fine in supporting inboxes, but Gmail won’t show the checkmark.

Yahoo, Apple Mail, and Fastmail show the logo from either certificate without visually distinguishing between them — the checkmark is specifically a Gmail feature, and specifically a VMC feature.

Not sure where your domain stands?

Our free domain scanner checks SPF, DKIM, DMARC, and BIMI in one pass — including whether your domain has a logo and certificate configured. Check your domain free →

How to actually get there

  1. Confirm DMARC is enforced at p=quarantine or p=reject — not p=none
  2. Design a square logo as an SVG, exported to the Tiny 1.2 PS profile
  3. Host the logo over HTTPS at a stable URL
  4. Decide between a VMC (if you have a registered trademark and want the Gmail checkmark) or a CMC (faster, cheaper, no checkmark)
  5. Publish the default._bimi TXT record with l= and a=
  6. Verify display across Gmail, Yahoo, and Apple Mail — rollout isn’t always instant

The bottom line

BIMI won’t fix a broken authentication setup, and it won’t protect you from spoofing the way DMARC enforcement does. But once that foundation is in place, it’s one of the few email standards that’s purely upside — a visible, measurable trust signal sitting on top of security work you’ve already paid for.

If you’ve already done the hard part, not finishing this last step is leaving a fairly cheap win on the table.

inbox.consulting helps businesses get to full email authentication — SPF, DKIM, DMARC enforcement, and BIMI. Book a free 20-minute audit and we’ll tell you exactly where your domain stands.

Related Articles

The Spoofed Invoice: How Weak Email Security Quietly Damages Your Brand

A spoofed invoice sent in your company's name, a customer who loses money, and a reputation hit you never saw coming. Domain spoofing happens more often than most businesses realise — and it's almost entirely preventable.

Why DMARC Enforcement is the Single Most Important Thing You Can Do for Your Domain Today

Most businesses have heard of DMARC. Few have actually enforced it. Here's why p=reject is the most impactful single change you can make to protect your domain from spoofing, phishing and brand abuse.