BIMI (Brand Indicators for Message Identification) can show your logo beside authenticated mail, but only if you meet its prerequisites. You need DMARC at enforcement on the domain and subdomains, a logo in SVG Tiny PS format, and a BIMI DNS record. A Verified or Common Mark Certificate is optional but recommended.
Status of the standard
BIMI is an IETF Internet-Draft, not an RFC. The draft I reviewed is version 14, dated May 2026, so details may still change. Each mailbox provider decides whether and when to display a logo. The BIMI Group's guide says each participating provider has its own criteria and points to a per provider adoption chart. Check current support for the mailbox providers your customers use.
Checklist
1. Authenticate everything. SPF, DKIM and DMARC all in place and aligned. The BIMI Group guide says DMARC MUST be at enforcement on the organizational domain and its subdomains: p=quarantine; sp=quarantine or p=reject; sp=reject.
2. Do not use none, and do not use partial enforcement. The guide says p=none policies and pct below 100 are not accepted. The draft agrees: BIMI processing must not happen if the policy or the subdomain policy is none, and a quarantine policy with a percentage tag must have pct=100. Note that pct was removed from DMARC in RFC 9989, so check how your receivers treat it.
3. Prepare the logo. Produce an SVG Tiny PS version of your official logo. Ordinary SVG exports from design tools usually need cleaning to meet the profile. The BIMI Group lists conversion tools and a validator.
4. Host the SVG. Serve it over HTTPS at a stable URL. The draft says the receiver fetches it and rejects the indicator if TLS validation fails.
5. Publish the DNS record. BIMI records live at selector._bimi.yourdomain, with the selector default by default:
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/cert.pem"
The l tag is the logo location. The a tag is the location of the certificate, and may be empty if you have none. The draft says if both are empty, that is an explicit refusal to participate.
6. Consider a mark certificate. See the certificate post.
7. Test. Use a BIMI validator, send to a test mailbox at a supporting provider, and read the authentication results header for a BIMI result.
Why bother
BIMI is a branding feature that happens to require good authentication. The prerequisite is the real value: getting a domain to quarantine or reject protects it from spoofing whether or not any logo appears. Do not expect a measurable lift without evidence from your own sends.
Quick check
Can I publish BIMI while at p=none?
You can publish the record, but receivers must not process BIMI for a domain at p=none, so no logo will show.
Does BIMI replace DMARC?
No. It depends on DMARC. BIMI adds a display feature on top of a passing, enforced DMARC result.
Sources
Last reviewed: 19 October 2026.
