Check the prerequisite first
BIMI only works with an enforced DMARC policy. Concretely that means:
p=quarantineorp=reject— withp=noneno logo is shown- many providers additionally require
pct=100 - SPF and DKIM must pass reliably and be aligned
If you do not meet these points there is no reason to start with BIMI. The record is simply ignored.
Step 1 — Create the logo
The logo must conform to the SVG Tiny 1.2 Portable/Secure profile — a deliberately restricted SVG variant:
- square aspect ratio (1:1)
- no scripts, no external references, no embedded raster images
- maximum file size 32 KB
- a
<title>element containing the brand name is required - a
baseProfile="tiny-ps"attribute must be present
An SVG exported from a graphics application generally does not satisfy this — exports almost always contain disallowed elements and need manual cleanup.
Step 2 — Serve the logo over HTTPS
The file must be permanently reachable at an HTTPS URL with a valid certificate. A private CDN or your own web server is sufficient.
Step 3 — Publish the DNS record
"default" is the selector. The a= tag additionally references the VMC certificate:
Step 4 — VMC for Gmail
Google requires a Verified Mark Certificate. This is a paid certificate from DigiCert or Entrust that presupposes a registered trademark — the mark must be registered with a trademark office and the logo must be identical to the registration. Annual costs run into four figures.
Without a VMC, Apple Mail and Yahoo still display the logo; Gmail does not.
Is it worth the effort?
BIMI is pure branding and protects against nothing DMARC does not already cover. For organizations with high sending volume and a registered trademark it is a sensible investment in recognition and trust. For everyone else, the path there — clean SPF, DKIM and DMARC at p=reject — is the actual gain.
Testing
Send an email to hello@analyzemy.email. The report shows the BIMI record found and the extracted logo URL.