BIMI explained: getting your logo into the inbox, and what it actually requires
BIMI is the standard that displays your logo next to your messages in Gmail, Apple Mail, Yahoo and others. It is equal parts marketing feature and security incentive: the logo is the reward, and the price is proving your domain cannot be spoofed. Here is what it takes, end to end, and where the money question — the VMC certificate — comes in.
What BIMI is and why it exists
Brand Indicators for Message Identification (BIMI) is a DNS-based convention: you publish a TXT record at default._bimi.yourdomain.dk pointing to an SVG file of your logo, and participating mailbox providers display that logo as the avatar for your authenticated mail.
The design intent goes beyond branding. Mailbox providers wanted a way to reward domains that adopt strict email authentication — something visible that businesses would care about. The logo is that carrot. That is why BIMI's first and non-negotiable requirement has nothing to do with images: your DMARC policy must be at enforcement. A logo shown next to a message is a trust signal to recipients, so the standard requires that the domain actually be hard to forge before any client will show it.
The prerequisites, in order
First, DMARC at enforcement: p=quarantine or p=reject, and critically with pct at 100 (or absent, which defaults to 100). A pct=50 quarantine policy does not qualify. Subdomain opt-outs (sp=none) can also disqualify the setup at some providers. If you are still at p=none, BIMI is your motivation to finish the DMARC rollout — nothing else in this article matters until then.
Second, the record itself: v=BIMI1; l=https://yourdomain.dk/logo.svg; a=https://yourdomain.dk/vmc.pem. The l= tag points to the logo over HTTPS; the optional a= tag points to your Verified Mark Certificate. The record lives on the default._bimi host, where "default" is a selector — like DKIM, BIMI supports multiple selectors, though almost everyone uses default.
Third, the logo format — where most first attempts fail.
SVG Tiny PS: a deliberately strict format
BIMI logos must be SVG Tiny Portable/Secure — a locked-down SVG profile defined specifically for this use. The restrictions exist because mail clients will render this file automatically, at scale, from untrusted internet sources: no scripts, no external references or links, no embedded raster images, no animations or interactivity. The file must carry baseProfile="tiny-ps" on the svg element and include a <title> element, and it should stay well under 32 KB.
A normal SVG export from Illustrator or Figma typically violates several of these at once (editor metadata, style links, embedded images). The practical route: export a plain vector version, run it through a BIMI-specific converter or clean it manually, center the artwork in a square viewBox on a solid background — the logo is displayed in a circle at avatar size, so fine detail disappears — and validate. Our free BIMI Inspector fetches your published file and reports exactly which profile requirement fails.
The VMC question: do you need the certificate?
A Verified Mark Certificate is an X.509 certificate from DigiCert or Entrust attesting that you own the logo as a registered trademark. It costs roughly $1,000–1,500 per year, and obtaining one requires an actual trademark registration covering the logo.
Where it matters: Gmail — by far the largest BIMI implementation — requires a VMC (or the newer, cheaper CMC "Common Mark Certificate" tier introduced in 2024) before displaying your logo, and adds a blue verified checkmark when one is present. Apple Mail likewise requires certification. Yahoo displays BIMI logos without a certificate. So without a VMC, BIMI works at a minority of inboxes; with one, you get the majority plus the checkmark.
For a Danish SMB the honest calculus: publish the DNS record and compliant SVG regardless (it is free and future-proof), and treat the VMC as a marketing spend decision — worthwhile for consumer-facing brands sending volume, skippable for a B2B firm sending invoices.
Verifying and maintaining it
After publishing, verify the chain end to end: DMARC at enforcement, record syntax, logo reachable over HTTPS and profile-valid, certificate matching if present. Then keep it verified — an expired certificate, a logo URL broken by a website relaunch, or a DMARC downgrade each silently removes your logo from inboxes. MonitorBase's monitoring covers the BIMI record and logo alongside SPF, DKIM and DMARC, so the avatar your customers learned to recognize does not quietly disappear.