What is BIMI and how do Brand Indicators for Message Identification work?

When BIMI display can change

BIMI eligibility is not the same as logo display. The receiver controls the display decision, so a sender can publish a syntactically valid record and still see no logo in a particular inbox.

The answer changes with these conditions:

• DMARC policy: BIMI implementation guidance requires a DMARC policy of quarantine or reject. A monitoring-only policy of p=none does not meet that condition. Although RFC 9989 removed the legacy pct tag from DMARC, current BIMI guidance still does not accept a published value below 100.
• DMARC alignment: The specific delivered message must pass DMARC. A valid BIMI record cannot compensate for an SPF or DKIM alignment failure.
• Logo format: The logo URL must lead to a file that meets the BIMI SVG Tiny Portable/Secure profile. A conventional SVG can include elements that the BIMI profile does not allow.
• Certificate policy: Some receivers require a Verified Mark Certificate or another accepted certificate before they display a logo. Check the receiving provider's current BIMI documentation before buying or publishing a certificate.
• Mailbox-provider support: A provider that does not implement BIMI will not display the indicator, regardless of the sender's DNS configuration.
• Local receiver policy: A supporting provider can apply additional trust and anti-abuse controls. BIMI does not override those controls.

If you want the enforcement, SVG conversion, hosted record, and verification steps in one guided workflow, see Palisade's managed BIMI feature. The receiver still makes the final logo-display decision.

Do not move a domain to p=quarantine or p=reject solely to obtain a logo. First identify legitimate sending sources and confirm aligned authentication for important mail streams.

The opportunity is measurable: Palisade's BIMI adoption data from 100,000 domains shows how many enforcement-ready domains have yet to publish a BIMI record, with a reusable funnel chart and downloadable counts.

Which providers support BIMI?

Major inbox providers have adopted the standard. Gmail, Yahoo, and Apple all incorporate BIMI into their platforms. Gmail and Apple Mail both need a mark certificate, while Yahoo displays logos from self-asserted records, and Google expanded Gmail's BIMI support in May 2023 to add a verified checkmark beside participating senders. Publishing a valid record puts the brand logo in front of users of those services, subject to each provider's own display decision.

The engagement case rests on that visibility. A 2021 consumer study by Red Sift and Entrust found open rates up to 39% higher when a brand logo was displayed with the message. Treat that as directional evidence rather than a guarantee: the receiver still controls whether a logo appears, and results vary by audience and provider.

Worked BIMI record example

A BIMI record is normally published as a TXT record beneath the selector and _bimi label. The BIMI Group documents default as the usual selector, though a receiver can use the selector in the message's BIMI-Selector header when present.

Host: default._bimi.yourdomain.com
Type: TXT
Value: v=BIMI1; l=https://assets.yourdomain.com/logo.svg; a=https://assets.yourdomain.com/mark.pem

This is illustrative only. Do not publish these example URLs. Your organization must host its own approved logo and use the certificate location issued for its own mark, when a target receiver requires one.

In this example:

• v=BIMI1 identifies the record as BIMI.
• l= identifies the HTTPS location of the BIMI-compliant SVG logo.
• a= identifies the HTTPS location of a mark certificate.

A public DNS result can show whether the record is visible. It cannot prove that a specific production message passed DMARC, that the receiver fetched the logo, or that the receiver chose to display it.

Why BIMI eligibility depends on DKIM, not just SPF

Gmail layers a blue verified checkmark on top of BIMI to signal that a brand's identity has been confirmed. The timeline is often reported wrong: BIMI logo avatars became generally available in Gmail in July 2021, but the blue checkmark launched in May 2023.

Within weeks of that launch, security researcher Chris Plummer demonstrated a spoofed message that carried UPS's logo and Google's blue checkmark and was a scam. The cause was how BIMI leaned on SPF. DMARC passes if either an aligned SPF check or an aligned DKIM check succeeds. Because UPS authorized a shared third-party mail platform in its SPF record, an attacker routing a message through that same platform earned an aligned SPF pass, which satisfied DMARC, which qualified the message for BIMI and the checkmark. This is sometimes called an SPF upgrade attack: a message that should have looked untrusted was upgraded to trusted.

In June 2023 Google told reporters it would stop treating an aligned SPF pass as sufficient and would require DKIM to qualify a sender for BIMI and the checkmark. A DKIM signature is a cryptographic hash tied to the message and signed with the domain's private key, so a sender cannot inherit trust by relaying mail through infrastructure a target happens to list in its SPF record. Google never carried that change into its published BIMI documentation: Google's current BIMI setup guide still says a domain must set up SPF or DKIM before DMARC, and it ties the checkmark itself to a Verified Mark Certificate.

The practical consequence for a sending domain is unchanged by that ambiguity. Google's sender guidelines require both SPF and DKIM from anyone sending more than 5,000 messages a day to Gmail accounts, and the checkmark additionally needs a VMC or CMC. Confirm the domain signs with aligned DKIM and holds a mark certificate before treating the checkmark as reachable. For the full certificate and cost path, see how to get Gmail's blue verified checkmark.

What to check next

Start with the evidence you have:

• If you only have a domain name, use the BIMI lookup tool to inspect the publicly visible BIMI record and its logo or certificate URLs.
• If you are preparing a logo, validate that the final hosted file conforms to the BIMI SVG profile. Keep the design source separate from the published BIMI file.
• If you have a delivered test message, inspect its authentication results. RFC 8601 defines the Authentication-Results header field used to report authentication evaluations. Confirm that the real sending path has an aligned SPF or DKIM pass before treating BIMI as the problem.
• If a mailbox provider does not show the logo, compare its documented BIMI requirements with the exact message path, DNS record, logo file, and certificate evidence. Do not infer a provider decision from DNS alone.

Check the public BIMI record first

A BIMI lookup is the right first action when you have a sending domain and need to confirm what the public DNS record currently publishes.

Check the BIMI record

A public lookup cannot prove that the production sender passes DMARC, that every receiver supports BIMI, or that a mailbox provider will display the logo.

Keep BIMI readiness connected to real sending evidence

A correct record today does not identify every sending source that may later fail alignment, and it does not show whether a policy change affects a different application or subdomain. Palisade is DMARC software that analyzes DMARC aggregate-report data, identifies sending sources and authentication or alignment issues, and creates prioritized remediation tickets. It can propose a next policy step when the evidence supports it, while a human reviews the evidence and applies the DNS change.

Start with Palisade

Palisade does not autonomously change a DMARC policy, guarantee logo display, or guarantee inbox placement.