# What is BIMI? Brand Indicators for Message Identification > What BIMI is, how it displays your verified logo in the inbox, the DMARC and certificate (VMC or CMC) requirements, and which email clients actually support it. Brand Indicators for Message Identification (BIMI) is an email specification that displays a business's verified brand logo next to authenticated messages in the recipient's inbox. Pronounced "bih-mee," it builds directly on [DMARC](/learning/what-is-dmarc), [SPF](/learning/what-is-spf), and [DKIM](/learning/what-is-dkim): only mail that has already passed authentication and meets an enforced DMARC policy can carry a logo. By turning authentication into a visible trust signal, BIMI helps recipients recognise legitimate mail at a glance and makes [phishing](/learning/what-is-phishing) that impersonates your brand harder to pull off. ## How does BIMI work? BIMI relies on a foundation of [email authentication](/resources-post/what-are-dmarc-dkim-and-spf) so that only verified senders can display a logo. The flow has three moving parts: ![Four-step flow showing how BIMI works: DMARC authentication with an enforced policy, publishing a BIMI DNS record, optional VMC or CMC verification, and logo display in supporting inboxes.](/images/figures/what-is-bimi-fig1.webp) *BIMI only activates once DMARC is enforced at quarantine or reject.* - **DMARC authentication.** The message must pass DMARC, which in turn depends on SPF (confirming the sending IP is authorised) and DKIM (validating the cryptographic signature). Critically, your DMARC policy must be set to `p=quarantine` or `p=reject` — a `p=none` monitoring policy will not trigger BIMI. - **BIMI record.** The domain owner publishes a [DNS](/learning/what-is-a-dns) TXT record at `default._bimi.yourdomain.com` containing a URL to a logo in SVG Tiny Portable/Secure (SVG Tiny P/S) format, hosted over HTTPS. The record can also point to a certificate that proves you own the logo. You can generate and check a record with the [BIMI record tool](/tools/bimi). - **Logo display.** When a supporting inbox receives an authenticated message from your domain and finds a valid BIMI record, it renders your logo beside the message — and, where a Verified Mark Certificate is present, a verified checkmark. ## What you need before BIMI will work BIMI is not plug-and-play. Before a logo will ever appear, you need all of the following in place: - **An enforced DMARC policy** at `p=quarantine` or `p=reject`, applied at 100% (no `pct` below 100), with SPF and DKIM passing and aligned for your legitimate mail. - **A square SVG Tiny P/S logo** — the profile strips scripts and external references for security. A normal SVG exported from a design tool usually needs conversion. - **HTTPS hosting** for both the logo file and, where used, the certificate. - **A mark certificate** for the inboxes that require one (covered below). - **A healthy sending reputation.** Even a perfect BIMI setup can be suppressed if a domain has spam complaints or poor [domain reputation](/tools/domain-reputation), because providers gate logo display on trust as well as authentication. ## VMC vs CMC: which certificate do you need? Two certificate types can back a BIMI record, and the difference matters: - **Verified Mark Certificate (VMC).** Proves the logo is a trademark you own, validated by a certificate authority. A VMC is what unlocks the Gmail blue verified checkmark, and it is required by Apple Mail and by Gmail for the checkmark experience. - **Common Mark Certificate (CMC).** A newer, lighter option for logos that are not registered trademarks (for example, a logo in use for at least a year). A CMC can display your logo in Gmail but does **not** grant the verified checkmark. If your logo is a registered trademark and you want the checkmark, get a VMC. If it isn't trademarked, a CMC now lets many brands display a logo that previously couldn't qualify at all. ## Which inboxes display BIMI logos? Support has broadened well beyond the original launch partners. As of 2026, BIMI logos render in **Gmail and Google Workspace, Apple Mail (iOS 16 / macOS Ventura and later), Yahoo Mail, AOL, Fastmail, and several regional providers** such as GMX and La Poste. Apple Mail and the Gmail checkmark both require a VMC. The notable holdout is Microsoft: **Outlook.com, Hotmail, Exchange Online, and Microsoft 365 mailboxes do not render standard BIMI logos** for normal inbound mail. Plan your rollout knowing a large share of business recipients won't see the logo yet — the authentication work underneath it still pays off everywhere. ## Why BIMI matters - **Enhanced trust.** A verified logo signals authenticity, helping users tell genuine mail from impersonation — especially valuable in banking, healthcare, and retail. - **Brand visibility.** Your logo stands out in a crowded inbox, reinforcing recognition before the message is even opened. - **Better engagement.** Recognisable, trusted mail tends to see higher open and click-through rates. - **An incentive to enforce DMARC.** Because BIMI requires `quarantine` or `reject`, it gives teams a concrete, visible reason to finish the DMARC journey they might otherwise leave at `none`. ![Checklist of six BIMI requirements: enforced DMARC, SPF and DKIM, a square SVG logo over HTTPS, a VMC where required, supported email clients, and good sender reputation.](/images/figures/what-is-bimi-fig2.webp) *BIMI won't activate without an enforced DMARC policy and proper SPF and DKIM.* You can confirm your DMARC, SPF, and BIMI readiness in one place with the [Email Security Score](/tools/email-security-score), and if you're not yet at enforcement, see [what a VMC is](/learning/what-is-a-vmc) and how it fits the picture. ## Frequently asked questions ### Do I need a VMC to use BIMI? Not always. A VMC is required for Apple Mail and for the Gmail verified checkmark, but a Common Mark Certificate (CMC) can display your logo in Gmail without the checkmark, and some providers show logos with a valid record alone. If you want the checkmark and own the trademark, get a VMC. ### Will BIMI work if my DMARC policy is p=none? No. BIMI only activates when DMARC is enforced at `quarantine` or `reject`. A monitoring policy of `none` provides reporting but never triggers logo display — moving to enforcement is the single biggest prerequisite most domains are missing. ### Why isn't my logo showing even though everything is configured? The most common causes are a DMARC policy still at `none` or below 100% enforcement, an SVG that isn't valid SVG Tiny P/S, a logo or certificate not served over HTTPS, a missing VMC for clients that require one, or poor sending reputation suppressing display. It's also normal not to see a logo in Microsoft inboxes, which don't support standard BIMI. ### Does BIMI improve deliverability? BIMI itself is a display feature, not a deliverability lever — but the enforced DMARC, SPF, and DKIM it requires do help inbox placement. In practice, the work you do to qualify for BIMI is what improves deliverability, not the logo record itself. ### How is BIMI different from the Gmail blue checkmark? The checkmark is Gmail's specific trust indicator, shown only when your BIMI logo is backed by a VMC. BIMI is the broader standard that displays the logo across many providers; the checkmark is one provider's premium layer on top of it. ## Related reading - [What are DMARC, DKIM, and SPF?](/resources-post/what-are-dmarc-dkim-and-spf) - [What is a VMC?](/learning/what-is-a-vmc) - [What is spoofing?](/learning/what-is-spoofing)