BIMI: getting your logo to show up in the inbox

BIMI (Brand Indicators for Message Identification) is the newest and most visible of the authentication standards: it's what puts your logo next to your emails in an inbox that supports it. Unlike SPF, DKIM, and DMARC — which are entirely invisible unless something breaks — BIMI is a reward you can actually see sitting right next to your name in someone's inbox.

But BIMI isn't something you can just turn on by itself. It's a reward for something else you've already built: strong DMARC enforcement. Mailbox providers only agree to show a logo next to your mail if they can already cryptographically trust that mail claiming to be from you really is from you — otherwise anyone could slap a trustworthy-looking logo on a spoofed message.

This is the single most important thing to understand about BIMI: it does nothing at all unless the domain's DMARC policy is already actively enforcing — p=quarantine or p=reject, not p=none. A domain running DMARC in monitor-only mode can publish a BIMI record all it wants, and no inbox will ever show the logo.

Like DMARC, a BIMI record is a TXT record published at a fixed location: default._bimi.yourdomain.com (the selector, before ._bimi, is almost always default unless a domain has explicitly published others). Like every other record in this series, it opens with a fixed version tag — v=BIMI1 — that marks the rest of the text as a BIMI policy rather than an unrelated TXT record.

Support for BIMI varies by provider, and it's still evolving. Several major inbox providers support it in some form. Some, Gmail among them, go a step further and require a Verified Mark Certificate — proof, from an independent certificate authority, that the logo is a legally registered trademark actually owned by the domain — before they'll display it at all. Requirements differ from provider to provider, so it's worth checking current documentation rather than assuming one inbox's rules apply everywhere.

A recognizable logo sitting next to a message is a small but real trust signal for the person reading it — it visually distinguishes a legitimate sender from a lookalike phishing attempt in a way plain text never can. For companies that have already put in the work to get DMARC fully enforcing, BIMI is often a relatively small additional step with a very visible payoff.