BIMI Requirements: DMARC, VMC & Logo Specs for 2026

BIMI requires four things: DMARC enforcement (p=quarantine or p=reject), SPF and DKIM alignment, a logo in SVG Tiny PS format, and a certificate (VMC or CMC) for Gmail and Apple Mail. The DNS record is free — the cost is in the prerequisites. Here's exactly what each requirement means, what it costs, and which email clients will actually show your logo once it's done.

The four BIMI requirements

1. DMARC enforcement

Your DMARC record must be set to p=quarantine or p=reject. No mailbox provider that supports BIMI will display your logo at p=none — the whole point of BIMI is that your domain has proven it's policing spoofing, and p=none means you're only monitoring, not enforcing.

If you're still on p=none, the path forward is:

1. Monitor DMARC aggregate reports (rua= tag) to confirm legitimate senders pass SPF and DKIM
2. Move to p=quarantine once you're confident no legitimate mail is failing
3. Move to p=reject for full BIMI eligibility (some providers like Yahoo specifically require p=reject)

You can check your current DMARC policy with a free scan at emailsecuritygrade.com — it shows your exact DMARC record, policy, and alignment status.

If DMARC enforcement feels like a big leap, start with the DMARC p=none, quarantine, and reject guide for a step-by-step progression.

2. SPF and DKIM alignment

Your email must pass either SPF or DKIM alignment for DMARC. This means:

• SPF alignment: the domain in your return-path (envelope sender) matches your visible From domain
• DKIM alignment: the d= domain in your DKIM-Signature header matches your visible From domain

If you're using an ESP like Mailchimp, SendGrid, or Klaviyo, SPF alignment often fails because the ESP sets the return-path to its own domain. The fix is usually DKIM alignment — sign with your own DKIM key and the d= tag matches your From domain.

For a deeper dive, see DMARC alignment explained and SPF alignment explained.

3. SVG Tiny PS logo

Your brand logo must be converted to SVG Tiny PS (Portable/Secure) format. This is a restricted SVG variant with strict rules:

• Single file — no external images, fonts, CSS, or resources
• No scripts or interactivity — pure vector graphics only
• Flat colors preferred — complex gradients can render inconsistently across email clients
• Square aspect ratio — recommended minimum 100×100 pixels
• Base profile — must conform to the SVG Tiny PS specification, not standard SVG 1.1

Most brands hire a designer or use a BIMI logo converter tool (EasyDMARC and others offer free ones). The conversion typically costs $200–$500 if outsourced.

Host the final SVG file at a public HTTPS URL — your website's /images/ directory works:

https://example.com/images/logo-bimi.svg

4. VMC or CMC certificate

Gmail and Apple Mail require a certificate to display your logo. Two options exist:

VMC is the established option. It requires your logo to be a registered trademark with a recognized intellectual property office. If you already have a trademark, the certificate is the only cost. If you don't, trademark registration adds $1,000–$3,500+ and can take 8–12 months.

CMC (Common Mark Certificate) is newer — DigiCert launched it in 2025. It doesn't require a registered trademark, just proof that your mark is in active commercial use. This lowers the barrier significantly for brands that haven't trademarked their logo.

Host the certificate at a public HTTPS URL:

https://example.com/.well-known/vmc.pem

BIMI DNS record format

The BIMI record itself is a TXT record published at default._bimi.yourdomain.com. Two fields:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/images/logo-bimi.svg; a=https://example.com/.well-known/vmc.pem"

• v=BIMI1 — version tag (required)
• l= — URL to your SVG Tiny PS logo (required)
• a= — URL to your VMC or CMC certificate (required for Gmail and Apple Mail; optional for Yahoo and Fastmail)

Without the a= tag, some providers (Yahoo, Fastmail) will still display your logo. Gmail and Apple Mail will not.

If you don't have a certificate yet, you can publish a record with just the logo URL to test on providers that don't require one:

default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/images/logo-bimi.svg"

Which email clients support BIMI (2026)

The biggest gap is Microsoft. Outlook and Microsoft 365 do not render BIMI logos. If a significant portion of your recipients use Outlook, BIMI won't reach them — though the DMARC enforcement you set up as a prerequisite still protects those recipients from spoofing.

What BIMI actually costs (full breakdown)

The DNS record is free. The costs are in the prerequisites:

If you already have DMARC enforcement and a trademarked logo, BIMI costs roughly $1,000–$1,800/year — just the certificate plus SVG conversion (one-time).

If you're starting from scratch, budget $3,000–$6,000+ for Year 1 (trademark filing + DMARC platform + SVG + certificate). Year 2 drops to just the certificate renewal.

The CMC path is worth considering if you don't have a trademark. It costs more annually than a VMC, but you skip the $1,000–$3,500 trademark filing and the 8–12 month wait. For a brand that wants BIMI now, the CMC can be cheaper in Year 1.

Is BIMI worth it?

BIMI doesn't directly improve spam filtering or sender score. The value is indirect:

• Higher open rates. Recipients see a brand logo instead of a generic avatar. Gmail's algorithm treats engagement as a trust signal.
• Phishing resistance. When recipients learn to look for your verified logo, they're less likely to engage with spoofed emails from lookalike domains.
• DMARC enforcement is the prerequisite. The real deliverability win is getting to DMARC p=reject — BIMI is the visible reward for that work.

If you're a high-volume sender (marketing emails, transactional notifications, customer communications) where brand trust directly affects revenue, BIMI's cost is easy to justify. If you're sending a few hundred emails a week from a personal domain, it's probably not worth the investment yet.

Common BIMI setup pitfalls

"My logo won't show in Gmail." Check three things: (1) DMARC is at p=quarantine or p=reject, not p=none. (2) You have a VMC or CMC hosted at a public HTTPS URL. (3) The logo is valid SVG Tiny PS, not standard SVG.

"Yahoo shows my logo but Gmail doesn't." Yahoo doesn't require a certificate — it displays logos for any BIMI-compliant sender with DMARC enforcement. Gmail requires VMC or CMC. You need the certificate for Gmail.

"I converted my logo to SVG but it's rejected." Standard SVG (SVG 1.1) is not the same as SVG Tiny PS. Use a BIMI-specific converter or have a designer re-export using the SVG Tiny PS profile. Common issues: embedded fonts, external CSS references, or scripts in the file.

"I have a VMC but no blue checkmark in Gmail." The blue checkmark requires a VMC specifically. A CMC will display your logo but not the checkmark. Verify your certificate type with your CA.

"My BIMI record is published but nothing shows." DNS propagation can take up to 48 hours. Also check that you're sending test emails that actually pass DMARC — if DMARC fails on the message, BIMI won't display regardless of your record.

Check your grade free

Don't guess what's broken — see it. Scan your domain free at emailsecuritygrade.com and get an instant A–F grade on your SPF, DKIM, DMARC, and MX records, with a plain-language fix for anything failing. No signup, no install — it runs in your browser.

If your emails are still landing in spam after fixing the records, a deliverability tool like InboxAlly can train mailbox providers to trust your sending — worth a look once your grade is solid.