How to Set Up BIMI (Logo in Gmail, Apple Mail and Yahoo): VMC vs CMC, SVG Tiny PS

Step-by-step BIMI setup: get DMARC to quarantine or reject, build an SVG Tiny PS logo, choose a VMC or CMC, host the logo and PEM over HTTPS, and publish default._bimi so Gmail, Apple Mail and Yahoo can show your logo.

Quick answer

BIMI (Brand Indicators for Message Identification) lets mailbox providers show your logo next to mail that passes DMARC. You need three things: a DMARC policy at enforcement, a logo in the SVG Tiny PS format, and one TXT record at default._bimi. Gmail and Apple Mail also want a mark certificate (a VMC or CMC) from a certificate authority:

_dmarc.example.com         TXT  v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
default._bimi.example.com  TXT  v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem

VMC (Verified Mark Certificate): needs a registered trademark. Gmail shows the logo with a blue verified checkmark.
CMC (Common Mark Certificate): no trademark needed, but the logo must have been in public use on your domain for at least 12 months. Gmail shows the logo without the checkmark.
No certificate (leave out a=): Yahoo can still show the logo for bulk mail with a good reputation. Gmail and Apple Mail won't.

Microsoft Outlook doesn't show BIMI logos. Build the record with the BIMI Record Generator and check your policy first with the DMARC Record Checker.

Step 1: Get DMARC to enforcement

BIMI depends on DMARC, so fix authentication first. The BIMI draft and the providers' rules come down to this:

Aligned SPF or DKIM. Mail has to pass DMARC for the domain in the visible From address. Aligned DKIM is the safer choice, because SPF often aligns only with your mail service's own bounce domain and breaks when mail is forwarded. Check your selectors with the DKIM Checker and your SPF record with the SPF Record Checker.
p=quarantine or p=reject on the organizational domain (for example example.com) and on the domain in the From address. Receivers skip BIMI when either one is at p=none.
No percentage below 100. With p=quarantine, a pct tag has to be pct=100. Leaving pct out also works, because 100 is the default. Google asks for pct=100, and the BIMI Group says pct below 100 isn't accepted.
No t=y. RFC 9989 (the May 2026 DMARC update) drops pct and adds a t (testing) tag. t=y takes the place of the old pct=0: it asks receivers to apply one policy level lower, so quarantine acts like none. Remove t=y before you expect a logo.
Subdomain policy. Receivers skip BIMI if the DMARC record of the From domain or the organizational domain includes sp=none, even for mail from the organizational domain itself. Subdomains without their own _dmarc record inherit sp= (or p= when there's no sp). Use sp=quarantine or sp=reject, or remove sp.

A record that meets all of these:

v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Still at p=none? Roll out step by step with the DMARC guide for Microsoft 365 or the Google Workspace guide, and build the record with the DMARC Record Generator.

Step 2: Make an SVG Tiny PS logo

BIMI logos must be SVG files that follow the SVG Tiny Portable/Secure (SVG Tiny PS) profile, a locked-down subset of SVG Tiny 1.2 with nothing that can run or load anything. A normal SVG export from a design tool usually fails until you edit it:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps"
     width="512" height="512" viewBox="0 0 512 512">
  <title>Example, Inc.</title>
  <desc>Example, Inc. logo</desc>
  <rect width="512" height="512" fill="#0b3d91"/>
  <circle cx="256" cy="256" r="160" fill="#ffffff"/>
</svg>

Rule	Details
Root element	`xmlns="http://www.w3.org/2000/svg"`, `version="1.2"` and `baseProfile="tiny-ps"`. No `x=` or `y=` attributes on the root `<svg>` element.
Title	Exactly one non-empty `<title>` directly under `<svg>`, ideally 64 characters or fewer. Google recommends your organization's name. A `<desc>` is optional (Gmail recommends one for accessibility).
Not allowed	Scripts, animation, interactivity, links, embedded raster images (`<image>`), `<switch>`, audio and video, and any external references other than the XML namespaces.
Shape	Square, with the logo centered. Many inboxes crop the logo to a circle or rounded square, so leave space around the edges.
Background	A solid color. Transparent backgrounds might not display as expected, and a solid color helps the logo work in both light and dark mode. The logo must render with at least two colors.
Size	Keep it as small as possible and no larger than 32 KB uncompressed. Remove editor metadata and comments.
Gmail extras	At least 96 × 96 pixels, set in absolute pixels (`width="96" height="96"` or larger), not percentages.

If the root element has zoomAndPan or externalResourcesRequired, they must be disable and false. Google's help center has a walkthrough for making the file with Adobe Illustrator and a text editor. If you're getting a certificate, the CA certifies this exact file, so finish the logo before you apply.

Step 3: Choose a VMC or a CMC

A mark certificate is how a third party (a Mark Verifying Authority, in practice a certificate authority) confirms you have the right to use the logo. The certificate contains your SVG logo and lists the domains it covers. You publish it as a PEM file and point the a= tag at it.

	VMC (Verified Mark Certificate)	CMC (Common Mark Certificate)
Mark you need	A registered trademark from a trademark office the issuers recognize, or a government mark. The logo has to match the trademark record.	A prior use mark: a logo you have shown publicly on a domain you control for at least 12 months, which the CA checks in the Internet Archive. A modified version of a registered trademark also qualifies.
Gmail	Logo plus the blue verified checkmark, on the web and in the Gmail apps for Android and iOS	Logo only, no checkmark (supported since September 2024)
Apple Mail	Supported. Apple's documentation names VMCs.	Apple says it accepts VMCs and "other forms of BIMI Evidence Documents" but doesn't name CMCs, so test before you count on it.
Yahoo	Not required. Yahoo shows self-asserted logos for mail that meets its rules.
Lead time	Getting a trademark registered can take 6 to 12 months (Google's estimate), then CA validation	CA validation only, once you have 12 months of public use

Who issues them: in October 2026, the BIMI Group's issuer list shows DigiCert, GlobalSign and SSL.com. Sectigo also sells VMCs and CMCs; it bought Entrust's public certificate business, and Entrust stopped issuing VMCs on 12 May 2025. Each mailbox provider decides which issuers it trusts, so check that the providers you care about accept your CA.
Who can apply: CAs validate your organization as well as the mark, for example through company registration documents. Sectigo, for example, takes registered businesses, government bodies and international organizations, and sole proprietors only if they're officially registered.
Renewal: mark certificates last about a year at most (the BIMI Group gives a maximum of 398 days) and come with an annual fee. Put the expiry date in your calendar and replace the PEM file before it runs out.
More than one domain: the certificate lists every domain allowed to use it. Add each sending domain when you order; extra domains can cost more.

Which providers show the logo

Mailbox provider	Certificate	Notes
Gmail and Google Workspace	VMC or CMC required	Gmail only uses BIMI with a PEM certificate file; a standalone SVG isn't enough. VMC senders get the checkmark. Google says the logo can take up to 48 hours to appear after you add the record.
Apple Mail (iOS 16, iPadOS 16, macOS Ventura 13 or later, and iCloud.com)	A verified BIMI Evidence Document, such as a VMC	The recipient's mail provider does the BIMI checks. Apple Mail shows the logo only when that provider is on the BIMI Group's supporting list, is verified by Apple, and adds the BIMI headers.
Yahoo Mail	Not required	Yahoo needs a valid SVG logo, DMARC at quarantine or reject, bulk mail (not personal mail) and enough reputation and engagement. Changes take time to spread; check on mail.yahoo.com in a fresh session with a clear cache.
Others listed by the BIMI Group	Varies	Fastmail, Comcast, La Poste, Zoho Mail, Onet Poczta, Zone, Zoner, au (KDDI), NTT docomo and Cloudmark are listed as supporting BIMI (chart last updated May 2025).
Microsoft (Outlook, Outlook.com)	–	Listed by the BIMI Group as not supporting BIMI.

Apple also has Branded Mail in Apple Business, a separate program in which Apple verifies your organization and approves the brand logo itself. Its requirements list doesn't mention a VMC or a BIMI record. It does need DMARC with p=quarantine or p=reject and pct=100 (or sp=quarantine/sp=reject for subdomains covered by the parent's record), and DKIM on all mail sent to customers, because SPF alone isn't accepted.

Step 4: Host the logo and the PEM over HTTPS

HTTPS only, with a certificate that chains to a publicly trusted root. Google recommends TLS 1.2 or later on the web server.
Content types: serve the SVG as image/svg+xml and the PEM as application/pem-certificate-chain or similar. Don't send headers that force a download.
Build the full chain. The PEM file should start with your entity certificate, followed by any intermediate CA certificates and then the root, in the order they were issued. If your CA sends them as separate files, add them to the PEM in that order.
Use the certified logo. When a record has both l= and a=, receivers check that the SVG at l= is identical to the logo in the certificate. Host the file you submitted to the CA, unchanged.
Keep the URLs reachable by mail servers: no login, no geo or IP blocking, no bot or hotlink protection, and no redirect chains that end on another file. The files can live on another domain or a CDN, and some CAs (DigiCert, for example) can host both files for you.

Check the HTTPS certificate on your logo host with the SSL Certificate Checker.

Step 5: Publish the BIMI record

Host:  default._bimi
Type:  TXT
Value: v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem

Tag	Meaning
`v=BIMI1`	Required, and must be the first tag, spelled exactly like this.
`l=`	HTTPS URL of the SVG logo. Leave it empty only in a declination record or when the logo comes from the certificate (see below).
`a=`	HTTPS URL of the VMC or CMC PEM file. If it's empty or missing, the logo is self-asserted.
`avp=`	Optional: `brand` (the default) or `personal`. It tells providers that also show personal profile pictures which one you prefer.

Publish exactly one v=BIMI1 record per name. If receivers find more than one, they skip BIMI.
Receivers don't correct syntax errors. Separate tags with semicolons and use full https:// URLs. If your DNS host splits long values into several strings, receivers join them back together, as they do for SPF.
Google's own example leaves l= empty and puts only the PEM URL in a=, because Gmail reads the logo from the certificate. Filling in l= as well keeps the logo working at providers that accept self-asserted logos, such as Yahoo.

Subdomains, extra domains and selectors

Subdomains: for mail from news.example.com, receivers try default._bimi.news.example.com first and then fall back to default._bimi.example.com. One record on the organizational domain covers all subdomains. Publish a record on a subdomain only if it needs a different logo.
Opting a subdomain out: publish a declination record, v=BIMI1; l=; a=;, at default._bimi.<subdomain>. Receivers record bimi=declined and show no logo, even though the parent domain has one.
Several domains, one logo: the BIMI draft recommends a CNAME, for example default._bimi.example.net pointing to default._bimi.example.com. Each domain still needs DMARC at enforcement and, if you use a certificate, has to be listed in it.
Selectors: to use a different logo for one mail stream, publish it at, say, brand._bimi.example.com and add the header BIMI-Selector: v=BIMI1; s=brand; to those messages. The header has to be covered by your DMARC-aligned DKIM signature, or receivers ignore it. Support for selectors varies by provider.

Step 6: Verify

DNS: look up the TXT record at default._bimi.example.com with DNS Lookup or the DNS Propagation Checker, or from PowerShell: Resolve-DnsName default._bimi.example.com -Type TXT.
DMARC: run the DMARC Record Checker on the organizational domain and on every sending subdomain. Look for p=none, pct below 100, t=y or sp=none.
Files: curl -sI https://example.com/bimi/logo.svg should return 200 and content-type: image/svg+xml with no redirect. Check the PEM URL the same way.
Certificate: openssl x509 -in vmc.pem -noout -subject -issuer -enddate -ext extendedKeyUsage shows the first certificate in the file. In a VMC, the subject includes the mark type (for example 1.3.6.1.4.1.53087.1.13=Registered Mark), the issuer is the CA's mark certificate CA, the extended key usage reads "Brand Indicator for Message Identification", and notAfter is the expiry date.
Real mail: send a normal message to Gmail, Yahoo and iCloud test mailboxes. Receivers that support BIMI may add a bimi= result to Authentication-Results: pass, none (no record), fail, temperror, declined or skipped (for example, the message failed DMARC). Paste the headers into the Email Header Analyzer to check DMARC and alignment.
Whole domain: the Email Deliverability Checker looks at SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI together.

Common mistakes

DMARC at p=none, or p=quarantine with pct below 100, or a leftover t=y.
sp=none on the organizational domain, which turns BIMI off for the whole domain.
Mail that passes SPF only for the mail service's own bounce domain, so DMARC isn't aligned. Set up DKIM with your domain at every service that sends for you.
A regular SVG export with no baseProfile="tiny-ps", no <title>, x/y on the root element, an embedded PNG or a linked font.
A logo that isn't square or has a transparent background, so it looks wrong when cropped to a circle.
Logo or PEM served over HTTP, behind a redirect, as text/html, or blocked by a firewall or bot protection.
A PEM with only the entity certificate when the CA sent the intermediate and root separately.
Editing the SVG at l= after the certificate was issued, so it no longer matches the certified logo.
Two v=BIMI1 records at default._bimi.
Expecting a logo in Gmail or Apple Mail without a certificate, or in Outlook at all.
Letting the VMC or CMC (or the trademark behind it) expire.

FAQ

Do I need a VMC to use BIMI?

It depends on the mailbox provider. Gmail requires a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC), and Apple Mail needs a verified evidence document such as a VMC. Yahoo shows self-asserted logos without a certificate for bulk mail with enough reputation and engagement. Without a certificate, publish the BIMI record with only the l= logo URL.

What is the difference between a VMC and a CMC?

A VMC needs a registered trademark (or a government mark) and makes Gmail show a blue verified checkmark next to your logo. A CMC needs no trademark: it covers a logo you have shown publicly on your own domain for at least 12 months, which the CA checks in the Internet Archive, or a modified registered trademark. Gmail shows a CMC logo without the checkmark.

What DMARC policy does BIMI need?

DMARC must be at enforcement on both the organizational domain and the From domain: p=quarantine or p=reject. With quarantine, any pct tag must be 100 (leaving pct out also works), and the record should not use t=y, the testing flag that replaced pct=0 in RFC 9989. A subdomain policy of sp=none stops BIMI as well.

Why is my BIMI logo not showing in Gmail?

The usual causes are a missing or invalid VMC or CMC (Gmail does not accept a standalone SVG), DMARC at p=none or pct below 100, mail that does not pass aligned DMARC, a logo that is not valid SVG Tiny PS or smaller than 96 by 96 pixels, or logo and PEM URLs that do not return the files over HTTPS. Google says a new record can take up to 48 hours to show.

Does Outlook support BIMI?

No. The BIMI Group lists Microsoft as not supporting BIMI, so Outlook and Outlook.com do not show logos from your BIMI record. The same record still works at Gmail, Apple Mail, Yahoo and the other providers that support BIMI.

How to Set Up BIMI: VMC vs CMC and SVG Tiny PS