BIMI Setup Guide 2026: Get Your Logo Showing in Gmail and Outlook.

To set up BIMI in 2026, get DMARC enforced at p=quarantine or p=reject, convert your logo to a square SVG Tiny P/S file, buy a Verified Mark Certificate (VMC) from Entrust, DigiCert, or Sectigo, then publish a TXT record at default._bimi.yourdomain.com pointing to both files. Gmail requires the VMC to show your logo; Outlook support is still rolling out gradually.

What Is BIMI and Why Your Logo Isn’t Showing Yet

BIMI (Brand Indicators for Message Identification) is a DNS record that tells inbox providers which logo to display next to your emails. Instead of a grey circle with your first initial, recipients see your actual brand mark before they even open the message.

The catch is that BIMI sits on top of your existing email authentication. If SPF, DKIM, or DMARC aren’t already solid, the logo simply won’t render — with no error message telling you why. That silent failure is the single biggest reason BIMI setups stall halfway through.

What BIMI actually gets you:

• A recognizable logo in Gmail, Yahoo, Apple Mail, and (gradually) Outlook
• A forcing function to finish DMARC enforcement, which improves deliverability on its own
• A visible trust signal that makes phishing harder to fake

What it doesn’t do: BIMI is not a spam-filter bypass. It’s a branding layer that sits on top of an already well-delivered email — it won’t fix a domain with poor sender reputation.

Stop guessing why your emails aren’t landing right

Before you touch BIMI, make sure your domain’s foundation — DNS, SPF, DKIM, and a working contact form — is actually solid. We audit and fix the whole stack.

Get a Free Quote →

Which Inboxes Actually Show the Logo in 2026

Support varies more than most guides admit, and the VMC requirement is the detail that trips people up.

Gmail and Apple Mail together cover the large majority of everyday email opens, and both flatly refuse to show a logo without a VMC. Yahoo, AOL, and Fastmail will show your logo with just a DNS record and a compliant SVG — no certificate needed. Outlook is the odd one out: Microsoft has been rolling out limited support since 2025, but it’s inconsistent, so don’t build your whole BIMI business case around Outlook showing up on day one.

Prerequisite: DMARC Enforcement (Do This First)

BIMI will not activate on a p=none DMARC policy. You need p=quarantine or p=reject, and in practice Gmail and Apple Mail lean toward wanting p=reject before they’ll reliably display anything.

If you’re starting from p=none, don’t jump straight to p=reject — a botched jump can silently block legitimate mail from services you haven’t authenticated yet, like your CRM or contact form provider. A safer progression:

1. Weeks 1–2: Sit at p=none and just monitor DMARC aggregate reports
2. Weeks 3–4: Move to p=quarantine; pct=25
3. Weeks 5–6: Increase to p=quarantine; pct=100
4. Week 7+: Move to p=reject once reports are clean
5. After enforcement is stable: Start the BIMI logo and VMC work

While you’re in there, confirm SPF and DKIM are passing for every sending source — marketing platform, transactional sender, CRM, all of it. A DNS record misconfigured at the registrar is a common reason DMARC alignment quietly fails even when SPF and DKIM look fine individually.

Step 1: Build a BIMI-Compliant SVG Logo

A regular SVG exported from Illustrator or Figma will not pass BIMI validation. It has to follow the SVG Tiny Portable/Secure (SVG P/S) profile, a stripped-down, security-restricted version of SVG.

Requirements checklist:

• Perfectly square canvas with a viewBox attribute
• Solid background — no transparency
• Logo mark only, no text or slogans
• No embedded raster images, gradients kept simple, no animations or scripts
• Under 32 KB in file size
• Valid SVG XML (no Base64-encoded content)

A minimal compliant header looks like this:

xml

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 100 100">
  <title>Your Company Name</title>
  <!-- logo paths here -->
</svg>

Getting there in practice:

1. Start from your highest-resolution logo file
2. Open it in Inkscape, Illustrator, or Figma
3. Force the artboard to a square with a solid fill
4. Expand any text to outlines — text elements aren’t allowed
5. Export as SVG Tiny 1.2, then manually edit the header to declare baseProfile="tiny-ps"
6. Run it through the BIMI Group’s free validator before you host it
7. Host the file over HTTPS with no redirects, e.g. https://yourdomain.com/bimi/logo.svg

If your brand mark is even slightly complex, it’s often faster to hand this to a designer familiar with BIMI than to fight the SVG Tiny P/S export yourself.

Step 2: Get a Verified Mark Certificate (VMC)

The VMC is what separates a real BIMI logo from something anyone could fake by publishing a random DNS record. It’s a certificate that cryptographically ties your registered trademark to your logo file and your domain.

Who issues them (as of 2026):

• Entrust
• DigiCert
• Sectigo

What you’ll need before applying:

• A registered trademark for your logo in the relevant jurisdiction (USPTO in the US) — this alone can take 8–18 months if you haven’t started yet
• Proof of domain ownership, usually via a DNS TXT record or a file placed at a specific URL
• Your BIMI-compliant SVG file for the CA to review

Typical cost: $1,000–$1,500 per year, per domain. That’s the real budget line item in a BIMI project, and it’s the main reason smaller brands skip Gmail/Apple Mail coverage and settle for the free-tier support on Yahoo, AOL, and Fastmail instead.

Once issued, the CA gives you a .pem certificate file. Host it over HTTPS just like the logo — no authentication wall, no redirects.

Not sure your DNS is ready for a project like this?

BIMI, DMARC, and VMC records all live in the same DNS zone — one typo can break all three. Let us set it up correctly the first time.

Talk to an Expert →

Step 3: Publish the BIMI DNS Record

The BIMI record is a TXT record at a specific, fixed subdomain: default._bimi.yourdomain.com.

Record syntax:

default._bimi.yourdomain.com  TXT  "v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem"

In your DNS provider’s dashboard: set the record type to TXT, the host/name to default._bimi, paste the value above, and use a TTL around 3600 seconds. Propagation is usually done within an hour, though it can take up to 48 hours in rare cases.

Sending from a subdomain (like newsletter.yourdomain.com)? Gmail generally applies the root domain’s BIMI record if DMARC alignment covers the subdomain, but publishing an explicit default._bimi.newsletter.yourdomain.com record removes any ambiguity. Each additional sending domain needs its own SVG, its own VMC, and its own record — there’s no shortcut across domains.

Step 4: Verify Everything Actually Works

Don’t just publish the record and hope. Check every layer before you consider the project done.

• BIMI TXT record resolves at default._bimi.yourdomain.com
• Logo URL loads over HTTPS with zero redirects
• Logo validates as SVG Tiny P/S (use the BIMI Group’s validator)
• VMC URL loads over HTTPS and the certificate hasn’t expired
• DMARC is at p=quarantine or p=reject
• SPF and DKIM pass for every sending source
• A test email to a Gmail address shows the logo within 24–48 hours

Run the domain through MXToolbox’s BIMI lookup or the BIMI Group Inspector — both will flag exactly which piece is missing if the logo still isn’t rendering.

Common Mistakes That Kill BIMI Logo Display

Publishing BIMI before DMARC enforcement is done. This is the single most common failure. The record looks fine, validators may even pass it, but Gmail and Apple Mail simply won’t show anything until enforcement is confirmed stable.

Standard SVG instead of SVG Tiny P/S. A file that opens fine in a browser can still fail BIMI validation because it contains disallowed elements like embedded rasters or scripts.

Redirects on the logo or VMC URL. Even a harmless HTTP-to-HTTPS redirect can cause some validators to fail to retrieve the file. Host it at the final URL directly.

VMC issued for the wrong domain. A certificate for yourdomain.com won’t cover mail.yourdomain.com — check subdomain coverage with your CA up front.

Letting the VMC lapse. It’s an annual certificate, and expiry kills logo display instantly with zero warning from inbox providers. Set a renewal reminder 30 days ahead.

If your domain’s DNS setup already feels fragile or your emails have a history of landing in spam, fix that foundation before layering BIMI on top — a shaky authentication stack will just make the BIMI failures harder to diagnose.

Is BIMI Worth the Cost?

For brands sending mostly to Yahoo, AOL, or Fastmail users, BIMI without a VMC is essentially free once DMARC is enforced — just DNS and an SVG file. For Gmail and Apple Mail coverage, you’re weighing a $1,000–$1,500/year VMC plus trademark registration against a reported 5–15% open-rate lift and a meaningful bump in brand recall, according to CA and inbox-provider studies.

It tends to make the most sense for:

• Brands with existing name recognition, where a familiar logo speeds up the “should I open this” decision
• Companies sending high volumes of transactional or account-related email, where trust cues matter
• Teams that already run solid email marketing infrastructure and just need the last authentication layer

It’s a weaker bet for very small lists or brand-new domains still building sender reputation — get the fundamentals of deliverability right first.

Get your email infrastructure production-ready

From DNS records to DMARC enforcement to the final BIMI logo, we can handle the entire authentication stack so your brand shows up correctly everywhere.

Get a Free Quote →

Conclusion

A proper BIMI setup in 2026 comes down to four things in order: get DMARC to enforcement, build a compliant SVG logo, decide whether the VMC is worth it for Gmail and Apple Mail coverage, and publish a clean DNS record with no redirects anywhere in the chain. Skip the order — especially publishing BIMI before DMARC is enforced — and you’ll get a silent failure with nothing to debug. Outlook support is still catching up, so treat Gmail, Apple Mail, Yahoo, and AOL as your real BIMI setup targets for now.