BIMI and VMC/CMC: setup guide
BIMI (Brand Indicators for Message Identification) displays your company logo directly in the recipient's inbox next to the sender name. This guide covers the technical requirements, DMARC configuration, SVG logo requirements, DNS record and the validation process for VMC (Verified Mark Certificate) and CMC (Common Mark Certificate).
Prerequisites
BIMI requires a chain of email authentication mechanisms. All three must be in place before BIMI works:
SPF (Sender Policy Framework)
SPF defines which servers are allowed to send email from your domain. Publish an SPF TXT record that includes all your sending servers and services. SPF is a requirement for DMARC.
DKIM (DomainKeys Identified Mail)
DKIM cryptographically signs each email so the recipient can verify that the content has not been altered in transit. DKIM is a requirement for DMARC alignment.
DMARC with p=quarantine or p=reject
DMARC builds on SPF and DKIM and defines what happens to emails that fail authentication.
BIMI requires at least p=quarantine, but p=reject is the strongest setting.
_dmarc.your-domain.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc@your-domain.com"
Start with p=none and monitor reports via rua= for at least 4 weeks. Switch to p=quarantine and then p=reject once you are confident that all legitimate mail is correctly authenticated.
The DMARC phase is critical. If you set p=reject without having SPF and DKIM correctly configured
for all your sending sources (transactional emails, newsletters, CRM, helpdesk), legitimate emails will be rejected.
Monitor DMARC reports carefully first.
SVG logo requirements
BIMI requires the logo in SVG Tiny PS (Portable/Secure) format. This is a security-restrictive subset of SVG that excludes everything that could pose a risk in email clients.
Allowed in SVG Tiny PS
- ✓ Static vector graphics (paths, shapes)
- ✓ Fill and stroke
- ✓ Text (converting to paths recommended)
- ✓ Basic gradients (linearGradient, radialGradient)
- ✓ Square viewport (1:1 aspect ratio)
Prohibited in SVG Tiny PS
- ✗ JavaScript (scripts)
- ✗ Animation (SMIL, CSS animation)
- ✗ External linking (xlink:href to URLs)
- ✗ Raster images (embedded PNG/JPEG)
- ✗ Filters (blur, drop-shadow)
- ✗ Clipping with complex paths
Standard SVG export from Illustrator or Figma does not meet SVG Tiny PS requirements. These generate SVG with features that are not allowed in SVG Tiny PS. Use a dedicated BIMI SVG conversion tool, or let the CA validate your SVG during the certificate issuance process. DigiCert offers SVG validation as part of the VMC/CMC process.
Logo requirements for VMC vs CMC
| Requirement | VMC | CMC |
|---|---|---|
| Trademark registration | Required (design mark) | Not required |
| Prior use | Not required | At least 12 months |
| Gmail blue checkmark | Yes | No |
| Logo in inbox | Yes | Yes |
| Validation | OV + trademark verification | OV + logo history |
BIMI DNS record setup
BIMI uses a TXT DNS record under default._bimi.your-domain.com. The record points to your SVG logo
and VMC/CMC certificate.
Record format
# Example: FairSSL's BIMI TXT record with VMC certificate default._bimi.fairssl.dk TXT "v=BIMI1; l=https://vmc.digicert.com/4df427fa-...668e22a00d62.svg; a=https://vmc.digicert.com/4df427fa-...668e22a00d62.pem" # Generic format default._bimi.your-domain.com TXT "v=BIMI1; l=https://your-domain.com/logo.svg; a=https://your-domain.com/vmc.pem" # Without certificate (limited support) default._bimi.your-domain.com TXT "v=BIMI1; l=https://your-domain.com/logo.svg; a=;"
v=BIMI1 Version tag. Always BIMI1. l= URL to your SVG logo in SVG Tiny PS format. Must be served over HTTPS. a= URL to your VMC/CMC certificate in PEM format. Empty (a=;) if you do not have a certificate. Host SVG and PEM on your own domain. Use HTTPS and ensure the files are accessible without authentication. Email clients fetch logo and certificate directly. Avoid CDNs with aggressive caching policies, as updates need to propagate quickly when you replace certificates.
Verification
# Check BIMI record nslookup -type=TXT default._bimi.your-domain.com # Check DMARC record nslookup -type=TXT _dmarc.your-domain.com # Linux/Mac dig TXT default._bimi.your-domain.com +short
How it looks in Gmail
BIMI with VMC displays your company logo next to the sender name in the Gmail inbox. With VMC, a blue verified checkmark is also shown, signalling that the sender is confirmed.
Re: Service agreement renewal for 2026
Your SSL certificate has been renewed and installed
Fwd: Quote for new server
3 people viewed your profile this week
Generic initial avatar. No visual identity.
Company logo + blue verified checkmark. Requires trademark registration.
Company logo, but without blue checkmark. Requires proof of at least 12 months of logo usage.
Email client support
| Client | Logo | Blue checkmark | Requirements |
|---|---|---|---|
| Gmail | Yes (VMC + CMC) | VMC only | VMC or CMC required |
| Apple Mail | Yes | Custom design | VMC or CMC required |
| Yahoo Mail | Yes | No | BIMI record (certificate optional) |
| Microsoft Outlook | Partial | Rolling out | Limited support (2026) |
| Thunderbird, others | No | No | No BIMI support yet |
Step-by-step setup
Verify SPF, DKIM and DMARC
Ensure all three are correctly configured and that DMARC has p=quarantine or p=reject. Monitor DMARC reports for at least 4 weeks before setting up BIMI.
Prepare SVG logo in Tiny PS format
Convert your logo to SVG Tiny PS. The logo must have a 1:1 aspect ratio (square), no scripts, no animation, no embedded images. Use a BIMI SVG tool or let the CA validate the file.
Order VMC or CMC via FairSSL
VMC requires documentation of trademark registration (design mark). CMC requires documentation of prior use of the logo. Both undergo OV validation of your organisation. See VMC products.
Host SVG and PEM files
Upload your SVG logo and VMC/CMC PEM certificate to your web server. The files must be served over HTTPS and be publicly accessible.
Create BIMI DNS record
Add the TXT record default._bimi.your-domain with URLs to SVG and PEM.
Test and verify
Send a test email to a Gmail account and verify that the logo is displayed. It may take up to 48 hours for changes to take effect. Use DNS lookups to confirm the BIMI record is correctly published.
VMC and CMC certificates
Frequently asked questions about BIMI and VMC
Find answers to the most common questions about SSL certificates and FairSSL.
a= field). Some email clients display the logo based on the BIMI record alone. However, Gmail, Apple Mail and Yahoo require a VMC or CMC to show the logo. Without a certificate you get virtually no visibility.userSpaceOnUse. The purpose is security: SVG can contain JavaScript, and email clients must ensure logos are harmless. Convert your logo with a BIMI SVG tool, not a standard SVG export.Show your logo in the inbox
Create a free account and issue your first certificate in under 10 minutes.