What Is BIMI? Requirements and Costs for a Logo in Gmail

BIMI (Brand Indicators for Message Identification) is a record in your domain's DNS (Domain Name System) that tells inboxes which logo to show beside your emails. In Gmail, the logo fills the round space next to the sender's name, in the inbox list and in the open message.

DMARC, the policy that tells receiving servers what to do with mail failing your checks, has to be at enforcement (quarantine or reject) first. Gmail and Apple Mail also want a paid certificate proving you own the logo.

Of 40 large UK consumer brands we checked, 37 had DMARC at enforcement, but only 15 had gone on to publish BIMI.

Which inboxes show BIMI logos

Apple Mail, Gmail and Yahoo Mail all display BIMI logos. Apple's app does so on iOS 16, iPadOS 16, macOS Ventura 13 or later and iCloud.com (Apple Support). It shows a logo only when the recipient's own mail provider has run the BIMI checks and been approved by Apple (Apple Developer).

Yahoo shows them in its mobile apps, for its own users and for AOL, which Yahoo also runs. It says the read view of its desktop webmail will show them too (Yahoo Sender Hub).

Microsoft is the big exception. The BIMI Group lists it as not supporting BIMI, so people on Outlook.com, Hotmail or Microsoft 365 see no BIMI logo. BT, the broadband provider, sits on the same list as "considering BIMI", with no date given (BIMI Group, May 2025).

Gmail adds a blue tick beside the From name when the logo comes with a Verified Mark Certificate (VMC). Pointing at the tick shows details about the domain behind it (Gmail Help).

BIMI changes what the inbox shows, not where the email lands. Its maintainers call it a display signal layered on authentication, with no effect on delivery. A logo can help recognition, but it is no guarantee of trust (BIMI FAQ).

What BIMI needs before a logo appears

Gmail and Apple Mail need all four items below; Yahoo and Fastmail skip the certificate. Even then, the provider decides: Yahoo wants bulk mail from an address with enough sender reputation and engagement, and Gmail runs its usual anti-abuse checks first.

1. DMARC at enforcement: p=quarantine or p=reject, on your sending domain and on its main (organisational) domain. A pct tag, if present, must say 100, and a subdomain tag of sp=none rules BIMI out (Internet-Draft 14, May 2026, not yet a finished standard).
2. A logo in SVG (Scalable Vector Graphics) Tiny P/S, a locked-down image format covered below.
3. A mark certificate, either a VMC or a Common Mark Certificate (CMC), for Gmail or Apple Mail.
4. The record itself: a TXT (text) entry at default._bimi that points to the logo and the certificate.

Google, Yahoo and Microsoft accept p=none from bulk senders (sender requirements), so a domain can meet their rules and still fail this first check. Moving DMARC from none to reject takes a few weeks of reading reports, until every service sending as your domain passes.

How to check whether your domain is ready

Two DNS lookups show where your domain stands. The dig command, built into macOS and most Linux systems, answers both; put your own domain in place of the example:

dig +short TXT _dmarc.example.co.uk
dig +short TXT default._bimi.example.co.uk

On Windows, nslookup -type=TXT _dmarc.example.co.uk answers the same question. For a check in the browser, use the free BIMI Inspector on bimigroup.org.

Run against mailgraf.com on 25 October 2026, the BIMI lookup came back empty:

$ dig +short TXT default._bimi.mailgraf.com
(no answer)

Our domain has no BIMI record, and its DMARC policy is still p=none, so no inbox would show our logo today.

VMC, CMC or no certificate

Gmail accepts a VMC or a CMC, but only a VMC adds the blue tick, and it is the only type Apple's documentation names.

Either way, the certificate is a file from a certificate authority confirming that your organisation may use the logo. The logo sits inside it, and you host it as a .pem file that your BIMI record points to (Google Workspace Admin Help).

A VMC needs the logo registered as a trade mark. Any office recognised by WIPO (World Intellectual Property Organization) counts, the UK Intellectual Property Office included (Mark Certificate Requirements 1.8, June 2026). The same document caps every mark certificate at 398 days.

A UK trade mark application costs at least £205 and usually takes 3 to 4 months if nobody objects (gov.uk, October 2026). The issuer then checks that your SVG matches the registered logo, colours included.

A CMC covers an unregistered logo. The issuer checks that your website shows it now and that archive.org shows it on the same domain at least 12 months earlier. A logo redesigned six months ago does not qualify yet.

Apple's pages also mention "other forms of BIMI Evidence Documents" without listing them, so if many of your readers use Apple Mail, plan on a VMC.

Certificates come only from issuers on the Mark Verifying Authority list, and each mailbox provider picks whose certificates it trusts. None of the VMC pages we checked, at DigiCert, GlobalSign and SSL.com, showed a public price.

What large UK brands publish

Only 15 of the 40 large UK brands we checked publish BIMI, every one of them with a VMC, and four of those certificates had expired.

The sample covers consumer brands in retail, banking, telecoms, travel, energy and media, looked up on 25 October 2026. For every BIMI record, we also opened the certificate it named.

What we found	Brands
DMARC at quarantine or reject	37 of 40
Enforced, but with sp=none, which rules out BIMI	1 of those 37
A BIMI record at default._bimi	15 of 40
BIMI record backed by a VMC	15 of 15
BIMI record backed by a CMC or no certificate	0
Certificate already expired	4 of 15

The expired certificates ran out between May 2025 and September 2026, yet the BIMI records still pointed at them.

Renewal is the part that slips. When a logo stops showing, Google's BIMI troubleshooting page tells you to check the certificate's status with its issuer.

The BIMI record and the logo file

The record is a TXT entry named default._bimi on your From domain. With a certificate, it looks like this:

default._bimi.example.co.uk  TXT  "v=BIMI1; l=https://example.co.uk/bimi/logo.svg; a=https://example.co.uk/bimi/certificate.pem"

l= holds the logo's web address and a= the certificate's, both on HTTPS (secure web) links. Google's examples leave l= empty when the certificate already carries the logo.

A record on your main domain also covers subdomains that have none of their own, so one record usually serves every stream you send.

The logo must be SVG Tiny Portable/Secure (SVG Tiny P/S), a strict profile marked with baseProfile="tiny-ps" and version="1.2". The BIMI standard bans scripts, animation, external links, and x= or y= attributes on the root element.

Gmail adds one hard rule: at least 96 by 96 pixels, written in absolute pixels such as width="96" height="96". Google also recommends, in guidance updated on 22 October 2026:

• A square image with the logo centred.
• A solid background, since transparent ones may display badly.
• A file of 32 kilobytes or less.
• A title element naming your organisation.

No design app exports a file that meets every BIMI rule, Google notes, so the file usually needs hand edits. Its step-by-step instructions start in Adobe Illustrator, turn any text into outlines and finish in a text editor.

Once the record is live, the logo can take up to 48 hours to appear.

When a BIMI logo is within reach

You are closest if your domain already enforces DMARC and the logo is a registered trade mark; the other two starting points take longer.

• Trade mark registered, DMARC at quarantine or reject. What remains is the SVG file, the VMC and the DNS record. The issuer checks your organisation, the trade mark and the domain before issuing the certificate.
• Unregistered logo, on your site for over a year. A CMC puts it in Gmail without the blue tick. Look your domain up on archive.org first, because the issuer will.
• New logo, or DMARC still at none. Expect to wait months. Enforcing DMARC pays off anyway, because receivers then junk or refuse mail that pretends to come from you.

BIMI on a MailGraf sending domain

BIMI is not a MailGraf setting. The record goes in your own DNS, and whether a logo is possible depends on which sender you send from (Add a sending domain).

Only a root domain, such as yourbrand.co.uk, can carry a logo. You control both its DMARC policy and its default._bimi record, so you can take it to quarantine or reject and publish BIMI yourself.

A connected subdomain or a MailGraf domain runs on a DMARC record that MailGraf writes, and today that record says p=none (who writes the record on each connection). BIMI stops there. A MailGraf domain such as yourbrand.postgraf.net has a second problem: issuers certify only domains the applicant controls, and postgraf.net is ours.

Before you tighten DMARC on a root domain for a logo, check that it shows Ready under Sending domain health in the Deliverability report, which tracks its DKIM and SPF verification.