How to set up BIMI: DMARC, the logo and the certificate

Updated on 11 Sep 2026

BIMI shows your company's verified logo beside your emails, in the inbox of whoever receives them. It is not a setting you switch on: it is the result of having authenticated mail, a logo in one specific format, and a certificate vouching that the logo is yours.

This is the whole path, in order, with the commands to check each step.

What it takes, in one table

Step 2 is what stops nearly everyone, and it is the one that takes real work.

Step 1 — SPF and DKIM, aligned

Everything below depends on this. See what you have:

dig +short TXT yourdomain.com | grep spf
dig +short TXT selector._domainkey.yourdomain.com

The detail people miss is alignment. It is not enough for SPF and DKIM to pass: the domain they validate has to be the same one in the From: the reader sees. A sending platform that signs with its domain passes DKIM and fails DMARC all the same.

If you send through Google Workspace, Microsoft 365, Mailchimp, SendGrid or similar, each has its own way of signing as you. The real work of this step is finding every service that sends mail in your name — usually more than anyone remembers: billing, the CRM, application notifications, the contact form on the site.

Step 2 — DMARC, from p=none to enforcement

See where you stand:

dig +short TXT _dmarc.yourdomain.com

Three possible answers:

• Nothing. You have no DMARC. Start at p=none to observe, never at p=reject.
• p=none. You have DMARC and it does nothing: it asks for reports and blocks nobody. This is where most domains are.
• p=quarantine or p=reject. You are at enforcement and can go to step 3.

How to climb without losing mail

The expensive mistake is jumping from p=none to p=reject overnight: if some legitimate service was not aligned, its mail starts bouncing and nobody finds out until a customer complains.

The safe path has stages:

1. Publish p=none with reporting and leave it for a few weeks:

   Copy

   v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
   

2. Read the aggregate reports. They arrive as XML, one per provider per day, saying which IP sent mail as you and whether it passed SPF, DKIM or neither. The forgotten services show up here.

3. Fix what fails, one at a time, until the reports contain only sources you recognise.

4. Move to p=quarantine with a percentage, which applies the policy to a fraction of the mail:

   Copy

   v=DMARC1; p=quarantine; pct=25; rua=mailto:reports@yourdomain.com
   

   Go 25, 50, 100 over weeks, reading the reports between each.

5. Once pct=100 has been quiet for a while, move to p=reject if you want the strongest setting. BIMI is satisfied by quarantine.

That is weeks, not an afternoon. It is the price of the logo meaning something: precisely because nobody can reach the inbox impersonating you, the mail provider is willing to draw your face.

Step 3 — The logo in SVG Tiny P/S

Not any SVG will do. The format is SVG Tiny 1.2 Portable/Secure, a restricted subset:

• No scripts, no animation, no external references.
• Square — the canvas, not the drawing.
• Carrying baseProfile="tiny-ps" and a <title> with the brand name.
• A solid background, not transparent: the inbox crops it to a circle and transparency looks dirty there.

If your logo is horizontal there is a design decision here, not a technical one: what fits in a forty-pixel circle is the symbol, not the full wordmark. Nearly every brand ends up using its mark alone.

Step 4 — The certificate

Two options, and the difference is what they ask of you:

• CMC (Common Mark Certificate): no registered trademark. It asks instead that the logo has been in continuous use for twelve months on a domain you own. Shows the logo in Gmail and Yahoo.
• VMC (Verified Mark Certificate): requires the logo to be a registered trademark in one of seventeen accepted offices. Adds Gmail's blue checkmark.

If your mark is not registered in any of those offices, the CMC is the one that can be issued. The list is on each product page.

The authority validates your organisation and — depending on which — the trademark registration or the logo's use. Three to seven business days.

Step 5 — The BIMI record

With the certificate in hand, publish a TXT:

Name:   default._bimi
Value:  v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

• l= is the address of the logo. It has to be served over HTTPS.
• a= is the address of the certificate, in PEM.

You publish both files yourself, on your own domain or anywhere else, as long as they answer over HTTPS.

Checking that it took

dig +short TXT default._bimi.yourdomain.com
dig +short TXT _dmarc.yourdomain.com
curl -sI https://yourdomain.com/logo.svg | head -1

Then be patient: providers cache. Gmail can take days to start showing it, and does so first for people who already had you in their contacts.

Frequently asked

Do I need the certificate, or is the BIMI record enough? Gmail and Yahoo require the certificate. Without it the record publishes and nothing happens.

Does it work for subdomains? The record goes on the domain you send from. If you send from mail.yourdomain.com, the TXT goes at default._bimi.mail.yourdomain.com, and the organisational DMARC policy has to cover it.

What if I change the logo? The certificate is bound to that exact logo. A CMC can be reissued within 30 days; a VMC cannot be reissued at all, so a rebrand means a new certificate.

How long does all of it take? If you are already at enforcement, a week. If you are at p=none, count one to three months — the time belongs to step 2, not to the certificate.

Where to go next

TiendaSSL sells the Common Mark Certificate and the Verified Mark Certificate, and checks your DMARC and your logo at no cost before you buy anything. If step 2 is the one you are missing, we do it with you.