Your logo beside an email can make a real difference when customers are deciding whether to open an invoice, appointment reminder, or sales follow-up. But BIMI is not a simple logo upload. If you are learning how to set up BIMI, start with the straight answer: your domain must already prove it sends authenticated email, and your logo must be verified through the right process.
BIMI stands for Brand Indicators for Message Identification. It lets participating mailbox providers display a verified brand logo next to messages from your domain. It is a trust signal, not a deliverability shortcut. BIMI will not repair a weak sending reputation or force an email into the inbox. What it does is reward domains that have taken email authentication seriously and make legitimate messages easier for recipients to recognize.
What You Need Before You Set Up BIMI
BIMI sits on top of SPF, DKIM, and DMARC. If those records are incomplete, misaligned, or only partly enforced, your BIMI record will not do much for you.
First, make sure SPF authorizes every service that sends mail using your domain. That may include Microsoft 365 or Google Workspace, your marketing platform, CRM, billing system, appointment software, and website forms. A common problem is an SPF record that covers employee email but forgets a third-party sender.
Next, confirm DKIM is enabled for each sending platform. DKIM adds a cryptographic signature to outgoing mail. For BIMI purposes, the important part is alignment: the domain in the DKIM signature needs to align with the visible From domain your customers see.
Finally, DMARC must be active with an enforcement policy. A monitoring-only record using `p=none` is useful while you investigate mail streams, but it generally does not meet BIMI requirements. Your DMARC policy needs to be set to `p=quarantine` or `p=reject`, typically applied at 100 percent with `pct=100`.
This is where many businesses get stuck. Moving from DMARC monitoring to enforcement without checking legitimate senders can cause valid email to fail. If your office uses several systems to send messages, review DMARC reports first. Identify every authorized source, fix its SPF or DKIM alignment, then raise enforcement deliberately.
How to Set Up BIMI Step by Step
Once DMARC is enforced and aligned, you can prepare the visual and certificate pieces.
1. Create a BIMI-ready logo
BIMI uses a specific SVG format, commonly called SVG Tiny Portable/Secure or SVG Tiny PS. A standard SVG exported from a design program may look fine in a browser but still fail BIMI validation.
The logo file should be simple, square, and recognizable at a small size. Avoid scripts, external references, animations, raster images embedded inside the SVG, and unnecessary code. A highly detailed logo can turn into an unreadable blur in an inbox.
Host the final SVG on a secure HTTPS URL that is publicly reachable. Do not place it behind a login page, firewall rule, or temporary file-sharing link. The URL should remain stable because mailbox providers need to retrieve the file when they evaluate your mail.
2. Obtain the right mark certificate
Most organizations need a Verified Mark Certificate, often called a VMC, to have their logo displayed by major participating providers. The certificate ties your logo to a trademark that has been verified by a recognized certificate authority.
That trademark requirement is the biggest BIMI trade-off. A company can have excellent authentication and a professional logo, yet still be unable to complete the most widely supported version of BIMI if its mark is not registered. Some providers and certificate programs support other certificate approaches, including Common Mark Certificates, but display support varies. Check the requirements of the mailbox providers that matter most to your customers before spending money on a certificate.
Certificate validation can require documentation about your business, trademark, and authority to use the logo. Plan for this step. It is not usually a same-day DNS change.
When your certificate is issued, the certificate authority will provide a secure URL for it. Keep that address available for the BIMI DNS record.
3. Publish the BIMI TXT record
BIMI is published as a TXT record in DNS. For the default policy, the hostname is:
`default._bimi.yourdomain.com`
Replace `yourdomain.com` with the domain in your visible From address. The record generally follows this format:
`v=BIMI1; l=https://www.yourdomain.com/logo.svg; a=https://www.yourdomain.com/mark-certificate.pem;`
The `v=BIMI1` value identifies the record as BIMI. The `l=` tag points to your BIMI-ready SVG logo. The `a=` tag points to your VMC or other supported mark certificate.
Use the exact URLs supplied or approved during your certificate process. One wrong character, an inaccessible file, or a redirected URL can prevent validation. DNS providers sometimes add quotation marks around TXT values automatically. That is normal as long as the published value resolves correctly.
Some organizations use a selector other than `default` for a more specialized BIMI configuration. For most small and midsize businesses, the default selector is the right place to begin. Keep the configuration simple until it is working.
4. Verify the record and the sending domain
After publishing, DNS changes may appear quickly or may take hours depending on your provider and the record's TTL. Do not assume the record is correct just because your DNS dashboard says it was saved.
Check that the BIMI hostname returns the intended TXT record. Then confirm the SVG URL and certificate URL open securely without requiring a password. Review your DMARC record again to make sure the policy is still set to quarantine or reject and that the percentage is 100.
A domain health check can help here because BIMI failure is often caused by a dependency, not the BIMI line itself. MailArrive can show the authentication gaps, DNS problems, and reputation issues that may be holding a domain back, in plain language.
5. Send a real-world test
Send mail from the exact domain and platform you want to validate. Test employee mail and any important third-party platforms separately. A logo might appear for mail from one aligned sender but not another if the second source is failing DKIM or DMARC alignment.
Do not judge BIMI only by whether you see a logo in one inbox. Logo display depends on the receiving provider, its current BIMI support, recipient settings, message authentication results, and its own security decisions. Even a correctly configured BIMI record does not guarantee every recipient will see your logo.
Common BIMI Problems and the Exact Fix
The most common issue is trying to publish BIMI while DMARC remains at `p=none`. The fix is not to force the BIMI record. Review DMARC reporting, authorize valid senders, and move to quarantine or reject when you know legitimate mail will pass.
Another frequent problem is a logo that is technically an SVG but not in the required secure Tiny PS profile. Ask your designer or certificate provider for a BIMI-compatible export, then replace the hosted file without changing its availability.
Businesses also run into certificate trouble because the company name, trademark ownership, or logo does not match the supporting documentation. Resolve those ownership questions before applying. A brand refresh can complicate BIMI if the new logo is not covered by the existing certificate.
Finally, do not confuse a missing logo with a failed email. BIMI does not replace the basics: clean mailing practices, low complaint rates, valid recipient lists, secure sending systems, and consistent authentication. A branded indicator can strengthen recognition, but your sending reputation still decides whether the message earns a place in the inbox.
Is BIMI Worth It for Your Business?
BIMI makes the most sense when your organization sends customer-facing email that recipients need to trust quickly. That includes payment notices, legal updates, patient communications, real estate transaction messages, appointment reminders, and branded marketing campaigns.
The value depends on your audience and email volume. If your domain sends only occasional internal messages, a trademark certificate may not be the first deliverability investment to make. If customers regularly receive time-sensitive messages from your business, visible brand verification can help distinguish your legitimate email from impersonation attempts.
Treat BIMI as the visible proof of a larger email health program. Get authentication right, protect the domain with enforced DMARC, keep every sender aligned, and then give recipients one more reason to recognize the messages that matter.