Skip to content

What is a BIMI record?

By Ash, Founder, HosteazePublished 2 min read

The short answer

A BIMI (Brand Indicators for Message Identification) record is a DNS TXT record that points to your logo, so supporting inboxes such as Gmail, Apple Mail and Yahoo can show it next to your emails. It only works if your domain already enforces DMARC at quarantine or reject, and most inboxes also want a paid mark certificate.

A gold signet ring engraved with a coat of arms, an old way of marking a letter as genuinely from you, as BIMI does for email.
Credit: Letiha via Pixabay

You've probably seen it already: a brand's logo in the little circle next to its email in Gmail, where everyone else gets a coloured initial. That logo comes from BIMI. It's the last and fussiest layer of email authentication, and it only works once the layers underneath it are solid.

How does BIMI work?

  1. You publish a TXT record at default._bimi.yourdomain.co.uk that points to your logo file and, usually, a certificate.
  2. Your email arrives at an inbox that supports BIMI.
  3. The receiver checks that the message passed DMARC and that your domain's policy is strict enough.
  4. If everything checks out, it fetches your logo and shows it beside your message.

Here's a real one, PayPal's, which we looked up in October 2026:

default._bimi.paypal.com   TXT   "v=BIMI1; l=https://www.paypalobjects.com/marketing/web/logos/paypal_ppe.svg; a=https://www.paypalobjects.com/marketing/web/logos/PPE_UK_DE_paypal_inc.pem"
PartMeaning
default._bimiThe host name. It's always default._bimi unless you use multiple logos.
v=BIMI1Identifies the record as BIMI.
l=The web address of your logo, as an SVG file.
a=The web address of your mark certificate (a .pem file). Gmail needs this.

Like SPF, DKIM and DMARC, it's just a TXT record in your DNS.

What do I need before BIMI will work?

Google's requirements are the strictest, and they're the ones most businesses care about:

  1. A DMARC policy of p=quarantine or p=reject, applied to all your mail (pct=100). A policy of p=none doesn't count.
  2. Your logo as an SVG file in the SVG Tiny Portable/Secure format, at least 96 by 96 pixels, ideally square with a solid background.
  3. A Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) from a certificate authority that issues them.
  4. HTTPS hosting for the logo and certificate files.

The VMC route needs your logo to be a registered trademark. Google notes that the trademark process can take 6 to 12 months, and it shows a blue checkmark next to senders verified with a VMC. A CMC is the option for logos that aren't trademarked; it gets the logo but not the checkmark.

After you add the record, Google says it can take up to 48 hours for the logo to appear.

Which inboxes show BIMI logos?

Mailbox providerLogo shown? (BIMI Group, October 2026)
GmailYes, in webmail and the app
Apple Mail (iCloud)Yes
YahooYes
FastmailYes
Microsoft OutlookNot listed

Should my business set up BIMI?

Get your DMARC policy to quarantine or reject first, whatever you decide about logos. That's the part that protects your customers from fake emails in your name, and our DMARC p=none vs quarantine vs reject guide shows how to get there safely. Once you're at enforcement, BIMI is a branding decision: lovely for a retailer sending thousands of order emails, hard to justify for a five-person consultancy.

Frequently asked questions

Is BIMI worth it for a small business?

Usually not yet. Getting DMARC to enforcement is worth doing for every business, because it stops people faking your domain. The logo on top needs a paid certificate and, for Gmail's blue checkmark, a registered trademark, which is a lot of effort for a small sending volume.

Does BIMI improve deliverability?

Not directly. BIMI shows a logo; it doesn't make filters trust you more. But the DMARC enforcement BIMI requires does help protect your domain's reputation.

Does Outlook show BIMI logos?

Microsoft isn't on the BIMI Group's list of supporting mailbox providers as of October 2026, so plan on Outlook users not seeing your logo.

Sources

  1. Google Workspace, Set up BIMI
  2. BIMI Group, BIMI support by mailbox provider
  3. BIMI Group, Verified Mark Certificates (VMC) and BIMI

Keep reading

A brass padlock with two keys beside it on a white backgroundTutorialHow to set up DMARC for Microsoft 365Add an SPF record with include:spf.protection.outlook.com, then create the two DKIM CNAME records Microsoft gives you and switch on DKIM signing in the Defender portal. Once both pass, add a TXT record at _dmarc with v=DMARC1; p=none; rua=mailto: and a reporting address, and tighten the policy later.Email and domains · 15 October 2026An old iron key in a rustic wooden door lockTutorialHow to set up DMARC for Google WorkspaceFirst make sure SPF includes _spf.google.com and DKIM is switched on in the Google Admin console. Wait 48 hours, then add a TXT record at _dmarc on your domain with the value v=DMARC1; p=none; rua=mailto: followed by a reporting address. Read the reports for a few weeks before moving to quarantine.Email and domains · 15 October 2026A tall stack of envelopes and letters seen side on, the scale bulk senders work atQuestionGoogle, Yahoo and Outlook bulk sender rules, explainedGmail, Yahoo and Outlook.com require anyone sending around 5,000 or more emails a day to them to pass SPF, DKIM and DMARC, offer one-click unsubscribe and keep spam complaints below 0.3%. Every sender, whatever the volume, needs at least SPF or DKIM, valid reverse DNS and a low spam rate.Email and domains · 15 October 2026Red octagonal stop sign against a blue sky, like a mail server refusing a messageQuestionWhat does a 550 email bounce error mean?A 550 error means the receiving mail server permanently refused your email, so it won't try again. The extra code after it gives the reason. 5.1.1 means the address doesn't exist, 5.7.1 means it was blocked as spam or by a policy, and 5.7.26 means your domain's SPF or DKIM authentication failed.Email and domains · 14 October 2026Two stacked cardboard boxes, ready for a move, like your email moving to a new providerTutorialHow to change MX records without losing emailLog in to wherever your domain's DNS is managed, delete the old MX records, and add the new ones your email provider gives you with the exact priority numbers. Lower the TTL a day before if you can. New email reaches the new provider within minutes to hours, so keep the old mailboxes open for a few days.Email and domains · 14 October 2026

Want email on your own domain?

Hosteaze hosting plans let you set up mailboxes on your own domain. See what each plan includes.

See hosting plans