BIMI Setup Guide
Brand Indicators for Message Identification (BIMI) displays your logo in supporting email clients. DDMARC hosts your logo, your VMC and the BIMI record itself from the Growth plan upward — you delegate with one CNAME.
Prerequisites
- • DMARC policy set to
p=quarantineorp=reject - • Your brand logo in SVG Tiny PS format
- • A Verified Mark Certificate (VMC) — required by Gmail and Apple Mail, optional elsewhere
- • Managed hosting requires the Growth plan or above; self-hosting the logo works on any plan
What is BIMI?
BIMI is an email standard that allows your brand logo to appear next to authenticated emails in supported email clients. This increases brand visibility and helps recipients identify legitimate emails from your organization.
Brand Recognition
Your logo appears in the inbox
Trust Signal
Recipients see you're authenticated
Phishing Protection
Only authenticated mail shows logo
Prepare Your Logo
Your logo must be in SVG Tiny PS (Portable/Secure) format. This is a restricted subset of SVG that ensures security and compatibility.
SVG Requirements
Tip: Use the BIMI Generator to convert your logo to the correct format.
Publish through Managed BIMI
With managed BIMI you do not host the logo or write the BIMI record yourself. DDMARC stores and serves both files over HTTPS and publishes the record in its own zone; you delegate to it with a single CNAME.
- 1.In the dashboard, open Domains and select your domain
- 2.Go to the Hosted Services tab and find the Managed BIMI card
- 3.Click Choose logo SVG and pick your SVG Tiny PS file
- 4.Optionally click Add VMC (.pem, optional) and attach your certificate
- 5.Click Publish. DDMARC validates the files first and shows any warnings before it serves them
What validation checks, and the limits
- • The SVG is checked against the SVG Tiny PS profile — scripts, external references and animation are rejected outright.
- • The VMC is parsed as PEM before it is accepted.
- • Both files are capped at 64 KB. A logo anywhere near that ceiling is almost always over-detailed for a 32-pixel avatar.
- • Publishing replaces both files together, so re-select the logo when you add or swap a VMC.
The card also shows the URLs DDMARC serves your assets from — the logo lives at https://api.ddmarc.com/api/v1/public/bimi/example.com/logo.svg (with your own domain in place of example.com). You do not need to paste this anywhere; DDMARC writes it into the BIMI record for you.
Delegate the BIMI record
Add one CNAME record in your own DNS. It points the BIMI selector at the record DDMARC publishes, so future logo or VMC changes never require another DNS edit.
Host: default._bimi.example.com
Type: CNAME
Value: example.com.bimi.dmarc.ddmarc.comSubstitute your own domain for example.com, and copy the exact host and target from the Managed BIMI card. The selector is always default. DDMARC checks the delegation on a schedule and alerts you if it stops resolving.
Self-hosting instead: publish the TXT yourself
If you host the SVG (and VMC) on your own HTTPS infrastructure, skip the delegation and publish a TXT record at default._bimi instead. Do one or the other — never both.
v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pemv=BIMI1— BIMI versionl=— HTTPS URL of your SVG Tiny PS logoa=— optional HTTPS URL of your VMC; omit the tag entirely if you have no certificate
Verified Mark Certificate (VMC)
Gmail and some other providers require a Verified Mark Certificate (VMC) to display your BIMI logo. VMCs are issued by certificate authorities after trademark verification.
Email Client Support
| Provider | BIMI Support | VMC Required |
|---|---|---|
| Gmail | Yes | Yes |
| Apple Mail | Yes | Yes (VMC or CMC) |
| Yahoo Mail | Yes | No |
| Fastmail | Yes | No |
| Microsoft Outlook | Announced | VMC expected |
Provider behaviour changes; last reviewed July 2026. Check the BIMI Group for the current state before planning around a specific mailbox provider.
Verify Your Setup
After adding the CNAME (or TXT), DDMARC monitors your BIMI configuration on a schedule and raises an alert if the delegation breaks or the record disappears. Check the DNS Monitoring page in the dashboard to confirm it resolves. Remember that most receivers only display a logo when the domain is at p=quarantine or p=reject.