BIMI Email Authentication in 2026: The Complete Guide

TL;DR

• BIMI (Brand Indicators for Message Identification) displays your verified brand logo next to authenticated emails in supporting inboxes like Gmail, Apple Mail, and Yahoo.
• BIMI is not a deliverability silver bullet — it is a reward for getting authentication right. You need SPF, DKIM, and an enforced DMARC policy first.
• Most major mailbox providers now require a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) before your logo appears.
• Setup is a DNS-and-certificate exercise: publish a DMARC policy at p=quarantine or p=reject, host an SVG logo, get a certificate, then publish a BIMI TXT record.
• The hidden prerequisite nobody talks about: a clean sending list. Bounces and spam traps wreck the DMARC reputation BIMI depends on.

What is BIMI email authentication?#

BIMI is a standard that lets mailbox providers show your official brand logo beside the messages you send — provided you can prove the message is really from you. Think of it like the verified checkmark on a social profile: anyone can type a brand name, but only the brand that controls the domain and passes the checks gets the visual badge.

Technically, BIMI is a text record published in your domain's DNS that points to two things: a specially formatted logo file (an SVG Tiny PS image) and, in most cases, a certificate that proves you own the trademark on that logo. When a supporting inbox receives your email, it checks that the message passed DMARC, looks up your BIMI record, validates the certificate, and then renders your logo in the avatar slot.

The payoff is trust and recognition. Recipients see a consistent, verified logo instead of a gray placeholder or a random initial. Studies shared by the BIMI Group consistently show lifts in open rates and brand recall when logos are present. But the logo is the last 5% of the work — the other 95% is authentication hygiene.

How does BIMI work with SPF, DKIM, and DMARC?#

BIMI sits at the top of a stack. Each layer below it answers a different question about your mail, and BIMI only triggers when the foundation is solid. Here's how the pieces fit together.

The critical line in that table is DMARC. BIMI will not activate on a domain whose DMARC policy is set to p=none. You must move to enforcement — p=quarantine or p=reject — and many providers also want the policy applied to 100% of mail (pct=100). That single requirement is why most BIMI projects stall: getting to safe DMARC enforcement means auditing every system that sends mail in your name.

If those acronyms are fuzzy, Tomba's glossary has plain-English primers on email deliverability, sender reputation, and the SPF record that BIMI builds on.

What is a VMC, and do you need one?#

A Verified Mark Certificate (VMC) is a digital certificate, issued by an approved certificate authority, that confirms two things: you own the domain and you hold a registered trademark on the logo you want to display. It's the mechanism that stops a phisher from slapping a famous brand's logo on their spam.

In 2023, Google and others introduced a lighter-weight option: the Common Mark Certificate (CMC). A CMC lets brands without a registered trademark still display a logo, as long as the logo has been in prior use. The trade-off is reach — not every inbox renders CMC-backed logos, and Apple Mail in particular has favored VMC.

Here's how the two certificate paths compare in 2026:

The two main certificate authorities are DigiCert and Entrust. Expect identity verification that resembles an Extended Validation SSL process: legal entity checks, trademark office lookups, and sometimes a verification call. Budget two to four weeks.

Do you need one? For Gmail and Yahoo, yes — a logo will not display without a valid certificate. The era of "self-asserted" BIMI logos with no certificate has largely closed at the big mailbox providers.

How do you set up BIMI step by step?#

Setting up BIMI is a sequence, not a single switch. Skipping ahead wastes money — buying a VMC before your DMARC is enforced means the certificate sits unused. Follow the order.

1. Authenticate everything. Publish SPF and DKIM for every service that sends on your behalf — your ESP, CRM, transactional mailer, help desk, and invoicing tools. Use a tool like Tomba's SPF checker to confirm the record resolves correctly.
2. Deploy DMARC and monitor. Start at p=none with an rua reporting address. Read the aggregate reports for a few weeks to find every legitimate sender, then fix alignment gaps.
3. Move to enforcement. Step the policy up to p=quarantine, then p=reject at pct=100. This is the gate BIMI checks.
4. Create the logo. Convert your logo to SVG Tiny Portable/Secure (SVG P/S) — a constrained SVG profile, square aspect ratio, on a solid background. Most design tools won't export this directly; the BIMI Group publishes a converter and spec.
5. Get a VMC or CMC. Apply through DigiCert or Entrust. You'll need your trademark registration number (for a VMC) and a copy of the exact logo file.
6. Publish the BIMI DNS record. Add a TXT record at default._bimi.yourdomain.com pointing to your hosted SVG (l=) and your certificate PEM file (a=).
7. Test and validate. Use the BIMI Group's inspector and send test mail to seed accounts at Gmail, Yahoo, and Apple Mail to confirm the logo renders.

A minimal BIMI record looks like this:

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

Which email providers support BIMI in 2026?#

Support has consolidated around the major consumer mailboxes, with certificate requirements now the norm rather than the exception.

Microsoft has been the long-awaited holdout; its BIMI rollout has been gradual, so verify current status before promising stakeholders that "everyone will see the logo." Coverage is wide enough that BIMI is worth doing — just don't oversell universal display.

Does BIMI actually improve deliverability?#

BIMI does not directly boost inbox placement — and any vendor claiming it does is overselling. What BIMI does is force you to complete the authentication work that genuinely drives deliverability, and then it rewards that work with a visible trust signal.

The causation runs like this: to earn BIMI, you must reach DMARC enforcement. Enforced DMARC protects your domain from spoofing, which protects your sender reputation, which is one of the strongest inputs to whether mailbox providers trust your mail. The logo is the cherry; the authentication discipline is the cake.

There's also a secondary, behavioral effect. When recipients recognize a verified logo, they're more likely to open and less likely to mark as spam. Higher engagement and lower complaint rates feed back into reputation. So BIMI helps deliverability indirectly, through both the prerequisites it forces and the engagement it encourages.

What BIMI cannot fix is a dirty list. If you're emailing dead addresses and spam traps, DMARC enforcement and a pretty logo won't save you — your complaint and bounce rates will still tank your reputation. This is where list quality becomes a deliverability prerequisite, not an afterthought. Running addresses through an email verifier before you send removes the invalid and risky contacts that quietly erode the reputation BIMI depends on.

What are common BIMI mistakes to avoid?#

Most failed BIMI deployments trip on the same handful of issues. Watch for these:

• Stopping at p=none. Monitoring mode is necessary, but it is not enforcement. BIMI ignores none. You must commit to quarantine or reject.
• Wrong logo format. A standard SVG or PNG will be rejected. It must be SVG Tiny P/S, square, with a solid (non-transparent) background.
• Buying the certificate too early. A VMC is useless until DMARC is enforced and the logo is hosted. Sequence matters.
• Forgetting subdomains. Your transactional and marketing subdomains may need their own DMARC alignment and BIMI records.
• Ignoring list hygiene. Spoofing protection means nothing if your own list is full of traps and bounces. Clean data is the foundation under the whole stack.
• Assuming universal display. Outlook coverage is still rolling out — set expectations accordingly.

How does BIMI fit into a broader sending strategy?#

BIMI is the capstone of a healthy sending program, not the starting point. Sequence your investment: clean data first, authentication second, BIMI last. A brand logo on email sent to a rotten list is lipstick on a deliverability problem.

Start by making sure the addresses you collect and import are real. Whether you're building outbound lists with an email finder or importing a CRM export, verify before you send. Then layer SPF, DKIM, and DMARC. Then — once enforcement is stable and your reputation is clean — invest in the VMC and the BIMI record. Done in that order, BIMI becomes a genuine asset: a visible, verifiable mark of a sender who does the fundamentals right.

For pricing on Tomba's verification and finding tools, see the Tomba pricing page; the free tier is enough to test list quality before you commit to a paid plan.

Frequently asked questions#

Is BIMI free? The DNS record and logo hosting are free, but the required VMC or CMC certificate costs roughly $1,000+ per year from a certificate authority.

Can I use BIMI without a trademark? Yes, via a Common Mark Certificate (CMC), though display support is narrower than for a trademark-backed VMC.

Will BIMI stop phishing? It raises the bar — attackers can't display your verified logo — but it works alongside, not instead of, DMARC enforcement and recipient vigilance.

How long does BIMI setup take? Authentication and DMARC monitoring can take weeks; certificate issuance adds two to four more. Plan for one to two months end to end.

Get your list clean before you earn the logo#

BIMI rewards senders who've done the unglamorous work — and the most unglamorous part is data quality. Before you spend a dollar on a certificate, make sure you're sending to people who actually exist. Use the Tomba Email Finder to build accurate, verified contact lists from the start, so the DMARC reputation your BIMI logo depends on stays strong. Start free with 25 searches a month, scale to the Starter plan at $49/mo when you're ready, and give your authentication stack the clean foundation it needs.