Updated · 8 min read
BIMI: the logo-in-the-inbox feature, and whether it's worth the effort
BIMI sticks your brand logo in the sender column of supported inbox clients — a small but visible signal that authenticated mail is genuinely from you. The setup demands DMARC enforcement, a compliant SVG, and (for Gmail) a Verified Mark Certificate running $1,000–$2,000/year. The brand lift is real and modest. The cost is higher than most teams plan for. Here's when it's worth doing and when it's a distraction from more important problems.
By Justin Williames
Founder, Orbit · 10+ years in lifecycle marketing
What BIMI is and isn't
BIMI is a DNS-based standard that tells supported email clients to display your brand logo next to your mail. Gmail has supported it since 2021. Apple Mail since iOS 16. Yahoo Mail and Fastmail are on board. Microsoft Outlook still isn't, as of 2026.
What BIMI is: a trust signal. Your logo only appears when your mail passes DMARC enforcement, so every user who sees it has cryptographic confirmation that the message is authentically from your domain. That's the whole point.
What BIMI isn't: a deliverability fix. It doesn't influence inbox placement. It's a display feature that runs on top of mail that's already been delivered. It cannot rescue a program with bad reputation; it can't even help much with a program with mediocre authentication. The underlying DMARC work that BIMI forces you to do — that helps. BIMI itself is polish.
BIMI is branding. It makes your authenticated mail visibly yours. It's not going to fix a deliverability problem — and if you don't already have the fundamentals right, it won't even display.
What BIMI requires
1. DMARC at enforcement. Your DMARC policy needs to be p=quarantine or p=reject, not p=none. For most programs this is the longest part of the entire BIMI project — enforcement without breaking legitimate mail is a real piece of engineering work, not a weekend task.
2. A compliant SVG logo. Specifically SVG Tiny PS (Portable/Secure profile). Most brand logos need reworking. Scripts, external references, and certain filters are all disallowed. Budget for a real design pass, not a quick export.
3. A Verified Mark Certificate for Gmail. Gmail specifically won't display BIMI without a VMC. VMCs are issued by a small set of certificate authorities (DigiCert, Entrust, GlobalSign) and require a registered trademark on the logo. Running cost: $1,000–$2,000 per year, plus trademark fees if you don't already have one.
4. DNS configuration. A BIMI TXT record pointing at the SVG and (for Gmail) the VMC. This is the easy part. The three items above are where the time goes.
Gmail's VMC requirement is decisive because Gmail is usually 40%+ of any consumer audience. You can technically run BIMI without a VMC — Apple Mail and Yahoo will still display a self-asserted logo — but skipping the VMC cuts off the biggest slice of your reach.
The effort-to-impact ratio
Measured effects of BIMI on program performance:
Open rate: vendor case studies claim 5–10% lift. Independent measurement tends to land at 2–7%. The effect is larger for brands where the logo genuinely adds recognition over text-only sender display — so, brands people already know.
Brand trust signals: anecdotal but consistent. Users report higher trust and lower spam-reporting intent when a recognisable logo sits next to the sender name.
Complaint rate: marginally lower, because the logo kills the "this looks like phishing" reflex for some users.
When BIMI is worth it
Large, recognisable brands. If users actually recognise your logo, BIMI converts that recognition into a real signal in the inbox. Smaller or less-recognised brands get less of this, because there's less to recognise.
Programs with high deliverability stakes. Financial services, healthcare, government, commerce at scale. Anywhere phishing impersonation is a genuine threat, BIMI is a small but meaningful defence against lookalike attacks — users learn to trust the logo and distrust its absence.
Programs already at DMARC enforcement. If you're already at p=quarantine or p=reject, BIMI is mostly an SVG project plus a VMC purchase. If you're not yet at enforcement, do DMARC for its own sake first — BIMI is a downstream benefit, not a reason to accelerate.
The SPF/DKIM/DMARC guide covers the authentication fundamentals that sit underneath all of this.
When BIMI isn't worth it
No DMARC enforcement yet. Don't chase BIMI as a way to get DMARC done. If authentication is a distant future, BIMI is a more distant future. Fix the fundamentals first, then revisit.
Low-volume programs. Run the numbers. A 5% open-rate lift on 100K sends/month works out to about 5K additional opens — maybe $500–$5,000 in incremental value depending on per-open economics. The VMC alone is $1,500/year. BIMI genuinely may not pay for itself at that scale.
Logos that can't easily be trademarked. VMC needs a registered trademark in most cases. If your logo is a generic shape, a common word, or otherwise hard to trademark, the trademark project alone ends up costing more than the BIMI itself. You're solving the wrong problem.
Implementation sequence
If you've decided to pursue BIMI, the order of operations matters. Skipping a step costs weeks.
1. Get to DMARC p=none and monitor DMARC reports for at least 30 days to confirm your authentication is correct and you've found every legitimate sending source.
2. Progress DMARC to p=quarantine pct=10, then pct=50, then pct=100, monitoring at each step for collateral damage to legitimate mail.
3. Once at p=quarantine pct=100 or p=reject, hand the logo to design for the Tiny PS version.
4. Register the trademark if not already. Trademark registration takes 6–12 months in most jurisdictions, so start this in parallel with step 3 if you can.
5. Purchase a VMC from one of the authorised CAs.
6. Publish the BIMI DNS record pointing at the SVG and VMC URLs.
7. Test with real Gmail and Apple Mail addresses. The logo should appear within a day or two.
Total elapsed time from standing start: 3 to 12 months depending on how much authentication cleanup is needed. From DMARC-already-enforced: 2 to 6 weeks.
The Deliverability Management skilltreats BIMI as a step-5 item, sequenced after authentication, reputation monitoring, and hygiene are healthy. It's a brand-and-trust enhancement, not a foundation piece. Programs that try to do it first almost always abandon it halfway through DMARC rollout.
Frequently asked questions
- What is BIMI?
- BIMI (Brand Indicators for Message Identification) is an email authentication extension that displays a brand's verified logo next to messages in supporting inbox clients — Gmail, Yahoo, Apple Mail iOS 16+. Requires DMARC enforced at p=quarantine or p=reject for 30+ days, an SVG Tiny 1.2 version of the logo hosted publicly, and typically a Verified Mark Certificate (VMC) purchased from DigiCert or Entrust.
- Is BIMI worth it?
- Worth it for brands where inbox recognition meaningfully drives opens. Lift studies show 5-10% open-rate improvement from BIMI logos in supporting clients, concentrated among recognisable B2C brands. Cost: $1,500-2,000/year for the VMC plus DMARC-enforcement prerequisite work. For small brands or B2B senders where logo recognition doesn't materially change opens, BIMI is not yet ROI-positive. Worth revisiting as more clients adopt.
- What are BIMI's requirements?
- Five prerequisites. (1) DMARC policy at p=quarantine or p=reject (p=none is insufficient). (2) SPF and DKIM must align with the From domain. (3) An SVG Tiny 1.2 version of the logo hosted at a public URL. (4) A Verified Mark Certificate (VMC) for Gmail — Yahoo and Apple accept Common Mark Certificates too. (5) A DNS TXT record at default._bimi.domain.tld pointing to the SVG and certificate. The VMC is the biggest friction point — it requires trademark registration for the logo.
- How long does BIMI take to set up?
- If DMARC is already at enforcement: 2-4 weeks including VMC procurement and DNS setup. If DMARC is still at p=none: add 30-60 days for enforcement progression (you have to identify and fix legitimate senders failing alignment before escalating to p=quarantine, then to p=reject). Rush this and you'll break legitimate mail — DMARC enforcement is the slow, careful piece of the BIMI project.
- Does BIMI affect deliverability?
- Not directly — BIMI is a display feature, not a trust signal for the delivery decision. BUT the DMARC enforcement prerequisite does improve deliverability (mailbox providers trust DMARC-enforced domains more). The BIMI benefit is downstream: higher open rates from logo recognition produce better engagement signals, which feed sender reputation over time. The causal chain is indirect but real.
This guide is backed by an Orbit skill
Related guides
Browse allSPF, DKIM, and DMARC explained for lifecycle marketers
Three DNS records decide whether your marketing email is trusted or binned. Gmail and Yahoo made all three mandatory for bulk senders in 2024, and the grace period is over. This is the practitioner's explainer: what each one does, how they interact, and the setup order that won't block your own mail.
Email deliverability — the practitioner's guide
Deliverability isn't a setting. It's the running total of every send decision you've made since you bought the domain. Four pillars hold it up. Break one and the whole program starts leaking.
The unsubscribe page is the most important page in your lifecycle program
The page every lifecycle team ignores is the one quietly deciding sender reputation, suppression-list quality, and the fate of next quarter's deliverability. A short defence of why it deserves the ten-minute rebuild.
Dedicated vs shared IP: the real decision
Every ESP sales conversation pitches the dedicated IP as an upgrade. For most lifecycle programs it isn't — it's a trade, and often a losing one. Here's the volume threshold that actually justifies dedicated, the risks most teams don't anticipate, and when the shared pool is genuinely the better call.
List hygiene: the six-rule policy
List hygiene isn't cleanup; it's a continuous policy that runs automatically. Here's the six-rule policy every lifecycle program should have written down, each tied to a specific deliverability outcome.
Bounce rate management: the thresholds and the fix order
Bounce rate is the easiest deliverability metric to read and the easiest to misread. Here's what each bounce type actually means, the thresholds that trigger real problems, and the fix order when your rate climbs.
Found this useful? Share it with your team.
Use this in Claude
Run this methodology inside your Claude sessions.
Orbit turns every guide on this site into an executable Claude skill — 54 lifecycle methodologies, 55 MCP tools, native Braze integration. Pay what it's worth.