BIMI setup: how to get your logo showing in Gmail and Yahoo

BIMI puts your verified logo next to your name in the inbox — a visible, hard-to-fake trust signal. It also has a strict prerequisite almost nobody meets on the first try: DMARC has to already be at enforcement.

If you've seen a company logo appear next to their name in your Gmail inbox instead of a generic initial-in-a-circle, that's BIMI (Brand Indicators for Message Identification) at work. It's one of the few email authentication standards that's actually visible to the people receiving your mail, which makes it an easy thing to point to when you're trying to explain to a non-technical stakeholder why any of this DNS work matters. The catch is that BIMI doesn't stand alone — it's the last step on top of DMARC, not a shortcut around it.

The prerequisite nobody skips past

Mailbox providers won't even look up your BIMI record unless your domain's DMARC policy is already at p=quarantine or p=reject, enforced at pct=100. This is by design: BIMI is a reward for proving you control who can send as your domain, not a badge you can buy your way into. If your DMARC is still sitting at p=none — which is the default, and where a lot of domains stay indefinitely — BIMI simply will not work no matter how correctly everything else is configured.

This is also exactly why BIMI is usually the wrong place to start. If you haven't done a staged DMARC enforcement rollout yet, that's the actual first project; BIMI is what you do once that's already true.

Check your own domain's readiness

The fastest way to know where you actually stand is to check the one prerequisite that a DNS lookup can actually tell you — your current DMARC policy.

Everything else BIMI requires

Once DMARC enforcement is in place, the rest is about the logo file and, depending on the mailbox provider, a certificate that proves you're entitled to use it.

The logo file

• SVG Tiny PS format (baseProfile="tiny-ps") — a specific, restricted SVG profile, not a regular SVG export
• Square (1:1 aspect ratio), solid background, under 32KB
• No JavaScript, external links, embedded raster images, or animation — mailbox providers reject anything that could be used as a tracking or exploit vector
• Hosted at a public HTTPS URL you control — on your own web server, not something VanceSentinental hosts on your behalf

The certificate — and why requirements differ by provider

This is the part that trips people up, because the three major providers don't agree with each other:

The difference between the two certificate types matters for both cost and eligibility. A VMC requires a registered trademark on the logo — the certificate authority verifies you own the mark. A CMC doesn't require a trademark at all; the authority instead verifies the logo has been publicly displayed on a domain you control for at least 12 months. If you don't have a registered trademark, a CMC is very likely your only realistic path to Gmail and Yahoo coverage, with Apple Mail out of reach until a trademark is registered. Certificate pricing is set independently by each issuing authority and isn't something VanceSentinental controls or marks up — the BIMI Setup engagement tells you exactly which certificate type fits your situation and logo status, but the certificate itself is a separate purchase you make directly.