BIMI puts a logo next to your messages in participating clients. It is the most visible thing in this course and the least about security — it is a reward for enforcement, not a mechanism that adds any.
The prerequisites, in order
| Requirement | Detail |
|---|---|
| DMARC at enforcement | p=quarantine or p=reject. p=none is disqualifying, and so is pct below 100. |
| Consistent authentication | Mail must actually pass DMARC. An enforcing record over failing mail gets no logo. |
| An SVG in the right profile | SVG Tiny Portable/Secure. Not any SVG. |
| A BIMI record | default._bimi.example.com, naming the logo and usually a certificate. |
| A VMC or CMC | Required by Gmail and Apple. Requires a registered trademark or a period of established use. |
The chain is strict and ordered. Each step is worthless without the one before it, which is why BIMI belongs at the end of a programme rather than anywhere near the start.
The record
"v=BIMI1;l=https://vmc.digicert.com/9e57aa28-3230-463f-b92e-ba8cd5612c17.svg; a=https://vmc.digicert.com/9e57aa28-3230-463f-b92e-ba8cd5612c17.pem"
l=— an HTTPS URL for the SVG.a=— an HTTPS URL for the certificate. Optional in the specification, required in practice by the clients that matter.- Both must be HTTPS with a valid certificate. There is no HTTP form.
The selector is default unless a message’s BIMI-Selector header names another, which lets one domain carry different marks for different mail streams. Almost nobody uses it.
The SVG profile
SVG Tiny Portable/Secure is a deliberately restricted subset: no scripts, no external references, no animation, no raster images embedded. It must be square, it must have a title element, and it must have an explicit background rather than transparency.
An SVG exported from a design tool will not pass
Illustrator and Figma output carries metadata, embedded fonts and constructs the profile forbids. The usual outcome is a file that renders perfectly in a browser and is rejected silently by every mail client. Validate against the profile rather than by looking at it.
Where most domains stop
Not the SVG and not the record — the trademark. A VMC requires a registered mark in a jurisdiction the issuing authorities recognise, which is a multi-year process for an organisation that does not already have one, and the certificate itself is an annual cost in the high hundreds to low thousands. For most domains that is the end of the enquiry, and it is a reasonable place to end it.