How do I set up BIMI? Is a VMC certificate always required?
Updated on 4 Oct 2026: We clarified certificate options, subdomain lookup, SVG requirements, and common reasons a BIMI logo does not appear.
Yes, you can publish a BIMI record without a VMC certificate. A VMC is not required to create the DNS record, and it is not required by every mailbox provider. The catch is display: Gmail requires a VMC or CMC for BIMI logo display, and the Gmail verified checkmark is tied to a VMC. Yahoo and Fastmail can display self-asserted BIMI without a VMC, but their own eligibility, reputation, and safety checks still decide whether the logo appears.
BIMI setup has two jobs. First, make the domain technically eligible with enforced DMARC, a valid SVG logo, HTTPS hosting, and a clean BIMI TXT record. Second, choose whether you need certificate-backed display for the inboxes that matter to your audience. If Gmail reach is important, plan for a mark certificate. Apple Mail also requires the receiving mail provider to validate a trusted BIMI Evidence Document and add the required BIMI headers. If your early goal is Yahoo and Fastmail only, a self-asserted BIMI record is a valid first step.
- Publish BIMI in DNS after DMARC is enforced, then add a VMC or CMC if your target inboxes require certificate evidence.
- Use a self-asserted BIMI record with an omitted or empty a= tag when you do not have a certificate.
- Use a CMC for an eligible prior-use or modified mark, or a VMC for a qualifying registered or government mark and the Gmail verified checkmark.
- Publishing BIMI does not force every mailbox provider to display your logo. The receiver still checks authentication, reputation, logo format, and local policy.
A domain registrar such as GoDaddy is not the deciding factor for BIMI display. If it lets you publish TXT records, you can publish BIMI. Gmail, Yahoo, Fastmail, Apple Mail, and other receiving mailbox providers decide whether the logo is shown to their users.
DMARC requirements for BIMI
BIMI sits on top of email authentication. Before publishing a BIMI record, confirm that real mail passes DMARC and that both the organizational domain and the visible From domain have an enforcement policy. The visible From domain must pass DMARC through aligned SPF or DKIM, and the applicable DMARC policy must be p=quarantine or p=reject. A p=none policy is useful for reporting, but it is not enough for BIMI. RFC 9989 classifies the pct tag as historic, so omit it from new DMARC records. If an older BIMI validation path still expects the tag, retain only pct=100; a lower value does not qualify for BIMI.
This is where Suped fits in. Suped is the DMARC reporting and email authentication platform behind this publication, and the practical BIMI workflow starts with DMARC monitoring: identify every sender, fix SPF and DKIM failures, move policy in stages, and keep alerts on once the domain is enforced. The BIMI record is the visible part. The work that makes it reliable is sender inventory and authentication cleanup.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
A BIMI-ready domain should meet these conditions before you spend time on certificates or logo conversion. If one of these is wrong, the logo can fail even when the BIMI TXT record is syntactically correct.
- The organizational domain and visible From domain use p=quarantine or p=reject. Omit the historic pct tag from new records, or retain pct=100 only for compatibility with older BIMI validation.
- Do not leave sp=none in control of a visible From subdomain that needs BIMI.
- Production mail passes SPF or DKIM with alignment to the visible From domain.
- Unknown senders are removed or brought into compliance before enforcement is increased.
Minimum DMARC policy for BIMIDNS
_dmarc.example.com TXT v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Before changing policy, run the domain through the domain health checker and confirm that DMARC, SPF, and DKIM are clean enough for enforcement. If you only need to validate the DMARC TXT value, use the DMARC checker before moving to the BIMI record.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
How to publish the BIMI record
A BIMI record is a TXT record under a selector. The default selector is usually default, so the DNS host name is default._bimi. The required l= tag points to an HTTPS-hosted SVG logo for self-asserted BIMI. When you have a VMC or CMC, the optional a= tag points to the PEM certificate file. Google also documents a certificate-backed Gmail record with a blank l= value because the PEM contains the logo; check receiver support before using that form.
BIMI setup flow from DMARC enforcement through inbox checks.
The setup sequence is straightforward, but the details matter. Complete the authentication work first, publish the self-asserted record, then add certificate evidence when the certificate is ready. That order establishes the DNS record without blocking on legal or certificate validation.
- Confirm the organizational and visible From domains are at enforcement and real senders are passing.
- Convert the brand mark to SVG Tiny Portable/Secure with a square viewBox, baseProfile="tiny-ps", version="1.2", and a title element. For Gmail, specify absolute dimensions of at least 96 by 96 pixels. Keep the file at or below 32 KB for Gmail compatibility; Fastmail requires less than 16 KB.
- Put the SVG, and later the complete PEM chain, on public HTTPS URLs. Use TLS 1.2 or later and avoid cookies, authentication, or fragile redirects.
- Add one TXT record at the selector host name and allow DNS time to propagate.
- Send real mail through production systems and check headers, DMARC results, asset retrieval, and inbox display.
Self-asserted BIMI record without VMC or CMCDNS
default._bimi.example.com TXT v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=;
Certificate-backed BIMI recordDNS
default._bimi.example.com TXT v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/mark.pem
Declination to publish recordDNS
default._bimi.example.com TXT v=BIMI1; l=; a=;
A missing or blank a= value is not an error by itself. It tells receivers that no certificate evidence is published. A blank l= value together with a missing or blank a= value is a declination record, which says the domain is aware of BIMI but is not publishing a logo.
If your DMARC record is still in monitoring mode, generate the enforcement-ready syntax with the DMARC record generator, then stage the policy only after the reports show that legitimate mail is passing.
How selectors and avatar preference work
The default selector is enough for most domains. BIMI also supports alternate selectors when one domain needs different eligible logos. A selector named seasonal uses a TXT record at seasonal._bimi.example.com. The sending system requests it with a BIMI-Selector header, which should be included in the aligned DKIM signature. If that selector is missing on the visible From subdomain, a receiver checks the same selector at the organizational domain. It does not switch to the default selector.
Alternate BIMI selectorEmail and DNS
BIMI-Selector: v=BIMI1; s=seasonal; seasonal._bimi.example.com TXT v=BIMI1; l=https://assets.example.com/bimi/seasonal.svg; a=https://assets.example.com/bimi/seasonal.pem
The optional avp= tag expresses whether a participating provider should prefer the domain's BIMI logo or a personal avatar. avp=brand prefers the BIMI logo and is the default when the tag is absent. avp=personal prefers a personal avatar when one exists, with the BIMI logo as the fallback. It is a display preference, not a command, so receiver policy still controls the result.
BIMI record that prefers personal avatarsDNS
default._bimi.example.com TXT v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/mark.pem; avp=personal;
How BIMI works on subdomains
A message sent as news.example.com uses the visible From subdomain for BIMI lookup. With the default selector, the receiver checks default._bimi.news.example.com first. If no record exists there, it checks default._bimi.example.com. For a named selector, it checks that same selector at both levels.
Publish a subdomain record when that mail stream needs a different logo. If the subdomain must show no BIMI logo while the organizational domain has one, publish a declination record at its selector instead of leaving the record absent. Keep enforced DMARC on both domains, and check the subdomain policy before testing display.
Subdomain logo and explicit no-logo optionDNS
default._bimi.news.example.com TXT v=BIMI1; l=https://assets.example.com/bimi/seasonal.svg; a=; default._bimi.internal.example.com TXT v=BIMI1; l=; a=;
Is a VMC always required?
No. A VMC is not always required for BIMI, but a certificate is required for some of the inbox outcomes people usually mean when they ask about BIMI. The practical distinction is DNS validity versus logo display. DNS can be valid without a VMC. Gmail display needs a VMC or CMC. The Gmail verified checkmark needs a VMC. Yahoo and Fastmail can display a self-asserted logo when the sender passes their checks.
Google's current Google BIMI setup documentation says Gmail requires third-party certification through a VMC or CMC. The BIMI Group note also explains self-asserted BIMI and the certificate evidence tag. The short version: VMC is not a universal requirement, but self-asserted BIMI gives you limited coverage.
Google Workspace Admin Help page for setting up BIMI.
Self-asserted BIMI
This is the no-certificate setup. It has a BIMI TXT record, an SVG logo URL, and no published certificate evidence.
- Best fit: Early testing, Yahoo, Fastmail, and lower-cost experimentation.
- Main limit: Gmail will not show the BIMI logo from a self-asserted record.
- DNS shape: The a= tag is omitted or blank.
Certificate-backed BIMI
This setup adds a PEM certificate URL to the BIMI record. The certificate connects an eligible logo to the organization and domain.
- Best fit: Gmail and other providers that require trusted logo evidence.
- Main limit: Organizational validation, mark evidence, and certificate renewal add cost and process.
- DNS shape: The a= tag points to the PEM file.
|
|
|
|
|---|---|---|---|
No cert | Yahoo, Fastmail | Self-asserted | Limited reach |
CMC | Gmail logo | Prior-use or modified mark | No Gmail checkmark |
VMC | Gmail checkmark | Registered or government mark | More validation |
BIMI certificate choices and practical outcomes
The certificate decision often comes down to mark status and audience mix. If the logo is a qualifying registered or government mark and Gmail trust markers matter, VMC is the relevant route. A certificate authority validates the organization, domain control, and mark evidence before issuance. If the logo has qualifying prior use or is a permitted modification of a registered mark, evaluate a CMC. For a deeper comparison, see CMC and VMC differences. If the goal is only to test the DNS and SVG work, publish self-asserted BIMI first and add the certificate later.
What changes by mailbox provider
BIMI is receiver-driven. You publish one record, but each receiving mailbox provider has its own checks. The same message can show a logo in one inbox and no logo in another. That does not automatically mean the DNS is wrong.
BIMI is more than a DNS project. It also depends on authentication, reputation, asset hosting, and any required certificate evidence. Even after everything is technically valid, a mailbox provider can suppress logo display for a message stream that does not meet its volume, engagement, reputation, or local-policy thresholds.
BIMI readiness levels
Use these levels to separate DNS readiness from actual inbox display.
Not ready
p=none
DMARC is missing or still at monitoring only.
DNS ready
TXT valid
DMARC is enforced and the BIMI TXT record is valid.
Certified
PEM live
A VMC or CMC PEM file is published through the BIMI record.
Displayed
Inbox logo
The receiver chooses to show the logo for real messages.
Gmail: Requires certificate-backed BIMI with a VMC or CMC. The verified checkmark is associated with VMC.
Yahoo and AOL: Can display self-asserted BIMI for bulk mail when the sender has enforced DMARC, a valid SVG, and sufficient reputation and engagement. Yahoo does not require a VMC for logo display across its Yahoo and AOL mail applications.
Fastmail: Can display BIMI without a VMC when the message passes DMARC under a strong enforcement policy. Its SVG file must be less than 16 KB.
Apple Mail: Displays BIMI only when the receiving mail provider validates a trusted BIMI Evidence Document and adds the required headers. Support also depends on the account's mail provider, not only the Apple Mail app.
Five checks that affect whether a BIMI logo appears in an inbox.
To predict the visible result, start with your recipient mix. A B2C sender with heavy Gmail traffic should not stop at self-asserted BIMI. A sender with smaller consumer volume can use self-asserted BIMI as a low-risk test while certificate work is pending. For placement examples, see where logos appear.
Common setup problems
Most BIMI failures are ordinary implementation issues. The record exists, but one of the required domains is not enforced. The logo is an SVG, but not the required SVG Tiny PS profile. The certificate URL works in a browser, but the hosted PEM chain is incomplete. The sending platform passes DKIM for a vendor domain, but DMARC does not pass for the visible From domain.
Do not expect instant display after publishing DNS. BIMI has DNS caching, certificate validation, mailbox-provider cache behavior, and sender reputation checks. A clean record is necessary, but it is not a display guarantee. Forwarding can break SPF, and mailing-list edits can break DKIM; check DMARC at the final receiver if the logo disappears only on those paths.
Failures to check first
- DMARC is still at p=none or the visible From subdomain inherits a non-enforcing policy.
- The SVG has the wrong profile, lacks required dimensions, uses unsupported elements, exceeds a provider size limit, or crops badly in a square container.
- The SVG or PEM file uses HTTP, blocks automated fetches, redirects badly, or returns the wrong content type.
- The PEM URL is missing where required, expired, mismatched, or missing part of the certificate chain. Renew certificates before expiry and replace the hosted PEM.
- The sender expects Gmail display from self-asserted BIMI or Yahoo display for personal mail.
For the no-certificate case, the most useful related read is BIMI without a VMC. Read it before spending money on a certificate or assuming the logo will show everywhere.
A practical BIMI rollout
Do not buy a VMC on day one unless the domain already has enforced DMARC, stable authentication, and an eligible mark. For most teams, the practical rollout is to prove the authentication foundation first, publish a valid BIMI record, then add certificate evidence once the legal and budget work is complete.
Suped, the DMARC reporting and email authentication platform behind this publication, supports the operational part of this rollout by keeping sender discovery, DMARC results, policy progress, and authentication alerts together. For MSPs and agencies, its multi-tenant view separates client domains and reports while teams work through BIMI readiness.
- Identify every service sending as the domain and remove unknown sources.
- Bring legitimate sources into aligned SPF or DKIM compliance for DMARC.
- Move the organizational and visible From domains to quarantine or reject after reports show low legitimate failure.
- Start with a valid SVG and self-asserted record if the certificate is not ready.
- Add an eligible CMC or VMC PEM URL when target providers require certificate evidence.
- Watch DMARC reports, sender changes, asset availability, certificate expiry, and reputation signals after launch.
A practical rollout is DMARC first, BIMI DNS second, certificate evidence third. That order avoids buying a certificate for a domain that still has authentication gaps, and it gives you a cleaner path to inbox display once the certificate is ready.
Views from the trenches
Best practices
Confirm enforced DMARC on the organizational domain before publishing any BIMI record.
Use self-asserted BIMI as a limited test, then add certificate evidence for Gmail.
Keep SVG and PEM files on stable HTTPS URLs and renew certificates before they expire.
Common pitfalls
Treating a blank evidence tag as broken causes teams to miss valid self-asserted BIMI.
Expecting Gmail display without VMC or CMC leads to false DNS troubleshooting and delays.
Forgetting receiver reputation checks makes valid BIMI look like a technical failure.
Expert tips
Publish a declination record when you need a formal no-logo BIMI posture for testing.
Use mailbox-specific test accounts because support and certificate rules are uneven.
Budget time for legal logo proof, certificate validation, hosting, and DNS propagation.
Expert view
Expert from Email Geeks says self-asserted BIMI is valid, but Gmail requires certificate evidence for display.
2024-01-18 - Email Geeks
Expert view
Expert from Email Geeks says a blank evidence tag is the normal form of a self-asserted BIMI record.
2024-02-07 - Email Geeks
BIMI setup and certificate choice
Set up BIMI by enforcing DMARC on the required domains, preparing an SVG Tiny PS logo, hosting the logo on HTTPS, publishing a TXT record at default._bimi, and testing real mail in supported inboxes. If you do not have a VMC or CMC, publish the self-asserted record with an omitted or blank a= value and expect limited display.
A VMC is required for the Gmail verified checkmark when the brand has a qualifying registered or government mark. A CMC can support Gmail logo display for an eligible prior-use or modified mark, without the Gmail checkmark.
Frequently asked questions
Yes. Publish a self-asserted BIMI record with the logo URL in l= and omit a= or leave its value blank. Gmail will not display a self-asserted BIMI logo, but Yahoo and Fastmail can when their other eligibility checks pass.
Gmail requires certificate-backed BIMI through a VMC or CMC. A VMC is needed for the verified checkmark, while a CMC can support logo display without that checkmark.
A VMC covers a qualifying registered or government mark and can unlock the Gmail verified checkmark. A CMC covers an eligible prior-use mark or permitted modification of a registered mark, but it does not provide the Gmail checkmark.
BIMI is not a deliverability fix. It depends on good deliverability because receivers check authentication and sender reputation before showing the logo. It also does not stop messages sent from lookalike domains.
Host the SVG logo and complete PEM chain on stable public HTTPS URLs. Use TLS 1.2 or later, return the correct content, and avoid cookies, authentication, or fragile redirects.
Yes. Publish each eligible logo under a separate selector and add a DKIM-signed BIMI-Selector header to messages that request a non-default logo. Keep the default selector for messages that do not request another selector.
