Does BIMI validate the content of the SVG image?

This is a common point of confusion when setting up Brand Indicators for Message Identification (BIMI). The short answer is both yes and no. BIMI validation checks the technical formatting of your SVG logo file to ensure it's secure and compliant, but it does not validate the visual content of the logo itself. The process of verifying that you have the right to use the logo is handled by a Verified Mark Certificate (VMC).

Let's break down what each part of the process actually validates.

Suped DMARC monitor

Free forever, no credit card required

Get started for free

Trusted by teams securing millions of inboxes

When we talk about BIMI validation in the context of the SVG file, we're referring to a strict set of technical requirements. This validation does not use image recognition or human review to see if the logo is appropriate. Instead, it checks the code of the SVG file to ensure it adheres to a specific, secure profile known as SVG Portable/Secure (P/S). This is a restricted version of the standard SVG format designed to eliminate security risks, such as embedded scripts or external links.

Mailkit says:

Visit website

If there is a text in your logo, you will need to convert it into curves as text may be in different fonts and BIMI SVG can't support that.

The key requirements that are validated include:

• File Format: The image must be in the SVG Tiny 1.2 format.
• Title Element: The file must include a <title> element that reflects your company name. This does not have to match your domain name exactly.
• No Harmful Elements: The SVG cannot contain scripts, external links, animations, or any interactive elements.
• Text as Paths: Any text within your logo must be converted into vector paths, not embedded as font files.
• Size and Aspect Ratio: The logo should be a square aspect ratio and the file size must be 32 kilobytes or less.

The validation of these technical points is done automatically. Mailbox providers and validation tools check the SVG file's XML structure against a predefined set of rules. The BIMI Group, which develops the standard, provides a specific schema for this purpose.

BIMI Group says:

Visit website

You can take an SVG file and validate that it is compliant with the SVG P/S profile specification by running it against the SVG P/S RNC schema.

Because of these strict requirements, you often can't just save a logo as an SVG from a standard graphics program. It may require using specific export settings or even opening the file in a text editor to manually remove unsupported elements and ensure it meets the P/S profile.

So, if BIMI's validation only checks the file's code, what stops a bad actor from using another company's logo? This is where the Verified Mark Certificate (VMC) comes in.

A VMC is a separate digital certificate that proves your organization has the legal right to use the logo associated with your domain. To get a VMC, you must go through a verification process with a Certificate Authority (CA). The CA verifies that your logo is a registered trademark. This process connects your verified, trademarked logo to your domain, providing the critical trust signal that mailbox providers need to display it.

Sendmarc says:

Visit website

How to set up a BIMI record (step-by-step) · Step 1: Ensure DMARC compliance · Step 2: Create a logo in an SVG format · Step 3: Get a certificate (VMC or CMC).

In short, the system works with two layers of validation:

• BIMI SVG Validation: A technical check to ensure the file is safe and properly formatted.
• VMC Validation: A legal and organizational check to verify the logo is a registered trademark owned by your company.

Therefore, while BIMI itself doesn't validate the visual content of the SVG, the overall ecosystem—when implemented with a VMC—ensures that the logo being displayed is both technically safe and authentically represents the sending brand.