BIMI (Brand Indicators for Message Identification): VMC Requirements, SVG Formatting & Implementation

How BIMI Operates in the Inbox

Brand Indicators for Message Identification (BIMI) empowers organizations that have secured their email ecosystem with rigorous DMARC enforcement to display their verified corporate logo in recipient inboxes. When an email arrives at a supporting mailbox provider (such as Google Workspace, Yahoo Mail, or Apple Mail on iOS 16+):

1. The receiver validates that the message passes DMARC with identifier alignment under an enforced policy (p=quarantine with pct=100, or p=reject).
2. The receiver queries DNS for a BIMI TXT record located at default._bimi.<From-domain>.
3. The receiver retrieves the published SVG logo and verifies its cryptographically embedded Verified Mark Certificate (VMC) issued by an authorized Certificate Authority.
4. Upon successful validation, the receiver renders the brand logo in the message list and open view, frequently appending a trusted sender verification badge (such as Gmail’s blue checkmark).

The Strict DMARC & Authentication Prerequisites

BIMI is not a standalone protocol; it is explicitly engineered as a reward mechanism for pristine domain security. Mailbox providers will unconditionally refuse to render a BIMI logo unless all following criteria are satisfied:

• Strict DMARC Policy: The domain must publish p=reject or p=quarantine with pct=100. Any record with p=none or pct=<100 is instantly disqualified.
• DMARC Longevity & Standing: The DMARC enforcement policy should be established for at least 30 consecutive days prior to BIMI application to prove stability.
• DKIM & SPF Alignment: 100% of outbound messages from that sending domain must pass DMARC alignment.
• High Sender Reputation: Even with valid records, Gmail and Yahoo throttle logo display if the sending IP or domain reputation drops below “High” on Google Postmaster Tools.

Certificate Tiers: VMC vs. CMC vs. Self-Asserted

SVG Tiny Portable / Secure (SVG-P/S) Formatting Rules

BIMI mandates a highly restrictive subset of XML vector graphics known as SVG Tiny Portable/Secure. Standard SVG files exported directly from Adobe Illustrator or Figma will fail validation. The specification requires:

• Square Aspect Ratio (1:1): The graphic must be centered within a square viewBox (e.g., viewBox="0 0 512 512").
• No External References: Raster images (PNG, JPEG), scripts (<script>), and external web font links are strictly forbidden.
• Base Profile Declaration: The root element must include version="1.2" and baseProfile="tiny-ps".
• Explicit XML Namespace: Must declare xmlns="http://www.w3.org/2000/svg".
• File Size Constraints: Total file payload should remain under 32 KB.

BIMI DNS Record Anatomy

The BIMI record is published as a DNS TXT record under the default._bimi subdomain selector:

v=BIMI1; l=https://cdn.example.com/bimi/logo.svg; a=https://cdn.example.com/bimi/cert.pem

Mailbox Provider Support & Verification Matrix

BIMI Verification Checklist & Failure Modes

1. DMARC Policy Drift: If your primary domain or any sending subdomain drops to p=none or introduces pct=<100, mailbox providers immediately revoke BIMI display.
2. SVG MIME Type Header: The web server hosting the SVG must return Content-Type: image/svg+xml with valid SSL.
3. VMC SAN Mismatch: The domain listed in the Verified Mark Certificate Subject Alternative Name (SAN) must match your sending domain character-for-character.