What is BIMI?
Also known as: Brand Indicators for Message Identification
BIMI (Brand Indicators for Message Identification) is a DMARC-aligned standard that lets email senders publish a verified logo for display in supporting mail clients.
BIMI, short for Brand Indicators for Message Identification, is an email authentication specification defined in RFC 9377. It allows domain owners to publish a brand logo in their DNS records via a BIMI DNS TXT record. When an email passes DMARC (Domain-based Message Authentication, Reporting, and Conformance) alignment at p=quarantine or p=reject, a supporting mail client can fetch and display the sender's logo next to the message in the user's inbox. This gives recipients a visual cue that the email is authentic, reducing phishing risk and building brand trust.
To implement BIMI, a domain must first have DMARC enforcement in place. The domain owner then hosts a Scalable Vector Graphics (SVG) logo file at a public URL and publishes a BIMI TXT record at default._bimi.<domain>. That record includes the SVG URL and optionally a Verified Mark Certificate (VMC) used by some providers for extra assurance. Mail clients like Apple Mail, Yahoo Mail, and Fastmail already support BIMI. Gmail introduced BIMI display for authenticated senders in 2023.
The BIMI standard sits on top of the existing DMARC and DKIM/SPF authentication stack. It does not replace those technologies; it adds a visual layer. Adoption is growing among senders with high email volume who prioritize brand protection. However, relying on BIMI alone without proper DMARC enforcement leaves the visual indicator meaningless, because unauthenticated emails can also request a logo.
Key facts
- BIMI requires DMARC alignment at p=quarantine or p=reject to display the logo.
- The BIMI DNS TXT record is placed at default._bimi.<domain>.
- Logo files must be in SVG format, often with a Verified Mark Certificate (VMC).
- Apple Mail, Yahoo Mail, and Fastmail support BIMI; Gmail started in 2023.
- RFC 9377 defines the BIMI specification (Auth-Results Indicator and DNS record).
How it works in practice
Related terms
References
More in Email
Bounce Message
A bounce message, or non-delivery report (NDR), is an automated email sent to the originator when delivery cannot be completed, including a status code and failure reason.
Catch-All Email
A catch-all email account receives all messages sent to invalid or nonexistent addresses at a domain, preventing bounce-backs but attracting spam.
DKIM
DKIM is an email authentication method that lets a domain claim responsibility for a message by attaching a cryptographic signature validated against a DNS public key.
DMARC
DMARC is an email authentication policy protocol that builds on SPF and DKIM to tell receiving mail servers how to handle messages that fail authentication checks.
DNSBL
A DNSBL is a real-time IP reputation database published via DNS, used by mail servers at SMTP time to reject or flag senders known for spam or abuse.
Greylisting
Greylisting is a spam-filtering technique that temporarily rejects email from unknown senders, forcing legitimate mail servers to retry delivery while filtering out spammers that do not retry.
IMAP
IMAP is an email protocol that lets clients access and manage messages stored on a mail server, keeping the server as the authoritative copy and synchronizing folder state across multiple devices.
Mailbox Quota
A mailbox quota is a storage limit placed on a user's email account. Once the total size of stored messages exceeds this limit, the server may reject new incoming emails or warn the user.
MDA
An MDA (Mail Delivery Agent) is a software component that transfers an email from a Mail Transfer Agent (MTA) into a recipient's local mailbox, typically on a mail server or a user's machine.
MTA
An MTA (Mail Transfer Agent) is server software that routes email between domains using the SMTP protocol, acting as the core delivery engine for internet email.