BIMI in 2026: how to put your logo in Gmail, what it costs, and the failures nobody mentions

BIMI (Brand Indicators for Message Identification) is the standard that puts your brand logo next to the sender name in supporting mail clients. When it works, your email shows a small logo in Gmail's avatar slot, in Yahoo's sender area, in Apple Mail's sender card on iOS 16+, and in Fastmail.

When it does not work, you get a generic letter avatar and a quiet shrug from your DNS validator. The gap between "I published the records" and "the logo is showing" is wider than most BIMI tutorials admit.

This is the operational view. What BIMI actually requires in 2026, what it costs, the edge cases that bite, and when the investment is worth it.

The actual requirements

To pass BIMI at Gmail and Yahoo, you need three things working in concert:

1. DMARC at `p=quarantine` or `p=reject`, with `pct=100`, on the organizational domain. No p=none. Subdomain policies count if you publish from a subdomain. Receivers verify your DMARC enforcement before they bother fetching your logo. If your DMARC is loose, no logo. 2. A square SVG-Tiny PS file. Not any SVG. SVG Tiny 1.2 with the Portable/Secure profile, which strips out scripts, animation, external references, masks, filters, and most fancy features. The file must be smaller than 32 KB, with a square viewBox, using a single solid color background or transparent. Most "we exported SVG from Illustrator" files fail validation immediately. 3. A Verified Mark Certificate (VMC), or a Common Mark Certificate (CMC) for Yahoo only. A VMC is issued by Entrust or DigiCert after they verify your trademark with the relevant patent and trademark office. It costs $1,295 to $1,499 per year as of 2026 and takes two to six weeks to issue. A CMC is cheaper (about $499/year) and faster (under a week) but Gmail and Apple do not display the logo for it. Yahoo will.

You publish two assets at public URLs: the SVG and the certificate. Then you reference both from a TXT record at default._bimi.yourdomain.com:

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

That is the surface. Now the things that bite.

The trademark requirement is real and slow

BIMI VMCs require a registered trademark on the logo or the brand name with the logo. Not a pending application. A registered, granted trademark in one of the supported jurisdictions: USPTO, EUIPO, UK IPO, JPO, IP Australia, CIPO, IP India, and a small handful of others.

If your brand has a wordmark trademark but not a logo trademark, you can apply for a "wordmark" version of BIMI, but the logo file has to be the wordmark exactly as registered, not your usual icon. If you have neither, you have to file. Trademark approval takes 9 to 14 months and a few thousand dollars in legal fees in most jurisdictions.

Companies that do not realize this until they buy a VMC: most of them. The cert vendor will ask for your trademark registration number on the application. If you cannot provide one, the cert is not issued.

The SVG profile is strict

The SVG Tiny PS subset rejects most exported SVGs. You will see validation errors for:

• <filter>, <mask>, <clipPath> elements. Common in icons with effects.
• <image> references to bitmap files. Even an embedded base64 raster image breaks the profile.
• Animations (<animate>, <animateTransform>). Strip them.
• Gradients with multiple stops sometimes pass, sometimes fail. Validator behavior is inconsistent across versions.
• Missing <title> element. Required.
• Non-square viewBox. The file has to be square (viewBox="0 0 400 400").
• Width and height attributes that do not match the viewBox aspect ratio.
• Colors using rgba(...) with alpha. Use solid hex.
• Missing baseProfile="tiny-ps" attribute on the root <svg>. Required, and most exports do not include it.

The fix: build the SVG by hand or use the BIMI Group's conversion tool. Hand-edit the file until it passes the BIMI Inspector at bimigroup.org/bimi-generator/.

The eight things that fail in production

1. DMARC pct < 100. You are at p=quarantine; pct=50. Receivers see partial enforcement and skip the BIMI lookup. Move to pct=100 before testing BIMI. 2. Subdomain DMARC inheritance. Your apex DMARC is p=reject but your sending subdomain has sp=none. Receivers check the subdomain policy when you send from mail.yourdomain.com. The subdomain policy has to match. 3. VMC chain not served correctly. The VMC is a PEM file with the cert, intermediates, and the SVG hash bundled. If you serve only the leaf cert, validation fails. The bundle has to include the full chain. 4. HTTP, not HTTPS. Both the SVG URL and VMC URL must be HTTPS. HTTP fetches are ignored. 5. Non-public URL. Some teams stash BIMI assets on a CDN that is geo-restricted or auth-walled. Receivers worldwide must fetch them anonymously. 6. CDN with aggressive cache invalidation. If you swap the SVG, some receivers cache the old version for hours. There is no documented TTL for receivers' caches; behave as if it is 24 to 48 hours. 7. VMC for the wrong logo. You replace the SVG to update brand colors, but the VMC was issued against the old version. The cert binds to a hash of the SVG. Any change in the SVG means a new VMC, which means another four-week issuance cycle. 8. Subdomain mismatch in record location. BIMI is queried at default._bimi.subdomain.com for messages from subdomain.com. If you only publish at the apex, mail from subdomains does not get the logo.

What displays where, in 2026

| Mailbox provider | VMC required | CMC accepted | Display | | --- | --- | --- | --- | | Gmail (web, Android, iOS) | Yes | No | Logo in avatar slot | | Yahoo Mail (web, mobile) | No | Yes | Logo next to sender | | Apple Mail (iOS 16+, macOS Ventura+) | Yes | No | Sender card on tap | | Fastmail | No | Yes | Sidebar avatar | | Outlook.com | No display | No display | None | | Microsoft 365 | No display | No display | None |

Outlook is the conspicuous absence. Microsoft has signaled BIMI support is on the roadmap for several years and has not shipped it. If your audience is heavily Microsoft 365 (most B2B), BIMI gets you logo display in Gmail and Yahoo, which is meaningful but less than the marketing implies.

When BIMI is worth it

Worth the spend:

• Consumer brand with a recognizable logo and a sizable Gmail and Yahoo footprint.
• Brand that ships transactional volume to consumer addresses (e-commerce, finance, travel).
• Brand whose sender reputation is already strong (DMARC at reject, complaint rate under 0.1%).

Skip for now:

• B2B with mostly Microsoft 365 recipients. The display surfaces do not reach your audience.
• Pre-revenue companies without a trademark. Trademark filing plus VMC is a multi-thousand-dollar upfront commitment.
• Brands that change their logo more than once every two years. VMC reissue cycles will eat the value.

The honest case for BIMI: a small open-rate lift (3% to 8% in published case studies, more if your prior trust signals were poor), a phishing-prevention story for security teams, and a visible marker in the inbox that you have done the homework on authentication. It is not a deliverability cure, and it does not move you out of Promotions.

The shortcut some teams take

If you want a visible-in-inbox effect without the VMC investment, several mailbox providers (Yahoo, Fastmail) honor a Gravatar-style profile picture set on a public service. The display is less prominent and Gmail does not honor it, but it costs nothing.

For B2B with Microsoft-heavy audiences, the actual win is well-configured DKIM and DMARC with a clean From name, not BIMI. Microsoft 365 weighs sender reputation and authentication health for its inbox decisions and does not (yet) factor BIMI logos at all.

TL;DR

• BIMI requires DMARC enforcement at pct=100, an SVG-Tiny PS file, and a VMC ($1,300 to $1,500/year).
• VMC needs a granted trademark, not an application. Plan for a multi-month upfront if you do not have one.
• Gmail, Yahoo, Apple, and Fastmail display BIMI today. Outlook does not.
• The SVG profile is strict; most exported files fail validation. Use the BIMI Inspector.
• Worth the spend for consumer brands with recognizable logos and clean DMARC. Skip if your audience is mostly Microsoft 365.