BIMI: showing a verified logo, and what it requires first

What BIMI is

BIMI lets a domain publish a logo that supporting mailbox providers show next to authenticated messages. It is a reward for strong authentication rather than a security control in itself: providers show the logo only when DMARC passes under an enforcement policy.

Requirements

You need DMARC at p=quarantine or p=reject applied to all mail (no pct below 100), a logo in the SVG Tiny Portable/Secure profile served over HTTPS, and for most large providers a Verified Mark Certificate or Common Mark Certificate from an approved certificate authority. The record lives at default._bimi.domain.

Snippet

default._bimi.example.org.  TXT  "v=BIMI1; l=https://example.org/brand/logo.svg; a=https://example.org/brand/vmc.pem"

Lab: readiness check

For a domain you manage, check the DMARC record and confirm it is at enforcement with no reduced pct. Check whether the logo SVG declares the Tiny PS profile and has no scripts or external references. If either fails, list the work needed. A BIMI record published before DMARC enforcement simply has no effect.

Snippet

dig +short TXT _dmarc.example.org
dig +short TXT default._bimi.example.org
curl -s https://example.org/brand/logo.svg | head -c 300
# look for baseProfile="tiny-ps" and no <script> or external href

Why it is worth doing

The real value is the path to get there: reaching DMARC enforcement blocks direct spoofing of your domain. The logo then gives recipients a consistent visual cue, though users should still be taught that a logo is not a guarantee about message content.

Diagram

BIMI prerequisites in order

Authenticate
SPF and DKIM aligned for all senders.
Enforce
DMARC p=quarantine or reject at 100 percent.
Logo
SVG Tiny PS over HTTPS.
Certificate
VMC or CMC, then publish default._bimi.

Check yourself

1. What must be in place before BIMI has any effect?

2. Which logo format does BIMI require?

3. Where is the BIMI record published?