BIMI
What is BIMI?
BIMI (Brand Indicators for Message Identification) is a DNS TXT record that lets a domain show its verified logo next to its messages in supporting inboxes like Gmail, but only once DMARC is enforced at p=quarantine or p=reject. AdminKit's SPF, DKIM and DMARC guide covers that DMARC prerequisite before a domain adds BIMI.
By AdminKit team, Netbase JSC · Updated
BIMI (Brand Indicators for Message Identification) is a DNS TXT record that lets a domain display a verified brand logo next to its messages in supporting inboxes, such as Gmail and Yahoo Mail. BIMI has a hard prerequisite: the domain’s DMARC policy must already be enforced at p=quarantine or p=reject, not p=none, because BIMI’s trust model depends on DMARC already having proven that unauthenticated mail claiming to be from the domain gets blocked or flagged — see AdminKit’s guide on SPF, DKIM and DMARC for getting DMARC enforcing first, and the SPF entry for one of the two authentication checks DMARC relies on. AdminKit’s BIMI check reads a domain’s live record and flags that DMARC-enforcement prerequisite directly. Many implementations also require a Verified Mark Certificate (VMC) from a recognized authority, tying the logo to a legally registered trademark, which adds cost and process beyond the DNS record itself. Google Workspace’s BIMI setup guide, for example, requires a Verified Mark Certificate (recommended) or a Common Mark Certificate issued by a certificate authority, with VMC eligibility depending on the logo being trademarked with a recognized intellectual property office. DMARC itself is defined in RFC 9989 (also tracked at the IETF Datatracker), which replaced RFC 7489 in May 2026; the current VMC and record requirements live in the BIMI Group’s specification.
BIMI is part of AdminKit’s email authentication cluster; the full AdminKit glossary lists other related terms.
Frequently asked questions
Do I need DMARC before I can use BIMI?
Yes -- BIMI requires DMARC already enforced at p=quarantine or p=reject, not p=none, because BIMI's trust model depends on DMARC having already proven that unauthenticated mail claiming to be from the domain gets blocked or flagged.
Does every mailbox provider show BIMI logos the same way?
No -- many implementations also require a Verified Mark Certificate (VMC) from a recognized authority tying the logo to a legally registered trademark, while others display the logo from the DNS record alone.
Will BIMI stop phishing emails that spoof my domain?
Not directly -- BIMI's prerequisite, an enforcing DMARC policy, is what actually blocks or flags unauthenticated mail; BIMI itself just displays a logo on mail that already passed that check.
What DNS record type does BIMI use?
BIMI is published as a DNS TXT record, the same record type SPF uses, though its name and content follow BIMI's own format rather than SPF's.