BIMI and Your Sender Logo in the Inbox: What It Does and What It Won’t Fix
What BIMI is and what it actually does
BIMI is a DNS record. It isn’t a service, and it isn’t a setting in an email client. You publish a record in your domain’s zone, and the rest happens on the recipient’s side. Your sender logo only shows up in the inbox once the mailbox provider decides you meet its requirements. You don’t force anything. You publish the data, and that’s it.
Technically? It’s simple. At _bimi._domainkey.twojadomena.pl there is a TXT record with the version, the URL of the SVG logo file and, optionally, the URL of a certificate. The receiving mailbox fetches the file, checks the message authentication and decides whether to show the logo at all.
A detail people tend to forget: BIMI works at the level of the domain in the From header, not at the level of a single campaign. You can’t set one logo for your newsletter and another for transactional emails sent from the same domain. The effect is purely visual - an avatar next to the message instead of an initial or a grey icon. Since your mark should be recognizable right in the inbox, it’s worth checking straight away that your logo in dark mode doesn’t disappear against a black background in the email body itself.
The entry requirement: DMARC with an enforcing policy
Without DMARC set to p=quarantine or p=reject, BIMI won’t work. Publishing p=none isn’t enough, even though people often assume “but we have DMARC”. Well, you don’t. A none policy only collects reports and enforces nothing.
DMARC is based on alignment. SPF or DKIM has to match the domain in From. A Return-Path on the sender’s subdomain takes care of SPF alignment, but I rely on DKIM signed with the sender’s domain - it survives forwarding and mailing lists.
The order of work is fixed: SPF and DKIM, then DMARC reports, then a stricter policy, and BIMI last. Since we run our own fleet of sending servers, we also add PTR records that match HELO and separate technical domains for link tracking. Small things, sure. But filters check them by default.
Tip: before you raise the policy to reject, read the aggregate reports for a few weeks. You’ll catch the systems sending on your behalf: CRM, invoicing, website forms, HR tools. You’ll block every one of them if you tighten the policy blindly. The result can be that payment reminders suddenly stop going out.
The SVG logo: requirements that upend the design
The file must use the SVG Tiny Portable/Secure profile. It’s a stripped-down subset of SVG, trimmed for security. Anything that can execute or fetch something is out.
- No scripts or events.
- No animation.
- No external references: fonts, images, stylesheets.
- No embedded raster images - no base64-encoded PNG.
- A square frame, a solid background and a required title element.
- File size measured in kilobytes, not megabytes.
The file sits at a permanent HTTPS address with a valid certificate. No redirects, and no path that changes every time the website is redeployed.
This is where the conversation with your designer starts. The brand’s visual signature usually needs simplifying, because a full logotype with text turns into a blur when shrunk to avatar size. A logo mark works better. Often you need to draw a variant that exists only for the inbox and appears nowhere else.
VMC and CMC: when you really need a certificate
A VMC, or Verified Mark Certificate, confirms your right to a trademark registered with a recognized trademark office. A CMC covers unregistered marks, but support on the mailbox side is narrower.
A certificate means an annual cost and a company verification process. The issuer checks your registration details, your representative and whether the image file matches the trademark. It takes quite a while from filing the trademark to getting the PEM file, so don’t plan it around a specific campaign. Really, don’t.
Some providers require a certificate, others show the logo without one. Work on this assumption: without a VMC, coverage will be partial. You’ll see the logo with some providers and not with others.
It’s a business decision, not a technical one. No registered trademark? Then the order is: register the trademark first, then get the certificate, then set up BIMI. It doesn’t work the other way round, and no workaround will shorten it.
Where the logo shows up and where you won’t see it
Support depends on the mailbox provider and changes over time. No honest person will promise you full coverage, because the list of supporting providers is a moving target.
The webmail and mobile app from the same provider can render things differently. The logo may be visible in the browser but not in the app. Desktop clients usually take the avatar from the recipient’s local address book, not from your record.
This leads to a situation that confuses marketing teams: a locally saved contact overrides the BIMI logo. A client you’ve been emailing for years will see whatever photo they once attached to your contact card. And there’s nothing you can do about it. If you don’t want recipients to see something random, at least take care of what you do control: a recognizable sender name in the From field.
Propagation can be slow. After you publish the record, you’ll see the effect in days, not minutes. Mailboxes cache the logo they’ve fetched.
Tip: test on your own accounts with several different providers, on mobile devices and in the browser. Checking a single company account tells you nothing about what your list actually sees.
What BIMI won’t fix
BIMI doesn’t improve deliverability. It doesn’t move messages from spam to the inbox, and it isn’t a free pass. Filters judge recipient behavior, domain history and traffic quality. Not the picture next to the header.
It doesn’t repair a damaged IP or domain reputation. Nor does it replace warming up a new IP address and a new domain - those processes take as long as they take, whatever you have in DNS.
On its own, it doesn’t protect against spoofing. Protection comes from the DMARC policy, and BIMI is a side effect of it. Getting this dependency backwards is probably the most common misunderstanding in conversations about logos in the inbox.
It doesn’t make your list legal. GDPR and electronic communications law, including Article 398 of the Polish Electronic Communications Law (PKE), require consent in B2B too. A DNS record won’t replace a legal basis.
A campaign with a weak list, high bounces and complaints will stay a campaign with a weak list. Tip: if you’re fighting a block at a major filter, put BIMI aside. Focus on list hygiene, sending pace and content - that works, the picture doesn’t.
Step-by-step implementation
- Audit SPF and DKIM for every system that sends on your behalf.
- Set DMARC to p=none with an address for aggregate reports.
- Clean up your sending sources: DKIM signatures, a correct Return-Path, removal of dead SPF entries.
- Raise the policy to quarantine, then to reject.
- Prepare the SVG Tiny PS file and host it at a permanent HTTPS address.
- Get a VMC or CMC if you want wider coverage.
- Publish the BIMI record in your DNS zone.
- Test with several providers and on several devices.
The division of roles is often underestimated. IT owns DNS, the designer prepares the file, marketing waits. Without that third part, the schedule falls apart.
Common slip-ups? A typo in the record name, an SVG file served through a redirect, an expired certificate. Put renewals in your calendar - expiry removes the logo without warning, and nobody will tell you.
Sending itself is a separate layer. Our email marketing platform with its own fleet of sending servers handles authentication on the infrastructure side. For DNS configuration on the client side, we provide step-by-step instructions - there’s no BIMI record wizard in the panel yet, it’s on the roadmap.
Summary: BIMI as a reward, not a shortcut
A logo in the inbox confirms that your authentication is in order. It isn’t a tool for improving results, just the visible effect of groundwork you did earlier.
The order can’t be reversed. SPF, DKIM, DMARC and a clean list come first, the picture comes after. Taking shortcuts ends with a record nobody renders.
The benefit is real, if narrow: sender recognition and fewer mix-ups with domains that look like yours. In industries where brand impersonation is common, that’s a solid argument.
Tight budget? The certificate can wait. Authentication can’t. Do DMARC properly, and make the VMC decision once everything else is stable.
