You published a BIMI record, uploaded the logo, and Gmail still shows the generic gray circle next to every message you send. Your BIMI logo not showing up is one of the most common deliverability complaints operators bring to us, and it almost never comes down to a mistake in the BIMI record itself.
BIMI is a DNS-based standard that tells an inbox provider which logo to display next to an authenticated message, but the logo only renders once the domain's underlying email authentication is already strict enough to prove every message really came from you. BIMI does not create authentication — it just displays a reward for authentication you already have.
What Is BIMI and Why Does It Show a Logo in Gmail?
BIMI stands for Brand Indicators for Message Identification. It lets a domain publish a TXT record pointing to a logo file, and inbox providers that support the standard show that logo in the sender avatar slot instead of a generic letter or gray circle.
The logo is not decoration a mail client adds on request. It is a trust signal: the provider only displays it after confirming the message passed DMARC and that DMARC record is set strictly enough to mean something.
Support for BIMI is not universal. Gmail, Yahoo, AOL, and Fastmail render it; Outlook and Microsoft 365 do not support the standard as of this writing, so a domain built entirely around Microsoft mailboxes will not see any visible change from setting BIMI up. Check where your recipients actually read mail before spending time on the certificate step.
The BIMI specification maintained by the AuthIndicators Working Group is deliberately narrow: it defines the DNS record format and the logo file profile, and it leaves DMARC enforcement as an outside prerequisite the provider checks separately, message by message.
Why Is Your BIMI Logo Not Showing Up Yet?
In almost every case we see, the BIMI record is published correctly and the logo file is fine. The missing piece is upstream of BIMI: the domain's DMARC policy is still at p=none, or SPF and DKIM are not aligned with the visible From address on every stream of mail.
Gmail treats a BIMI record on a domain with a weak DMARC policy the same as no BIMI record at all. It does not partially trust the logo — it either shows it or it doesn't, and a monitoring-only policy is a hard no.
What Does BIMI Require Before the Logo Appears?
Four things have to be true at the same time, and each one is checked independently by the receiving mail server.
| Requirement | What It Means | Where It Lives |
|---|---|---|
| Enforced DMARC | Policy must be p=quarantine or p=reject at pct=100, not p=none | TXT record at _dmarc.yourdomain.com |
| SPF/DKIM alignment | The signing or sending domain must match the visible From domain on every stream, not just pass in isolation | Checked per message by the receiving server |
| SVG Tiny PS logo | A restricted SVG profile with scripts, external references, and raster images stripped out | Hosted over HTTPS, referenced by the BIMI record's l= tag |
| Verified Mark Certificate | Gmail requires a VMC tied to a registered trademark; Yahoo and Fastmail can show the logo without one | Issued by an authorized certificate authority, referenced by the a= tag |
Gmail will not render a BIMI logo unless the sending domain enforces DMARC at p=quarantine or p=reject — a policy of p=none is treated the same as having no BIMI record at all. That single line explains most "I did everything and it still doesn't show" tickets.
How Do You Set Up BIMI Step by Step?
- Confirm your DMARC record is already enforcing —
p=quarantineorp=rejectatpct=100— not sitting atp=none. - Convert your logo to the SVG Tiny Portable/Secure profile; most design tools export a full SVG that BIMI validators reject, so run it through a BIMI-specific converter.
- If you send through Gmail, purchase a Verified Mark Certificate from an authorized certificate authority such as DigiCert or Entrust, tied to a registered trademark for your logo.
- Publish a TXT record at
default._bimi.yourdomain.comcontainingv=BIMI1, anl=tag pointing to the hosted SVG, and ana=tag pointing to the VMC. - Send a test message to a Gmail mailbox and a Yahoo mailbox and check whether the logo renders in each.
- Re-check after 24 to 48 hours — inbox providers cache BIMI lookups and will not reflect a change instantly.
Why Does the Logo Break Even After DMARC Is Enforced?
Enforcement alone does not guarantee a clean render. The most common secondary failure is alignment mode: DMARC has a relaxed and a strict setting for both SPF (aspf) and DKIM (adkim), and a domain sending through a marketing platform on a subdomain can pass relaxed alignment while still failing the tighter checks some BIMI validators expect from a brand's primary sending domain.
The second failure is hosting, not DNS. The SVG file has to be served over HTTPS with a valid, unexpired certificate, with a content type of image/svg+xml, and it cannot redirect. A logo hosted on a CDN that serves it as application/octet-stream, or behind a certificate that expired last month, fails silently — the BIMI record still resolves, but the logo never loads.
The third is scope. A BIMI record published only at the root domain will not cover mail sent from a subdomain like news.yourdomain.com. Each sending subdomain that should show a logo needs its own default._bimi record, inheriting the parent domain's DMARC enforcement or publishing its own.
How Do You Check If Your DMARC Policy Is Strict Enough?
The BIMI specification maintained by the AuthIndicators Working Group only defines the logo mechanism — it does not tell you whether today's DMARC record on your domain actually qualifies, and that record can silently regress after a DNS migration, a new marketing tool, or a registrar change nobody flagged.
Re-querying DNS by hand every time a client or a colleague touches a record does not scale past one or two domains. EmailControl checks your SPF, DKIM, and DMARC records on a schedule and flags the exact moment a policy tag weakens, so a slip back to p=none shows up before it silently pulls your BIMI logo. See how EmailControl reads your SPF, DKIM, and DMARC records on every scheduled check.
Is BIMI Worth It for a Small Business?
Not always, and it is worth saying plainly: a Verified Mark Certificate costs money and requires a registered trademark, so a two-person shop without one is not going to get the Gmail checkmark no matter how clean the DNS is. That part of BIMI can reasonably wait.
The DMARC enforcement it depends on should not wait. Getting to p=quarantine or p=reject blocks domain spoofing regardless of whether a logo ever shows up, so the prerequisite work pays for itself even if you never buy a certificate. Compare monitoring plans on the EmailControl pricing page to see what daily versus hourly authentication checks cost at your domain count.
What's the Next Step to Get Your Logo Showing?
Check your current DMARC policy tag before you spend anything on a logo conversion or a certificate — if it still reads p=none, that is the actual blocker, not the BIMI record. Create a free EmailControl account and add your domain; it reads your current SPF, DKIM, and DMARC records in under a minute and tells you exactly which tag is holding your logo back.