BIMI: What the Logo in the Inbox Actually Requires
Summarize with AI
BIMI may display your logo beside your sender name in mailbox providers that support it, and the logo is the reward for finishing DMARC enforcement on the domain in question. That ordering decides who should be reading this. If the domain already carries enforcement on itself and its subdomains, BIMI may require certificate, logo and hosting work under the receiving provider's criteria. If it does not, BIMI depends on an authentication project whose scope needs to be assessed first.
BIMI is a framework for associating a domain with a brand image that participating mail providers may display. Authentication, policy, logo and certificate requirements depend on the implementation. Publishing a record does not force logo display, create sender trust or guarantee delivery. Related glossary concepts: DMARC, DKIM, Sender reputation. Current DMARC reference: RFC 9989.
The Gate Is DMARC Enforcement, Not the Logo File
The BIMI Group implementation guide puts the authentication requirement before anything visual. DMARC policy "MUST be at enforcement on the organizational domain and subdomains," which the guide spells out as either "Quarantine (p=quarantine; sp=quarantine)" or "Reject policy (p=reject; sp=reject)."
Two details in that sentence decide eligibility before the artwork does.
The first is sp. Check the effective subdomain policy as well as the organizational-domain policy; explicit and inherited enforcement can differ from a scanner's display. A domain that reached p=reject on the main domain can still carry sp explicitly set to none to protect a billing system or a support desk sending from a subdomain. That exception is a reasonable operating choice, and it disqualifies the domain for BIMI until the subdomain traffic is cleaned up.
The second is the percentage tag. The guide states plainly that "'None' policies or 'pct' less than 100 percent are not accepted." A staged rollout sitting at pct=50 while the team watches reports is not at enforcement for this purpose, even though the policy value reads reject.
Both conditions are BIMI eligibility questions to assess against the receiving provider. The BIMI guide's pct criterion involves a legacy tag: RFC 9989 removed pct from DMARC percentage enforcement. It does not mean current DMARC applies that percentage. Verify the provider's current compatibility requirements.
The Certificate Is Called Optional and Behaves as Required
The BIMI record itself is short. The implementation guide gives the shape as default._bimi.[domain] IN TXT "v=BIMI1; l=[SVG URL]; a=[PEM URL]", where l points at the logo and a points at the certificate.
On the certificate, the guide marks the step "Highly recommended, but Optional," and adds that "Self-Asserted BIMI records have limited support across the various Mailbox Providers." It declines to name which providers require what, noting only that "each participating mailbox provider has their own criteria."
Google answers that question for its own inbox. The Workspace documentation on adding a BIMI TXT record states that "to display BIMI logos in Gmail, you must use a TXT record that refers to a Privacy Enhanced Mail (PEM) file." The PEM file is the certificate. A self-asserted record with only the l tag does not produce a logo in Gmail.
Our view: price the certificate as a required line item. Resolve how much of your recipient base sits on Google Workspace, because for that share a record without the a tag produces no logo at all, and the budget conversation should start from that number instead of from the specification's word "optional."
Evaluate BIMI for Each Sending Context
Outbound programmes run on sending domains separated from the main brand domain, which distinguishes streams but does not guarantee isolation of the primary domain's reputation. That architecture changes the recognition and cost questions; it does not make BIMI universally pointless.
A logo works by recognition. A prospect may not recognize a sending domain, while a familiar brand image can still carry meaning; assess the actual audience rather than assuming recognition is impossible. Meanwhile, separate organizational sending domains can require separate implementation work, while subdomains can share organizational-domain policy; check the actual domain and provider requirements. An outbound setup with many separate domains needs a cost comparison against actual provider coverage and audience recognition.
The brand domain is a different argument. Mail going to customers, applicants, partners and renewal contacts reaches people who do know the mark, and those are the recipients for whom a visual sender cue changes anything. If BIMI is worth buying, it is worth buying there.
The Logo File Is a Real Piece of Work
The guide requires "an SVG Tiny PS version of your official logo," built to the Scalable Vector Graphics (SVG) Tiny PS specification. That is a restricted profile of SVG rather than the export your design team already has on file.
The practical consequence is that the asset comes back to design with constraints that sound arbitrary from outside the standard, and it has to be hosted somewhere stable and publicly reachable, because the l tag is a URL that receivers fetch. A logo served from a location that changes during a website migration breaks the record quietly, with no bounce and no report to tell you.
Budget the design round and name an owner for the hosted file. A BIMI record whose logo URL has gone stale is worse than no record, because everyone believes the work is done.
The Sequence We Would Follow
We treat BIMI as the last item in an authentication programme, never the reason to start one.
Reach p=reject on the organizational domain and confirm no legitimate mail is failing in your DMARC aggregate reports. Check effective subdomain enforcement through inheritance or an explicit sp=reject, which usually means finding the forgotten system sending from a subdomain and authenticating it properly. Remove any pct tag once the reports are quiet. Our guide to fixing a DMARC policy that is not enabled covers the states that keep a domain short of enforcement, and reading a DMARC report covers the evidence that tells you the rollout is safe.
Only after that does the logo question make sense, because by then the answer costs a certificate and a design round instead of a quarter of authentication work.
What To Do This Week
- Read the
p,spandpctvalues from your live_dmarcrecord. Write them down, then determine effective inheritance and the receiving provider's current BIMI requirements. - If
spexplicitly disables required subdomain enforcement, inventory what sends from your subdomains. Missing `sp` alone does not establish this; inspect inheritance. That inventory is the actual project. - Get a quote for a certificate from a certification authority before committing, because Gmail display depends on it.
- Ask your design team whether an SVG Tiny PS export exists. If not, add the round to the timeline instead of discovering it later.
- Prioritize domains where recognition is useful, then assess other sending domains against audience, provider support and cost.
If you want your sending domains, authentication records and outbound setup reviewed together before you spend on any of this, book a free ICP and campaign-fit discovery call →.
Frequently Asked Questions
A strong positive reply rate for B2B cold email is 1.5–3%. Top-performing campaigns with tight targeting and personalized copy can hit 4–5%. If you're below 1%, it usually signals a deliverability or messaging problem, not a volume problem.
The safe range is 30–50 emails per inbox per day for warmed inboxes. That's why outbound systems use multiple inboxes (we use 80) to reach 40,000+ monthly sends while keeping each inbox well within safe limits. Sending more than 50/day from a single inbox risks spam folder placement.
Yes. The CAN-SPAM Act permits unsolicited commercial email as long as you include a physical address, an unsubscribe mechanism, accurate headers, and non-deceptive subject lines. Unlike GDPR in Europe, the US does not require prior opt-in consent for B2B cold outreach.
Domain warm-up typically takes 2–3 weeks. During this period, sending volume gradually increases while the email warm-up tool generates positive engagement signals (opens, replies) to build sender reputation. Skipping or rushing warm-up is the most common cause of deliverability problems.
Cold email is targeted, relevant outreach to a specific person based on their role, industry, or company, with a clear business reason. Spam is untargeted mass messaging with no personalization or relevance. The distinction matters legally (CAN-SPAM compliance) and practically (deliverability depends on relevance signals).
