BIMI and your logo in the inbox: what you get after p=reject
BIMI puts your verified logo next to your emails, but only once DMARC is enforced. What BIMI and a VMC are, and why they are the visible payoff for getting DMARC right.
BIMI is the feature that puts your company logo next to your emails in the inbox. It is also one you cannot switch on until your DMARC policy is enforced. That makes it a rare thing in email security: a visible, on-brand reward for finishing the unglamorous work of reaching p=reject. Here is what BIMI is, what a VMC is, and why the logo in the inbox is a business win that only follows from getting DMARC right first.
What BIMI actually is
BIMI stands for Brand Indicators for Message Identification. In practical terms, it is a way to tell mail providers “here is my official logo, show it next to messages that genuinely come from me”. In supporting inboxes, your customer then sees your logo beside your name in their message list, instead of a gray placeholder or a generic initial.
You enable it by publishing a small DNS record that points to your logo file (a specific, tightly specified SVG format) and, where required, to a certificate proving the logo is yours. Receivers that support BIMI read that record and, if everything checks out, display your logo.
The effect is simple and surprisingly powerful. A customer scanning a crowded inbox spots your brand instantly, and a message wearing your real logo carries a visual signal of legitimacy that a forgery cannot easily copy.
The prerequisite everyone hits: enforced DMARC
Here is the catch that sends people looking for answers. BIMI does not work on a domain that is only monitoring. You must have an enforced DMARC policy first, meaning p=quarantine or p=reject. A domain sitting at p=none cannot display a BIMI logo, no matter how correctly the BIMI record itself is set up.
The reasoning is sound. BIMI is a trust signal, so a provider will only show your logo once it is confident that mail claiming to be from you really is from you. That confidence comes from DMARC enforcement. If your policy is p=none, you are telling receivers “I am not yet asking you to act on forgeries”, and no provider is going to attach your brand to messages it has been told to let through unchecked. Enforcement is the ticket to entry, and most providers expect p=reject (or at least a real p=quarantine) before they will show anything.
So BIMI is not a separate project bolted on beside DMARC. It is the thing waiting on the other side of enforcement. The work you do to reach p=reject is exactly the work that makes it possible.
What a VMC is, and why Gmail wants one
Publishing a logo raises an obvious question: what stops a scammer from claiming your logo as theirs? The answer, for the providers that demand it, is a VMC.
A VMC is a Verified Mark Certificate. It is a certificate, issued by an approved authority after they verify that you own the logo, usually by checking a registered trademark. The certificate cryptographically ties your logo to your organization, so a receiver can confirm the logo genuinely belongs to the business sending the mail. You publish a reference to the VMC in your BIMI record alongside the logo itself.
Support varies by provider. Some will show a logo without a VMC; others require one. Gmail, in particular, requires a VMC before it will display your BIMI logo, so if reaching Gmail’s inbox with your brand attached is the goal, budget for obtaining one. A VMC is a paid certificate and it depends on holding a registered trademark for the logo, so it is a real, if modest, business step rather than a DNS tweak. Because requirements shift, confirm the current rules with each provider you care about before you invest.
Why this is the payoff, not the project
It helps to frame BIMI correctly for anyone weighing up whether DMARC enforcement is worth the effort. The security case for p=reject is real but abstract: forgeries you will never see get refused at receivers you do not control. It protects you from a bad thing that mostly happens out of sight.
BIMI turns that abstract protection into something you can point at. After you finish getting to enforcement, your logo appears in customers’ inboxes. It is visible, it is on brand, and it reinforces recognition and trust every time you send a message. For a business owner who has been asked to fund the DMARC work, “and then our logo shows up next to our emails” is a far easier win to understand than a technical policy change.
That order matters, though, and it is worth being honest about. BIMI does not come first, and it does not replace the fundamentals. You do not get the logo by publishing a BIMI record; you get it by reaching enforcement and then publishing a BIMI record. The logo is the reward for the discipline, not a shortcut around it.
The order of operations
If the inbox logo is what you are chasing, the path is straightforward:
- Get your legitimate mail authenticating with SPF and DKIM, aligned to your domain.
- Move your DMARC policy up through monitoring to an enforced
p=quarantineorp=reject, confirming along the way that you are not blocking your own mail. - Prepare your logo in the required
SVGformat. - Obtain a VMC if you are targeting providers that require one, Gmail included, which means having a registered trademark for the logo.
- Publish your BIMI record pointing at the logo and, where needed, the VMC.
The DMARC part is the hard part, and it is the part that also happens to be the most valuable on its own. We map out the safe route to enforcement, step by step, in the path to p=reject.
If you want to see where your domain sits today, whether it is at p=none, already enforced, or somewhere in between, run the free DMARC checker. It analyzes your live policy and tells you plainly how close you are to the point where BIMI becomes possible. Get DMARC right, and the logo in the inbox is the visible proof that you did.