BIMI

A DMARC policy of `quarantine` or `reject`, applied to the whole domain rather than a fraction. A monitoring-only policy does not qualify.

A logo in SVG Tiny Portable/Secure form — a restricted SVG profile with no scripting, no external references and a square aspect ratio — served over HTTPS.

A TXT record at `default._bimi.example.com` naming the logo's URL, and optionally the certificate's.

For several major providers, a verified mark certificate issued by one of a small number of authorities, which requires a registered trademark for the logo.

The record name matters: `default._bimi` is the selector used when a message carries no BIMI selector header, and it is the one nearly every deployment needs.

A certificate attesting that the organisation named holds rights to the logo, typically evidenced by a trademark registration in a recognised jurisdiction.

It is issued by a small set of authorities, costs a meaningful annual sum, and requires the trademark to exist before the application.

Some providers display a BIMI logo without one; others require it. Support differs, and it changes over time.

A common indicator certificate exists as a lower-cost alternative without a trademark requirement, with correspondingly narrower provider support.

It makes authenticated mail from the domain visually distinguishable in inboxes that support it, which is a recognition benefit rather than a technical one.

It does not improve deliverability. The DMARC enforcement it requires may, but that is the prerequisite doing the work, not BIMI.

It does not authenticate anything additional. A message displaying a BIMI logo passed DMARC, which it would have done anyway.

It is displayed at the discretion of each mailbox provider, and a correct configuration may simply not appear in some clients.

It is worth being clear about the order of causation, because it is frequently reversed in marketing material: enforcing DMARC is what protects the domain, and BIMI is a consequence of having done it.

`dig default._bimi.example.com TXT +short` shows whether a record is published and what it points at.

Fetch the logo URL and confirm it is served over HTTPS with a valid certificate and the correct restricted SVG profile. An ordinary SVG will be rejected.

Confirm the DMARC policy first with `dig _dmarc.example.com TXT +short`; a policy of `none` makes everything else moot.

Send a message to accounts at the providers you care about. Display is the only real test, and it varies by provider and by account type.