Field note · 2026-10-15 · DME Computer Services
What is BIMI and do I need it
BIMI is a logo next to mail that already authenticated. It is not a fourth security record. Gmail will not show it while DMARC is still at p=none, and it wants a certificate on the logo.
People add BIMI because they want the company mark in Gmail. That is a display feature. The security work is still SPF, DKIM, and a DMARC policy receivers are willing to enforce. If you do not have those, a logo record does not change what a spoofed message can do.
What the record is
The specification is the IETF draft Brand Indicators for Message Identification. It is a draft, not an RFC. The default selector is the TXT record at default._bimi plus your domain, for example default._bimi.company.com. The record starts with v=BIMI1. l= is where the logo file lives. a= is where the evidence file lives, when you have one. An empty l= and an empty a= is how the draft says you decline BIMI.
Receivers only consider it for a message that passed DMARC. The logo is not fetched for a failure, and it is not fetched because you put a picture on your website.
What Gmail actually requires
Google's BIMI page was last updated 13 Oct 2026. This note was checked against it on 2026-10-15. To use BIMI there you need all of the following.
- DMARC at p=quarantine or p=reject, with pct=100. They say BIMI does not support p=none or a percent under 100. Getting to that policy safely is How to set up DMARC. Do not jump to reject so a logo can appear.
- A VMC or a CMC from a certificate authority. A VMC needs the logo trademarked at an intellectual-property office the issuers recognize. Google says to expect that process to take 6 to 12 months, and they recommend a VMC when you can get one. If the logo is not trademarked, they point you at a CMC and at the current list of mark-certificate issuers. Check that list on their page. It changes.
- An SVG of the logo that meets their extra rules: at least 96 by 96 pixels, with the size in absolute pixels, not percentages. They recommend a square, a solid background, and a centered mark. The file is hosted on HTTPS. They recommend TLS 1.2 or later.
Their TXT examples use a sample host. With that host left as they wrote it, a PEM file that contains the logo looks like v=BIMI1;l=;a=https://images.solarmora.com/brand/certificate.pem, and an SVG looks like v=BIMI1;l=https://images.solarmora.com/brand/bimi-logo.svg. Replace the host with yours. Publish the record at the DNS host. They say the logo can take up to 48 hours to show.
Do you need it?
If the goal is "stop strangers sending as our domain," you do not need BIMI. You need the three authentication records, and a DMARC policy that is no longer p=none once the reports are clean. BIMI sits on top of that and asks a receiver to show a logo. A company without a trademarked mark, and without a reason to spend months on a certificate, can stop after DMARC.
If the goal is "make the invoices look like us in Gmail," BIMI is the documented way, and only after enforcement. A lookalike domain still will not show your logo, because BIMI follows the authenticated domain, not a name that merely resembles it. A stolen mailbox will show it, if you have BIMI, because the mail really is yours. The logo is not proof the person at the keyboard was yours.
See whether you are even eligible
/check reads the DMARC record, including the policy tag. It does not look up default._bimi, and it does not know whether a certificate exists. p=none on that check means Gmail will not show a BIMI logo. It stores nothing.
The $9 report writes the same live lookup into a PDF, with steps for the unfinished SPF, DKIM, and DMARC rows. It requires a license key. It is not a BIMI certificate and it does not host a logo.
Getting from p=none to quarantine or reject, while a real sender is still failing, is the part that bounces mail. DMARC setup is that rollout, done by DME Computer Services in Omaha, plus 30 days of reading the aggregate reports. $199 is one Google or Microsoft domain. $499 is three domains or extra senders. The service does not include a trademark filing or a VMC. Contact info@dmeomaha.com.
Sources
Free check · nothing stored
See the records you have now
The checker reads MX, SPF, DMARC, and five common DKIM selectors once. It does not send a message, it does not read DMARC reports, and it does not keep the domain.
From the directory
The products that read DMARC reports. BIMI is not what they are for. You need the policy in place before a logo means anything.
- CategoryDMARC, SPF, and DKIMTools that read DMARC reports or help you publish SPF, DKIM, and DMARC so other people cannot send mail as your domain.
- CategoryFree checkersTools with a check or a plan you can use without paying. Trials are not listed here unless a lasting free tier was on the vendor page.
The other notes
- How to set up DMARC (step by step)Publish one SPF record and DKIM first. Then a DMARC record at p=none, read the reports, and only then move to quarantine and reject.
- SPF vs DKIM vs DMARC explainedSPF lists who may send. DKIM signs the message. DMARC checks that one of them matches the From address and tells receivers what to do on failure.
- Is my email domain being spoofed? How to tellRead Authentication-Results on a real message and, if you asked for them, the DMARC reports. A DNS lookup alone does not prove an attack today.
- How to set up DMARC in Microsoft 365Publish Microsoft's SPF include, copy both DKIM CNAMEs from the Defender portal, then add DMARC at p=none and move to reject only after the reports are clean.
- Google Workspace SPF/DKIM/DMARC setupAdd Google's SPF include, generate a DKIM key in the Admin console, and publish DMARC at p=none. Do not paste the strict-alignment sample on day one.
- Why are my emails going to spamA failed SPF, DKIM, or DMARC check, a complaint rate Gmail flags, or a missing PTR or TLS setup can file mail as spam. The wording is not the only cause.
- How to spot invoice fraud and business email compromiseA new bank account in an invoice email is unconfirmed until you call a number you already had. DMARC does not stop a lookalike name or a stolen mailbox.
Questions
Short answers to the questions this note is for. The paragraphs above are the longer version.
- Does BIMI stop spoofing?
- No. BIMI is a logo the receiver may show after mail already passes DMARC. The control that asks receivers to quarantine or reject a failure is the DMARC policy. A domain at p=none can be spoofed and cannot show a BIMI logo at Gmail.
- Can I publish the logo without a certificate?
- Google's BIMI page says you need a VMC or a CMC from a certificate authority. A VMC needs a logo trademarked at an office the issuers recognize. They say that process can take 6 to 12 months. A CMC is the option they describe when the logo is not trademarked. One of their TXT examples points at an SVG. The other points at a PEM and leaves l= empty. A logo with neither certificate is not the setup they describe.
- Will every mailbox show the logo?
- No. BIMI is a request. The receiver decides whether to fetch the logo and whether to show it. Google's page says that after you publish the TXT record it can take up to 48 hours for a logo to show in recipients' mailboxes. That is Gmail's timing, not a promise about other providers.
- Our DMARC policy is p=none. Can we add BIMI now?
- Not for Gmail. Their page says p must be quarantine or reject, and pct must be 100. BIMI does not support p=none or a pct under 100. Move the policy only after legitimate senders align. The logo is not a reason to jump to reject.
- Do we need this?
- Not for security. You need SPF, DKIM, and a DMARC policy you have actually enforced if you want receivers to treat exact-domain spoofs as failures. The logo is optional, and it is mostly useful once you have a trademarked mark and a reason for people to see it in the inbox. A small company with neither can skip it.