BIMI: How to Add Your Logo to Gmail and Outlook Inboxes?

What is BIMI?

BIMI (Brand Indicators for Message Identification) is an email standard that allows you to display your company logo in the recipient's inbox – supported by Gmail, Yahoo, Apple Mail, Fastmail, and others.

Visually, it looks like this: instead of a generic initial (e.g., "K"), Kodulehe Haldus's green logo is displayed next to every email you send. The result: higher trust, better open rates, and reduced phishing risk.

Why is BIMI Important?

1. Trust and Brand Recognition According to a [Red Sift report](https://redsift.com/insights/bimi-impact-report), BIMI increases: - Open rates by **10-12%** - Click-through rates by **5-8%** - Brand recognition by **18%**

2. Anti-Phishing Protection The logo is displayed **only** if the email is authentic (passed DMARC + DKIM + SPF checks). A phisher cannot use your logo – the user will immediately notice something is wrong.

According to the Verizon DBIR 2024, 68% of cyberattacks begin with phishing. BIMI reduces the success rate of these attacks.

3. Competitive Advantage In Estonia, fewer than 5% of companies use BIMI (our estimate). By being among the first, you stand out in the inbox.

Technical Prerequisites

BIMI does not work in isolation. You need:

1. DMARC Policy `p=quarantine` or `p=reject` ``` v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.ee; pct=100 ``` `p=none` **is not enough** – Gmail BIMI requires at least quarantine.

2. SPF and DKIM Must Be Configured - SPF: `v=spf1 include:_spf.google.com ~all` (example with Google Workspace) - DKIM: Activate in your email provider's panel (Google, Microsoft 365, Zoho, etc.)

3. Logo in SVG Format (SVG Tiny PS profile) - Square (1:1) - Maximum **32 KB** - Specific SVG profile (no support for animations, scripts, or raster images) - Tool: [BIMI SVG Conversion Tool](https://bimigroup.org/creating-bimi-svg-logo-files/)

4. BIMI DNS Record ``` default._bimi.yourdomain.ee. TXT "v=BIMI1; l=https://yourdomain.ee/bimi-logo.svg; a=https://yourdomain.ee/vmc.pem" ```

5. VMC Certificate (Required by Gmail) **Verified Mark Certificate** – proves that the logo is a registered trademark.

VMC Certificate – The Biggest Hurdle

Gmail (the largest email provider) requires a VMC to display the logo. Yahoo and Apple accept logos without it, provided there is a strong DMARC policy.

Requirements for obtaining a VMC: 1. **Registered Trademark** for the logo ([EUIPO](https://www.euipo.europa.eu/) or [USPTO](https://www.uspto.gov/)) 2. The trademark must cover the exact graphics of the logo 3. **Cost**: 1500-2000 USD/year ([DigiCert](https://www.digicert.com/tls-ssl/verified-mark-certificates) or [Entrust](https://www.entrust.com/digital-security/certificate-solutions/products/digital-certificates/verified-mark-certificates))

Alternative: CMC Certificate In 2024, Google added support for the [Common Mark Certificate (CMC)](https://www.digicert.com/blog/common-mark-certificates-cmc) – the logo must be **in public use for 12+ months** without needing a registered trademark. Cheaper (~1000 USD/year).

Step-by-Step Guide

Step 1: Audit Your Current DMARC Tool: [MXToolbox DMARC checker](https://mxtoolbox.com/dmarc.aspx)

If you don't have DMARC: ` _dmarc.yourdomain.ee. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.ee" ` Start with p=none and monitoring. After 4-8 weeks (once all legitimate sources are authenticated), move to p=quarantine.

Step 2: Prepare Your Logo - Convert your existing logo to SVG Tiny PS format - Square composition - Solid background (not transparent for compatibility across services) - Test: [BIMI SVG Validator](https://bimigroup.org/bimi-generator/)

Step 3: Order VMC (If targeting Gmail) - Prerequisite: Trademark registration (if not yet registered, do this first – approx. €600 in Estonia, €850 for EUIPO) - Order VMC via DigiCert or Entrust - The process takes 2-6 weeks

Step 4: Add DNS Records Cloudflare, Cloudways, Veebimajutus.ee – adding a TXT record is a 1-click process in all panels.

Step 5: Test - [BIMI Inspector](https://bimigroup.org/bimi-generator/) - Send a test email to a Gmail account - Wait 24-48h for Gmail to verify

Who in Estonia has Set Up BIMI?

Our audit (June 2026) showed that full BIMI + VMC is only used by: - Major banks (Swedbank, SEB) - 2-3 telecommunications companies - A few select e-commerce stores

This is a massive opportunity for smaller businesses to differentiate themselves.

Total Cost Structure (Year 1)

In subsequent years: only certificate renewal fees apply.

Common Issues

1. DMARC p=none – Gmail will not display the logo
2. SVG contains raster image references – the validator will return an error
3. Logo hosted on HTTP instead of HTTPS – it will not be displayed
4. VMC doesn't match the exact logo version – it must match the one in the trademark registry
5. Multiple default._bimi records – only one is allowed

Further Reading

• Website Security in 10 Steps
• Phishing Attacks in Estonia
• SSL Certificate – What is it?
• WAF: Web Application Firewall
• Password Managers for Businesses

Summary

BIMI is not just a "nice-to-have" – it is the next step in email security and brand trust. Major brands (Apple, Bank of America, CNN) have already implemented it. In Estonia, you still have the advantage of being an early adopter.

We can help with full BIMI setup (DMARC audit + SVG + VMC ordering + DNS) – check out website security and contact us.