What is BIMI?

The record points at an SVG file in a restricted profile called SVG Portable/Secure: no scripts, no external references, no animation. Most logo exports need converting before they qualify.

Gmail and Apple Mail additionally want a Verified Mark Certificate, bought from a certificate authority and tied to a registered trademark. That runs to roughly a thousand dollars a year and takes weeks, because the trademark check is manual.

Yahoo and Fastmail display the logo without the certificate, so a record with an SVG alone is worth publishing if those providers matter to your audience.

The security argument is thinner than the marketing suggests. The logo confirms this domain is enforcing DMARC, which a recipient could not otherwise see. It is a visible reward for authentication work you already did.

The DNS entry is a TXT record at default._bimi.yourdomain.com. A typical value is v=BIMI1; l=https://yourdomain.com/brand/logo.svg; a=https://yourdomain.com/brand/mark.pem. The l tag points at the logo and the a tag points at the certificate, and both files have to be served over HTTPS.

Say a design team exports the company logo from their usual tool and uploads it. Validation fails. The file declares the wrong SVG profile, includes an embedded bitmap, and isn't square. Inboxes crop the image to a circle or a rounded square, so a wide wordmark also ends up unreadable at 40 pixels even once it validates.

A logo that works is a square, vector-only file with a solid background, a title element, and the mark centered with room around it. Expect a round of edits between the designer and whoever runs DNS before it passes.

Start with the prerequisite, because it filters most people out. Your organizational domain needs DMARC at quarantine or reject, applied to all mail, and the subdomain policy can't be none. If you're still at p=none, BIMI is next year's project at the earliest, and the DMARC work is worth more than the logo anyway.

Then look at cost against volume. A Verified Mark Certificate needs a registered trademark and an annual fee. Gmail also accepts a Common Mark Certificate, which doesn't require a trademark registration, though mail sent with one doesn't get Gmail's blue verified checkmark. For a consumer brand mailing millions, a recognizable logo beside every message is cheap at that price.

A 15-person B2B firm sending a few thousand emails a month has a different answer. Your recipients mostly read mail in corporate Outlook, where the logo doesn't show. Publish the SVG-only record if Yahoo matters to your audience, and put the certificate money toward something else.