What it needs
- 01
Enforced DMARC
Your policy must be reject, or quarantine applied to all mail. BIMI does nothing at none.
- 02
A logo in the right format
A square SVG in the Tiny PS profile, which is stricter than the SVG a designer exports.
- 03
A mark certificate
Gmail and Apple Mail show a logo only with a mark certificate, which you buy from a certificate issuer.
The record
v=BIMI1; l=https://…/logo.svg; a=https://…/certificate.pem
Which inboxes show it
Support varies by provider and changes. Gmail and Apple Mail need a mark certificate. Yahoo shows a logo without one. Microsoft's inboxes do not show BIMI logos.
Sources: Google, Set up BIMI; Apple, About BIMI support in Apple Mail; Yahoo, BIMI.
What it is not
BIMI is not a security control. It does not stop a fake. It shows your logo on mail that has already passed.
How OuterMark handles it
The free check reports whether a BIMI record exists, as advice. It never lowers your score (check 7). Every Managed DMARC customer gets a readiness checker that says what is still missing. On the Scale plan, Managed BIMI checks your logo, hosts it and publishes the record once your DMARC policy is ready. You supply the logo and buy the certificate.
Questions
How much is a mark certificate?
It is sold by certificate issuers, not by us, and priced by them.
Do we need a registered trade mark?
A Verified Mark Certificate needs one. A Common Mark Certificate does not, but needs proof you have used the logo.
Can we have BIMI without reject?
Quarantine applied to all mail is enough.