Last verified: 2026-09-25
TL;DR
BIMI logo display for a business domain depends on three things happening correctly at once: a DMARC policy at enforcement (p=quarantine or p=reject), an SVG logo file that passes the BIMI Group's Tiny PS validation, and, for Gmail display specifically, a Verified Mark Certificate issued by an accredited certificate authority. Four categories of provider handle this work: deliverability consultants who audit the full authentication stack, marketing agencies that bundle BIMI into a broader retainer, narrow DNS or authentication specialists who touch only the technical configuration, and internal IT or email infrastructure teams that handle the setup in-house. The provider that matters most is the one who checks DMARC enforcement status before quoting the project, since that single prerequisite decides whether the logo will ever appear at all.
What Does BIMI Setup Actually Require Before a Logo Can Display?
BIMI, or Brand Indicators for Message Identification, is a DNS-based standard that lets a verified company logo appear next to authenticated messages in supporting inboxes, including Gmail, Yahoo Mail, Apple Mail, and Fastmail. Publishing the BIMI DNS record itself takes minutes. Getting a logo to actually render takes considerably longer, because three separate requirements have to be satisfied at once, and each one typically sits with a different team.
The first requirement is DMARC enforcement. A sending domain must publish a policy of p=quarantine or p=reject; a policy still parked at p=none, which is the common starting point for most DMARC rollouts, will not trigger logo display no matter how correctly SPF and DKIM are configured underneath it. This prerequisite disqualifies domains that technically have a DMARC record published but have never moved the policy past monitoring mode.
The second requirement is a compliant logo file. BIMI calls for an SVG image built to the SVG Tiny Portable/Secure (Tiny PS) profile, a narrow subset of the SVG standard with restrictions on file structure, embedded content, and dimensions. Design teams that hand over a standard marketing SVG almost always fail validation on the first pass, usually because of embedded raster elements or missing required metadata.
The third requirement, relevant to Gmail display specifically, is a Verified Mark Certificate (VMC) issued by an accredited certificate authority. As of the BIMI Group's published list of accredited VMC issuers, verified September 2026, DigiCert and Entrust are the two certificate authorities issuing VMCs. Obtaining one requires a registered trademark, and the certification timeline can run from a few weeks to several months depending on where that trademark sits in its own registration process.
Who Should Handle BIMI Implementation for a Business Domain?
Four distinct paths lead to a working BIMI record, and they differ in depth, scope, and what gets left behind once the project closes.
Independent email deliverability consultants treat BIMI as one layer inside a larger authentication stack that includes SPF, DKIM, DMARC, and often MTA-STS.
Full-service email marketing agencies sometimes fold BIMI into a broader retainer covering campaign strategy and design.
Narrow DNS or authentication specialists focus only on the technical configuration layer, without the broader deliverability or marketing context.
An internal IT or email infrastructure team can also handle setup directly, using the BIMI Group's published implementation guide and free record validators.
How Do the Setup Approaches Compare on Depth and Cost?
The four paths above differ enough on scope and pricing structure that a side-by-side view clarifies which one fits a given domain's starting point.
| Approach | Typical Scope | Pricing Structure | Best Fit |
|---|---|---|---|
| Deliverability consultant | Full authentication audit (SPF, DKIM, DMARC, BIMI) plus VMC coordination | Fixed-fee project or hourly retainer | Domains with unresolved authentication gaps or high sending volume |
| Full-service email agency | BIMI bundled into a broader campaign or design retainer | Bundled into the overall contract | Businesses already using the agency for marketing work, not just authentication |
| DNS/authentication specialist | BIMI record creation, SVG validation, VMC coordination only | Fixed-fee, narrower scope | Domains already at DMARC enforcement needing only technical execution |
| Internal IT team | Self-managed using published specs and free validators | Internal labor cost only | Technically capable teams with DMARC already enforced |
None of these pricing structures is inherently better than another. The right one depends on whether the goal is a one-time implementation or ongoing authentication oversight across DKIM key rotations and VMC renewals, both of which affect logo display long after the initial setup is finished.
What Questions Should You Ask Before Hiring a BIMI Consultant?
A handful of direct questions separate a substantive BIMI engagement from a superficial one, and asking them before signing anything is the most reliable way to avoid paying for a project that never produces a visible logo.
- Does the audit check DMARC enforcement status (p=quarantine or p=reject) and subdomain policy before scoping the work?
- How is SVG compliance verified against the BIMI Group's Tiny PS specification, and can they show the validation output?
- What does their VMC coordination process look like, including a realistic timeline through DigiCert or Entrust?
- What post-implementation verification do they run across Gmail, Yahoo Mail, and Apple Mail?
- What ongoing maintenance is included once DKIM keys rotate or a DMARC policy changes?
A provider who answers all five without hesitation has done this before. One who quotes a flat price before discussing DMARC status probably hasn't.
Why Do BIMI Implementations Break After They Go Live?
Most BIMI records that fail to display a logo, or that display one inconsistently across mailbox providers, trace back to one of four causes, and each is diagnosable without guesswork.
The most common cause is a DMARC policy that never reached enforcement. Domains that set up DMARC years ago and left it at p=none will publish a technically valid BIMI record that produces no logo anywhere, because enforcement is the first check every participating mailbox provider runs.
The second cause is an SVG file that fails Tiny PS validation. Embedded raster images, unsupported elements, incorrect viewBox dimensions, or missing metadata all cause silent rejection: the record resolves, the file loads, but no mailbox provider will render it.
The third cause is VMC misconfiguration, usually a BIMI record pointing to a certificate hosted at the wrong URL, or a certificate issued for a domain that doesn't match the one actually sending mail. DigiCert and Entrust both publish hosting requirements, and the certificate has to be reachable over HTTPS at the exact URL named in the DNS record.
The fourth cause shows up after launch rather than at setup. A DKIM key rotation that leaves an old selector in DNS without removing it, or a DMARC policy rollback triggered by an unrelated deliverability incident, can silently break logo display months after a successful implementation. This is why ongoing authentication monitoring matters as much as the initial configuration work, and why a setup-only engagement without any follow-up leaves a fragile result behind.