BIMI Setup: Show Your Logo in Gmail (Step by Step)

To show your logo next to your emails in Gmail, you need a DMARC policy set to quarantine or reject, a logo saved in a strict SVG format, a certificate for that logo (a VMC or CMC) in PEM format, and a BIMI TXT record at default._bimi.example.com that points to the certificate. The certificate means a third party checks your logo first, so plan for that.

Here is the surprising part: according to Google's own setup page, Gmail supports BIMI logos only through PEM certificate files. A self-hosted SVG logo with no certificate will not show in Gmail at all, even if every DNS record is perfect.

By the end of this guide you will be able to check that your DMARC is ready, prepare the logo file, publish the BIMI record, and test each piece with dig and Google's own requirements.

What BIMI actually is

BIMI stands for Brand Indicators for Message Identification. It is a DNS record that tells mailbox providers, "this is the logo for mail from my domain, and here is proof it is mine."

Think of it like the photo on an ID card. DMARC is the ID card itself: it proves the mail really comes from your domain. BIMI is the photo printed on it, and the certificate (VMC or CMC) is the office stamp that says someone checked the photo belongs to you.

Why this matters: BIMI sits on top of email authentication. If your SPF, DKIM, and DMARC are not working, no logo record will fix that.

Heads up: a logo only appears where the mailbox provider supports BIMI and decides to show it. BIMI Group says each mailbox provider sets its own criteria for when a domain's logo may be displayed, and Google's page says non-Gmail web apps do not support this feature. So treat BIMI as "your logo can appear in supporting inboxes", not "your logo will appear everywhere".

Before you start

Run through this list before you touch DNS.

• DNS access: a login to wherever your domain's DNS is hosted (your hosting control panel, your registrar, or a DNS provider). This is often not the same company that hosts your email.
• Working SPF or DKIM, plus DMARC: Google says you must set up SPF or DKIM first, and BIMI Group says SPF, DKIM, and DMARC should all be authenticated and aligned for all your organization's mail. If you are not there yet, start with our SPF, DKIM, and DMARC setup guide.
• Your logo source file: ideally a vector file (for example an Adobe Illustrator file), not a JPG or PNG.
• A public HTTPS web server on your domain: you will host the PEM file (and optionally the SVG) there.
• Budget and time for a certificate: a VMC or CMC comes from a certificate authority, and it may cost money. Prices vary by issuer, so check with them directly.
• A trademark, if you want a VMC: Google says a VMC needs a logo trademarked with an intellectual property office that VMC issuers recognize, and that the trademark process can take 6 to 12 months.
• A text editor: you will edit the SVG file by hand.
• The `dig` command: a DNS lookup tool from the BIND project. If you do not have it, any online DNS lookup tool that shows TXT records works too.
• Time: about an hour of hands-on work, plus waiting for the certificate, plus up to 48 hours for logos to appear after the record goes live.
• Risk level: adding the BIMI record itself is low risk. Tightening DMARC to quarantine or reject is the risky part, because mail that fails authentication will go to spam or be refused.

Quick tip: before changing any DNS record, copy its current value into a text file with the date. That is your backup, and it lets you undo a change in seconds.

Step-by-step BIMI setup

Step 1: Back up your current DNS records

Look up what you have now, so you can compare and roll back later. These commands print your current DMARC record and any existing BIMI record.

dig +short TXT _dmarc.example.com
dig +short TXT default._bimi.example.com

You should see your DMARC record (it starts with v=DMARC1) on the first line of output. The second lookup usually prints nothing if you have never set up BIMI. Save both outputs in your backup file.

Step 2: Get DMARC to enforcement

Google's BIMI page says the DMARC policy option (p) must be quarantine or reject, and BIMI does not support p=none. BIMI Group goes further: the policy must be at enforcement on the organizational domain and its subdomains, so sp (the subdomain policy) must also be quarantine or reject if you set it.

This is what a BIMI-ready DMARC record can look like, using quarantine for both the main domain and subdomains.

_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; sp=quarantine; pct=100; rua=mailto:dmarc@example.com"

If you are already confident in your mail flow, reject works too. This version refuses failing mail instead of sending it to spam.

_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:dmarc@example.com"

Heads up: do not jump straight from p=none to reject without reading your DMARC reports first. If a tool like your invoicing app or newsletter service is not authenticated, its mail will start failing. Our guide to reading DMARC aggregate reports shows how to spot those senders.

After you save the change, run the Step 1 dig command again. You should see p=quarantine or p=reject in the output.

Step 3: Settle the pct question

You may have read that pct is now historic. Our post on the RFC 9989 change and pct explains the newer DMARC standard. But at the time of writing (7 November 2026), Google's BIMI guidance still says the percent option (pct) must be set to 100, and its troubleshooting page says BIMI does not support a pct value other than 100.

So here is the practical rule for BIMI: if your record has pct, it must be pct=100. Google's DMARC page also says that when pct is left out, the policy applies to 100% of messages. BIMI Group says a pct value below 100 is not accepted.

Why this matters: pct=50 or pct=10 is the classic leftover from a gradual DMARC rollout. It quietly blocks BIMI, and nothing warns you.

But what if you remove pct because of the newer standard? Per Google's DMARC page, an omitted pct means 100%, so that is fine for BIMI too. Keeping pct=100 simply matches Google's BIMI wording word for word.

Step 4: Make your logo an SVG Tiny PS file

BIMI logos use a strict SVG flavour called SVG Tiny PS (Portable/Secure). It is a cut-down SVG with no scripts or outside links, so it is safe for mail apps to display.

Google lists these requirements and recommendations for Gmail:

• Square logo, centred, on a solid background (transparent backgrounds may not display as expected).
• At least 96 by 96 pixels, written as absolute pixel sizes such as width="96" height="96", never percentages.
• File size of 32 KB or less.
• A <desc> element for accessibility, and a <title> element (recommended) with your organization's name.
• baseProfile="tiny-ps" and version="1.2" on the root <svg> element.
• No external links or references (other than XML namespaces), no scripts, no animations or interactive elements.
• No x= or y= attributes on the root <svg> element.

Google's detailed steps use Adobe Illustrator. In Illustrator, go to File > Save As, name the file in lowercase with dashes (for example example-bimi.svg), and set Format to SVG (svg), not svgz. In SVG Options, set the SVG profile to SVG Tiny 1.2 and Image Location to Preserve. Google also says to convert any text to outlines with Create outlines, and to avoid bitmaps, links to other files, live text, and grouped objects.

Then open the file in a text editor. This is how the top of a finished file should look, with the BIMI attributes, a title, and a description in place.

<?xml version="1.0" encoding="utf-8"?>
<svg version="1.2" baseProfile="tiny-ps" xmlns="http://www.w3.org/2000/svg" width="96" height="96">
<title>Example Company</title>
<desc>Logo of Example Company</desc>
<g id="design">

Heads up: Google's own sample header still shows x="0px", while the text of the same page says to remove the x and y attributes. Follow the requirement and remove them.

Quick tip: Google notes that no single app meets all BIMI requirements out of the box, so manual edits are normal. BIMI Group also links to an SVG assistant tool and conversion tools from its implementation guide if you prefer a helper.

You should now have one .svg file under 32 KB that opens in a browser and shows your logo on a solid square background.

Step 5: Get a VMC or CMC certificate

A certificate is how a trusted third party confirms the logo is yours. Google recommends a Verified Mark Certificate (VMC), and accepts a Common Mark Certificate (CMC) as the other option.

• VMC: needs a trademarked logo. Google says Gmail shows a checkmark next to senders verified with a VMC.
• CMC: the option when your logo is not trademarked. BIMI Group says it allows some flexibility with the display of logos.

Certificates come from Mark Verifying Authorities. At the time of writing (7 November 2026), BIMI Group's issuer list names DigiCert, GlobalSign, and SSL.com. Check the BIMI Group issuer list for the current names, and ask each issuer for its price and timeline.

You submit your SVG to the issuer and request the certificate. When it is issued, you receive an entity certificate PEM file. Google says the SVG logo and the certificate are embedded in that PEM.

But what if you skip the certificate? BIMI Group labels the certificate step "Highly recommended, but Optional", and says self-asserted BIMI (no certificate) has limited support across mailbox providers. For Gmail specifically, Google says standalone SVG files are not supported in Gmail. So if Gmail is your goal, the certificate is not optional in practice.

Step 6: Build and upload the PEM file

Google says to append any intermediate and root CA certificates to the PEM file, in issued order: the entity certificate first, then the intermediate, then the root. Your issuer should give you those extra certificates.

This is the shape of the finished file, with each block pasted one after the other.

-----BEGIN CERTIFICATE-----
(entity certificate from your issuer)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(intermediate certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(root certificate)
-----END CERTIFICATE-----

Upload the file to your public web server and copy its full URL, for example https://images.example.com/brand/certificate.pem. Google says the server must use HTTPS, recommends TLS 1.2 or later, and says the TLS certificate must reference a trusted root CA certificate.

Open the URL in a private browser window. You should get the file (it downloads or shows as text), not a login page or a 404 error.

Step 7: Publish the BIMI TXT record

Now tell the world where the certificate lives. Google's detailed steps give these values:

• Type: TXT
• Host or Name: default._bimi (some DNS panels add your domain automatically; if not, enter default._bimi.example.com)
• TTL: 1 hour (3600 seconds)
• Value: your BIMI assertion record

This is the record in the form Google shows for a PEM file, with l= left empty and a= pointing at your certificate.

default._bimi.example.com. 3600 IN TXT "v=BIMI1;l=;a=https://images.example.com/brand/certificate.pem"

BIMI Group's guide shows a template that fills both tags, with l= pointing at the SVG and a= pointing at the PEM. This version is useful if you also host the SVG on your own domain.

default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://images.example.com/brand/example-bimi.svg; a=https://images.example.com/brand/certificate.pem"

Either way, Gmail reads the logo that is embedded inside the PEM. In these records, v is the version (always BIMI1), l is the logo URL, and a is the certificate URL.

Heads up: Google warns that the number 1, the uppercase letter I, and the lowercase letter l look similar. It is BIMI1 (ending in the number one), and the tag is a lowercase l.

After you save, it can take up to 48 hours for BIMI to start working and for logos to show in recipients' mailboxes, according to Google.

Control panel variants

cPanel Zone Editor

In cPanel's Zone Editor, click Manage next to your domain. Click the arrow next to Add Record and choose the TXT record type. Enter default._bimi.example.com. as the name, paste the value into the Record box, then click Save Record.

Quick tip: cPanel's documentation says the Record text box will accept invalid data, so double-check what you paste. If you cannot find Zone Editor, your host may have turned it off, and you will need to ask them to add the record.

Other DNS providers

Look for a DNS records page with an Add record button, choose TXT, and use default._bimi as the name. Google says the steps can be different for each provider and field names may vary, so match the values rather than the labels.

Made-up example: Priya runs a small bakery at example.com. Her website is on cPanel hosting, but her DNS is managed at her registrar. She adds the BIMI record in cPanel, waits two days, and sees nothing. dig shows no record at all, because cPanel's zone is not the live one. She adds the same record at the registrar, and dig shows it within the hour. Lesson: add records where your nameservers point.

How to check it worked

Check each layer in order.

Check 1: The BIMI record is live

This command asks DNS for your BIMI record.

dig +short TXT default._bimi.example.com

You should see one line starting with "v=BIMI1; and containing your a= URL. Empty output means the record is not live yet or was added in the wrong place.

Check 2: DMARC is at enforcement

This command prints your DMARC record again.

dig +short TXT _dmarc.example.com

You should see p=quarantine or p=reject. If sp= appears, it must also be quarantine or reject. If pct= appears, it must be pct=100.

Check 3: The record format and DMARC together

BIMI Group's free BIMI Inspector takes your domain (and an optional selector) and checks the BIMI record format and whether DMARC is at enforcement. The page says it does not validate your SVG or Mark Certificate, so a pass here is necessary but not the whole story.

Check 4: The files load and meet Google's list

Open your PEM URL in a private browser window and confirm it loads over HTTPS. Then walk through Google's BIMI requirements page and tick off each logo rule from Step 4.

Check 5: A real Gmail inbox

Send a normal email from your domain to a personal Gmail address and open it in Gmail on the web. Give it up to 48 hours after the record goes live. With a VMC, you should also see the checkmark Google mentions.

Troubleshooting

Logo never appears, and dig shows pct=50 (or any value below 100)

Likely cause: a leftover from a gradual DMARC rollout. Google says BIMI does not support a pct value other than 100. Fix: change it to pct=100 (or remove it, since Google treats an omitted pct as 100%), then wait for DNS to update.

Logo never appears, and your DMARC record says p=none or sp=none

Likely cause: DMARC is in monitor-only mode. Google says BIMI does not support p=none, and BIMI Group requires enforcement on subdomains too. Fix: move p (and sp, if present) to quarantine or reject after checking your reports.

dig for default._bimi.example.com returns nothing

Likely cause: the record was added at a DNS host that is not authoritative for your domain, or your panel added the domain twice (for example default._bimi.example.com.example.com). Fix: check where your nameservers point, and enter just default._bimi in panels that add the domain for you.

Everything checks out, but Gmail still shows no logo

Likely causes, from Google's troubleshooting page: the certificate is not yet approved, the PEM file is missing the intermediate or root certificates, the PEM URL in the record is wrong, or the SVG embedded in the certificate has a format problem. Fix: confirm status with your certificate authority, re-check the certificate order (entity, intermediate, root), and make sure the PEM file loads publicly.

Your logo shows in some mail apps but not in Gmail

Likely cause: you published a self-asserted record with only l= and no certificate. Google says Gmail does not support a standalone SVG. Fix: get a VMC or CMC and add the a= tag pointing to the PEM file.

You use another mail system for DKIM and the logo is missing

Google's troubleshooting page says that if you set up DKIM with a non-Google system, you should not use the DKIM length tag (l=) in your DKIM signature, because messages using it are vulnerable to abuse. Fix: ask your mail provider to sign without the length tag. This l= is a DKIM signature tag, a different thing from the l= logo tag in your BIMI record.

Your SVG is hosted on a different domain

Google's troubleshooting page says the web server for the SVG should be in the same domain as the one where you added the BIMI TXT record. Fix: move the file to a host under your own domain, such as images.example.com, and update the l= URL.

Pro tips and when to ask for help

• Keep the logo simple. Logos are shown at small sizes, so a bold mark on a solid square background is easier to recognise than fine text.
• Watch your DMARC reports after enforcement. A new tool added by a colleague can start failing quietly, and with reject that mail is refused.
• Mail from your own server? Get the basics right first, including a matching PTR record; see our reverse DNS guide for Gmail.
• Ask your host if you cannot see a DNS zone editor, cannot upload files over HTTPS, or are not sure which company controls your nameservers.
• Ask a developer or legal adviser about trademark questions before paying for a VMC. Google recommends involving legal counsel for the trademark step.

The one message worth forwarding

Copy this to whoever manages your DNS or email:

"Hi, I would like our logo to show in Gmail using BIMI. Could you please: 1) confirm our DMARC record at _dmarc.example.com uses p=quarantine or p=reject, with sp (if set) also at quarantine or reject, and pct either removed or set to 100; 2) host our PEM certificate file over HTTPS at https://images.example.com/brand/certificate.pem; 3) add a TXT record at default._bimi.example.com with the value v=BIMI1;l=;a=https://images.example.com/brand/certificate.pem and a TTL of 3600. Google's requirements are here: https://knowledge.workspace.google.com/admin/security/set-up-bimi. Thanks!"

The takeaway: get DMARC to full enforcement first, then let a certificate carry your logo, because in Gmail the PEM file is the only road in.