Ensure your domain has a DMARC policy of at least p=quarantine or p=reject and has maintained that enforcement level continuously for 30 or more days, as most mailbox providers enforce this prerequisite before displaying your logo.
Prepare your brand logo as an SVG Tiny PS file: the file must use the SVG Tiny 1.2 Portable/Secure profile, be square (1:1 aspect ratio), under 32 KB, and pass validation tools provided by the BIMI Group.
Host the validated SVG at a stable HTTPS URL (for example https://yourdomain.com/bimi/logo.svg); the file must be publicly accessible with no authentication gate.
Obtain a Verified Mark Certificate (VMC) from a CA such as DigiCert or Entrust if you need Gmail or Apple Mail support, or a Common Mark Certificate (CMC) if your logo is not trademark-registered and you only need providers that accept CMCs (Gmail accepts CMCs as of September 2024; Apple Mail still requires VMC). Host the issued PEM file at a stable HTTPS URL.
Publish a BIMI TXT record at default._bimi.yourdomain.com with the format: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/cert.pem
Validate the full setup with the BIMI Group's Inspector tool; allow up to 72 hours for mailbox providers to fetch and cache the new record before logo display appears.
Known gotchas
VMC validation typically takes two to four weeks; the issuing CA must verify your trademark registration with an approved Intellectual Property office, your organisation identity, and the SVG logo's correspondence with the trademark—budget accordingly.
The PEM certificate file must be hosted by you; no CA hosts it on your behalf after issuance. If the HTTPS URL becomes unreachable, mailbox providers stop displaying your logo.
Not all mailbox providers support BIMI; as of 2026 Gmail, Yahoo, Apple Mail (iCloud), and Fastmail have announced or active support, but many smaller providers do not—validate display in each target environment separately.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp