BIMI Setup Guide: Get Your Logo Showing in Gmail and Yahoo

You've probably noticed some emails show a little circular logo next to the sender's name in Gmail, and most don't. That's not a Gmail feature you can toggle - it's a DNS record called BIMI, and it only works if your domain's email authentication is already solid. If you've already got SPF, DKIM and DMARC in place, BIMI is a genuinely quick win for brand trust and inbox recognition. Here's how it actually works and how to set it up properly.

What BIMI Actually Is

BIMI stands for Brand Indicators for Message Identification. It's a DNS TXT record that points mailbox providers to an SVG version of your logo, so they can display it as the sender avatar instead of a generic letter circle. Gmail, Yahoo, Apple Mail and Fastmail all support it in some form as of 2026.

It's not a security record like SPF or DKIM - it doesn't stop spoofing on its own. What it does is give mailbox providers a reason to trust that the logo is really yours, and that trust is entirely borrowed from DMARC. If your DMARC isn't enforcing, BIMI won't show up no matter how correct the record is.

The Prerequisite Everyone Skips: DMARC at Enforcement

This is where most BIMI setups fail before they even start. Gmail and Yahoo require your DMARC policy to be at p=quarantine or p=reject - not p=none. A monitoring-only DMARC record tells mailbox providers you haven't actually committed to blocking spoofed mail from your domain, so they won't extend the logo privilege.

Check your current policy with:

dig TXT _dmarc.yourdomain.com +short

You're looking for something like:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@yourdomain.com

If you see p=none, you need to move your DMARC policy up before BIMI will do anything. Don't jump straight to p=reject if you've never enforced before - work through quarantine first, watch your DMARC aggregate reports for a few weeks to confirm nothing legitimate is failing, then move to reject once you're confident.

What You Need Before Touching DNS

Step 1: Build a BIMI-Compliant SVG

A regular SVG export from Illustrator or Figma will almost always get rejected. BIMI requires the SVG Tiny PS profile - a restricted subset of SVG with no scripts, no external references, no raster images embedded, and specific metadata tags. Most teams don't hand-code this; you run your logo through a BIMI SVG converter (several free ones exist) and validate it against the BIMI Group's validator before publishing.

Keep the logo simple - a square or circular mark works better than a wide wordmark, since most clients crop it into a circle anyway.

Step 2: Get a VMC If You Want Gmail Support

This is the part that surprises people. Yahoo and Apple Mail will show your BIMI logo with just a valid DNS record and SVG. Gmail won't - it requires a Verified Mark Certificate, which is effectively a trademark-backed certificate issued by a small number of authorized Certificate Authorities (DigiCert and Entrust currently issue them). You'll need a registered trademark for the logo to qualify, and the certificate itself typically costs several hundred dollars a year.

If Gmail display isn't critical for your use case, you can skip the VMC entirely and still get Yahoo/Apple Mail coverage with just the SVG and DNS record.

Step 3: Add the BIMI DNS Record

In cPanel, go to Domains > Zone Editor, select your domain, and click Manage. Add a new TXT record:

The l= tag points to your logo, and a= points to the VMC if you have one. Both files need to be served over HTTPS with a valid, non-self-signed certificate and no redirects in the request chain - a 301 to a different URL is enough to make some mailbox providers give up on fetching it.

Step 4: Verify the Record

Give it a few minutes to propagate, then check:

dig TXT default._bimi.yourdomain.com +short

You should see your BIMI record echoed back exactly as you set it. From there, run it through a BIMI record checker (several free tools validate the record, fetch the SVG, and confirm it passes the Tiny PS profile) before you wait on real inbox tests.

Why the Logo Still Isn't Showing

Even with a technically correct setup, don't expect the logo to appear the moment you save the DNS record. A few things commonly delay it:

• Mailbox provider caching. Gmail and Yahoo cache BIMI lookups per sending domain - it can take a few days of consistent, authenticated sending before the logo shows up reliably.
• DMARC alignment failures. If SPF or DKIM occasionally fails alignment (common with third-party ESPs sending on your behalf without proper DKIM signing), some messages will authenticate and show the logo while others won't.
• SVG validation edge cases. Converters don't always strip every disallowed element. Re-validate after any logo redesign, not just on first setup.
• Wrong subdomain. If you send from mail.yourdomain.com, the BIMI record needs to live at default._bimi.mail.yourdomain.com, not the root domain, unless your DMARC record explicitly covers subdomains with the same policy.

Prevention

• Don't attempt BIMI before your DMARC has run at enforcement for at least a few weeks with clean reports - it'll just waste time chasing a record that can't work yet.
• Re-validate your SVG every time the logo changes, and keep the file at a stable, non-redirecting HTTPS URL.
• If you send transactional email through a third-party platform (SendGrid, Mailgun, Postmark), confirm they support DKIM signing aligned to your domain - misaligned third-party sending is the most common reason BIMI logos show inconsistently.
• Budget for VMC renewal if you go that route - certificates expire annually and Gmail stops showing the logo the moment it lapses.

If your DMARC reports look clean, your SVG validates, and the logo still isn't appearing after a couple of weeks, open a ticket with Getwebup support with your domain and the exact DNS records you've published - we can check propagation and alignment from our side to rule out a caching issue versus a genuine misconfiguration.