BIMI puts your logo next to your name in the inbox. Here's what it really requires, what the certificate costs, and how to publish the record on a VPS running NexPanel.
Open Gmail and look at your inbox. Some senders show a circular logo next to the sender name while everyone else gets a coloured circle with a letter in it. That logo is not something the sender uploaded to Google. It comes from a DNS record on their own domain, and the mechanism behind it is called BIMI.
BIMI stands for Brand Indicators for Message Identification. The working group behind it formed in 2019 and includes Google, Yahoo, LinkedIn and Comcast, and the idea is simple: if a domain can prove its mail is genuinely its own, the mailbox provider will display that domain's logo instead of a generic placeholder. It is one of the few things you can do to your domain that recipients actually see.
Most write-ups on BIMI skip straight to buying a certificate that costs more than a year of hosting. The real picture is more useful than that, so this covers what BIMI requires, what it costs, who should genuinely bother, and how to publish the record.
There are three prerequisites, and the first one is the wall most domains hit.
| Requirement | Detail |
|---|---|
| DMARC at enforcement | Your policy must be p=quarantine or p=reject, with the subdomain policy matching. A policy of p=none does not qualify, and neither does partial percentage enforcement. |
| A logo in SVG Tiny PS | Square, solid background, no scripts or external references, served over HTTPS. |
| A DNS record | A TXT record at default._bimi.yourdomain.com pointing at the logo. |
SPF and DKIM have to be passing and aligned underneath all of that, since DMARC enforcement is meaningless without them. If your domain is not there yet, the SPF, DKIM and DMARC setup guide covers that groundwork, and it is worth doing on its own merits whether or not you ever add BIMI.
This is where most BIMI articles either oversell or mislead, so here is the actual state of it.
The certificate tag in a BIMI record is optional. The BIMI Group's own implementation guide lists getting one as step three and marks it recommended rather than required, and a record published without it is called self-asserted. What the certificate buys you is coverage, because support for self-asserted records is limited. Yahoo Mail and Fastmail will display a logo from a self-asserted record. Gmail and Apple Mail will not, and those are the two inboxes most people are actually trying to reach.
There are two certificate types. A Verified Mark Certificate requires a logo registered as a trademark with a recognised government trademark office, and it is the only route to the blue verified checkmark in Gmail. A Common Mark Certificate drops the trademark requirement in favour of showing the logo has been in continuous use for at least twelve months, and it gets your logo displayed as a Gmail avatar without unlocking the checkmark.
Neither is cheap. DigiCert's list pricing in 2026 runs around $1,416 a year for a VMC and about $1,236 for a CMC, and resellers advertise CMCs from roughly $649. As of May 2026 the certificates come from a short list of issuers: DigiCert, GlobalSign and SSL.com. Entrust left the market in May 2025 after selling its public certificate business to Sectigo.
One more thing worth knowing before you budget for this: Microsoft does not support BIMI. If most of your recipients are on Outlook, Hotmail or Live addresses, a certificate buys you nothing with them.
If you send marketing or transactional mail at volume to a consumer audience on Gmail and Apple Mail, and you already hold a trademark, a VMC is a reasonable brand spend. Recognition in a crowded inbox is the whole point, and you are paying for the only visual signal a mailbox provider will vouch for.
If you run a small business site that sends a few hundred contact form replies and invoices a month, spending $1,236 a year to change an avatar is difficult to justify. The honest recommendation is to do the free parts. Get SPF and DKIM correct, move DMARC to enforcement, and publish a self-asserted BIMI record. Yahoo and Fastmail recipients will see the logo, it costs nothing beyond the time, and the DMARC work is the part that actually protects your domain from being forged. If the business later grows into a certificate, the record is already there and you add one tag to it.
Nothing else matters until this is done. Publish DMARC at p=none first, read the aggregate reports for a few weeks, and confirm that every legitimate sender is passing. Only then tighten the policy:
v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:dmarc@yourdomain.comSet sp= to match p=, because the implementation guide treats a weaker subdomain policy as a failure to qualify. Avoid the pct= tag entirely at this stage, since partial enforcement disqualifies the domain too. Moving to enforcement before the reports are clean will send real mail to spam, which is a considerably worse outcome than not having a logo.
The format is SVG Tiny 1.2 using the Portable/Secure profile, usually written SVG Tiny PS. It is a deliberately restricted subset of SVG, and an ordinary SVG export from Illustrator or Figma will not pass without editing. The constraints:
Design for the size it will actually be seen at. The logo renders in a circle roughly the size of a fingernail, so wordmarks turn to mush. Most brands that do this well use a single glyph or monogram rather than their full horizontal logo.
The record points at a URL, and that URL has to be served over valid HTTPS. Host it on your own domain rather than a file sharing link or a CDN account you might close, because if the URL ever breaks the logo silently stops appearing and nothing tells you.
On a VPS this is a non-issue. Drop the file in your web root and reference it directly:
https://yourdomain.com/bimi/logo.svgNexPanel, which is included free on every Lvato VPS, issues and renews Let's Encrypt certificates automatically for every site it hosts, so the HTTPS requirement is handled the moment the site exists. There is no separate certificate to buy for the logo URL itself.
BIMI uses selectors the same way DKIM does, and the default selector is literally default. So the record goes at default._bimi.yourdomain.com as a TXT record:
v=BIMI1; l=https://yourdomain.com/bimi/logo.svgThat is a self-asserted record. If you have bought a certificate, add the a= tag pointing at the PEM file:
v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pemBoth URLs must be HTTPS, and both must stay reachable, since providers re-fetch them.
NexPanel runs PowerDNS and writes the A, MX, SPF, DKIM and DMARC records automatically the moment you add a site or a mailbox, so the authentication groundwork for BIMI is already in place rather than being something you assemble by hand. Its mail stack is Postfix, Dovecot and Rspamd with DKIM signing configured per domain, which is what makes DMARC enforcement achievable in the first place.
BIMI itself is not auto-provisioned, because the logo and the policy decision are yours. Open the DNS section for your domain, add a TXT record with the name default._bimi, and paste the record value above. Tighten the existing DMARC record to p=quarantine in the same screen once your reports are clean.
If your nameservers point somewhere other than your VPS, Cloudflare being the common case, add the TXT record there instead. DNS is read from wherever the nameservers point, and a BIMI record added in the wrong panel looks perfectly correct while doing nothing.
Confirm the record resolves and the logo is actually reachable:
dig TXT default._bimi.yourdomain.com +short
curl -I https://yourdomain.com/bimi/logo.svgThe curl response should be 200 with an SVG content type. After that, send mail to a Yahoo address and check whether the logo appears, since Yahoo is the provider that will show a self-asserted record.
Do not expect anything to change instantly. Mailbox providers cache aggressively and weigh sender reputation separately, so a technically perfect BIMI setup on a domain with no sending history or a poor reputation may still show nothing. BIMI is permission to display a logo, not a guarantee that one appears.
The sequence that makes sense for most domains is to fix authentication, move DMARC to enforcement, publish a self-asserted record, and only then decide whether Gmail coverage is worth four figures a year. Two of those three steps cost nothing and improve deliverability regardless of whether a logo ever shows up.
The infrastructure side is the part worth getting right once. A Lvato VPS gives you full root access, NVMe storage and a dedicated IP across 32 or more locations, with NexPanel included at no cost: PowerDNS for the records, a full mail stack that signs DKIM per domain, and automatic HTTPS for the logo URL. A dedicated IP matters more than it sounds here, since sender reputation is attached to the address your mail actually leaves from.