BIMI (Brand Indicators for Message Identification): VMC Certificates & SVG Logo Specs

In an era plagued by brand impersonation, business email compromise (BEC), and sophisticated phishing campaigns, visual authentication in the recipient inbox has evolved from an aesthetic luxury into a mission-critical cybersecurity standard. Brand Indicators for Message Identification (BIMI) is an emerging email specification that enables authenticated organizations to display their official trademarked logo directly inside supporting email clients (including Google Workspace, Yahoo Mail, Apple Mail on iOS 16+, and Fastmail). Achieving BIMI certification requires far more than uploading an image: it demands enforcing strict DMARC rejection policies, securing a cryptographically signed Verified Mark Certificate (VMC) from an accredited Certificate Authority, and engineering vector assets to meet rigid SVG Tiny Portable/Secure (SVG Tiny P/S) formatting requirements.

1. What is BIMI: Visual Inbox Authentication & Phishing Immunity

Historically, email clients displayed generic initials or arbitrary favicon scrapers next to sender names. Phishers routinely exploited this ambiguity by spoofing corporate display names to trick users into wiring funds or divulging credentials.

BIMI binds verified domain authentication directly to visual brand display. When a supporting mailbox receives a message, it verifies that the domain passed SPF and DKIM authentication with strict DMARC alignment. The receiving mail server then inspects the domain's DNS for a BIMI assertion record pointing to a Verified Mark Certificate. If all cryptographic validations succeed, the client renders the authenticated logo alongside a verified checkmark badge, providing immediate cognitive assurance to the end user.

2. Foundational Prerequisites: Strict DMARC Enforcement

Before authoring a single line of BIMI DNS configuration, organizations must achieve full DMARC compliance. The sending organizational domain and all operational subdomains must publish a DMARC record that satisfies the following non-negotiable criteria:

• The policy tag must be explicitly set to p=reject or p=quarantine. A monitoring policy of p=none will cause immediate BIMI assertion failure.
• If p=quarantine is used, the percentage tag must be pct=100 (partial quarantine rollouts are rejected).
• The subdomain policy tag (sp) cannot be set to none; it must inherit or enforce quarantine or reject.
• Both SPF and DKIM must achieve strict or relaxed alignment with the From: header domain.

3. Verified Mark Certificates (VMC) & CommonMark Certificates (CMC)

While basic BIMI specifications allow self-hosted SVGs for certain providers, major ecosystem gatekeepers (most notably Google Gmail and Apple Mail) mandate a Verified Mark Certificate (VMC) or a CommonMark Certificate (CMC) issued by an authorized CA (such as DigiCert or Entrust):

To issue a VMC, the Certificate Authority executes rigorous legal identity verification. The brand logo must be an active, registered trademark with an official recognized intellectual property office (e.g., USPTO, EUIPO, CIPO, UKIPO, JPO). The CA validates trademark ownership, confirms organizational identity through notarized documentation, and embeds the cryptographically sealed SVG vector directly inside a Privacy Enhanced Mail (PEM) certificate bundle. In 2024, the AuthIndicators Working Group expanded certificate tiers to include CommonMark Certificates (CMC), permitting organizations with established non-registered trade dress and verified prior commercial use to participate under calibrated reputation scoring.

4. Technical SVG Tiny P/S Specification & Vector Profiles

Standard web SVG images will fail BIMI validation. BIMI mandates compliance with the SVG Tiny Portable/Secure (SVG Tiny P/S) profile—an ultra-secure subset of SVG Tiny 1.2 designed to eliminate security vulnerabilities (such as cross-site scripting, external entity injections, or interactive scripts):

<?xml version="1.0" encoding="utf-8"?>
<!-- Verified BIMI SVG Tiny P/S Specification Profile -->
<svg xmlns="http://www.w3.org/2000/svg" 
     version="1.2" 
     baseProfile="tiny-ps" 
     width="100%" 
     height="100%" 
     viewBox="0 0 512 512">
  <title>EmailCampaigner Official Brand Mark</title>
  <desc>Cryptographically verified square vector mark</desc>
  <defs>
    <linearGradient id="cyberIndigo" x1="0%" y1="0%" x2="100%" y2="100%">
      <stop offset="0%" stop-color="#6366f1"/>
      <stop offset="100%" stop-color="#06b6d4"/>
    </linearGradient>
  </defs>
  <rect width="512" height="512" rx="128" fill="#0a0f1d"/>
  <path d="M128 160h256v192H128z" fill="url(#cyberIndigo)"/>
</svg>

Rigid formatting constraints govern BIMI SVG files: the graphic must possess a 1:1 square aspect ratio; the file size must not exceed 32 kilobytes; it must not contain <script> tags, external links, animations, or raster bitmapped embeds; and the baseProfile="tiny-ps" attribute is strictly required. Designers must convert all typography to static vector paths and strip extraneous metadata nodes injected by design tools like Adobe Illustrator or Figma before submitting assets for cryptographic hashing.

5. Comparative Matrix: BIMI Deployment Tiers & Inbox Support

6. DNS Record Architecture & Public Key Cryptography Verification

Once the VMC is issued and the SVG Tiny P/S asset is uploaded to a high-availability HTTPS server, organizations publish a dedicated DNS TXT record at the subdomain default._bimi.domain.com:

# Production BIMI DNS TXT Record
default._bimi.emailcampaigner.info. IN TXT (
  "v=BIMI1; "
  "l=https://cdn.emailcampaigner.info/branding/bimi-logo.svg; "
  "a=https://cdn.emailcampaigner.info/certificates/emailcampaigner-vmc.pem;"
)

The v=BIMI1 declaration identifies the protocol version; the l= tag specifies the direct HTTPS URI of the SVG Tiny P/S graphic; and the a= tag provides the HTTPS URI of the PEM-encoded VMC certificate chain containing the cryptographic trust signature.

7. BIMI Telemetry, Caching Headers & Production Troubleshooting

Deploying BIMI requires careful monitoring of HTTP cache headers and DNS propagation. Mailbox providers cache BIMI records aggressively to prevent latency during incoming message evaluation. Web servers hosting the SVG and PEM files must return proper HTTP headers (Content-Type: image/svg+xml, CORS Access-Control-Allow-Origin: *, and Cache-Control: public, max-age=86400).

Deliverability engineers audit BIMI health using automated command-line scripts: running dig TXT default._bimi.domain.com +short and parsing the certificate chain with OpenSSL to ensure certificate expiration warnings are dispatched 60 days prior to renewal deadlines, safeguarding continuous brand visibility across global subscriber inboxes.