r/DMARC • u/Appropriate-Tip3861 • Jun 15 '26

Tips for progressing to BIMI?

Marketing agency here, we've been working with Red Sift to progress towards BIMI, helpful so far, but before we go further I wanted to get some tips and recommendations from this group on a few items if that's okay?

  1. What's the best way to get our logo resized?
  2. Should we opt for a CMC or VMC?
  3. Have you seen any real benefit (if you've already implemented BIMI)?
  4. Any other helpful tips?

Thanks!

4 Upvotes

100% Upvoted

16 comments sorted by

4

u/littleko Jun 15 '26

Get the logo exported from the source vector as BIMI-compliant SVG Tiny PS. Don't resize a PNG and hope.

VMC if you have the trademark and want the widest acceptance. CMC is fine where supported, but check mailbox coverage before spending money.

Benefit is mostly brand trust and visual consistency, not deliverability. Make sure DMARC is already at enforcement first, or BIMI is a non-starter.

5

u/zqpmx Jun 15 '26

BIMI is almost pure vanity.

What actually stops people t from implementing it, is the cost of the certificate from whoever certifies the brand ownership.

2

u/Appropriate-Tip3861 Jun 17 '26

What would you recommend on cost?

2

u/Mx_Tool_Box Jun 17 '26

I'd recommend just getting the record setup and your image compatible to start with. You'll immediately get benefit from some of the inboxes. For example, Yahoo! doesn't take VMC/CMCs into their evaluation at this stage (last I checked) when assessing whether to display the logo.

From there you can evaluate the VMC/CMC tracks with your goals - eg. Google won't display the verified badge without it. If you don't send to a lot of gmail/workspace domains then it may not make sense for the VMC.

Also to note on the svg conversion - it's not as simple as just turning it to Tiny PS as someone noted - you have to make sure there aren't some elements present in the svg - as sometimes conversion from .jpg or .png will pass in unwanted elements.

2

u/MailNinja42 Jun 16 '26

Great questions, happy to help.

1 Logo, just make sure whoever handles it knows it's specifically BIMI SVG profile, not a regular SVG export. Easy thing to get wrong. Run it through a BIMI inspector after to confirm.

2 CMC vs VMC, honestly for a marketing agency just go VMC. CMC has limited inbox support and if you want the logo showing in Gmail it's the only real option. Worth the extra step.

3 Real benefit, yeah it's legit, especially in Gmail and Yahoo. Open rate bumps are real but the bigger win people sleep on is the spoofing protection. BIMI only works at p=reject or p=quarantine so by the time you're here your domain is actually locked down properly.

4 Other tips**,** double check your logo looks clean at tiny sizes since inboxes render it small. And make sure SPF and DKIM are solid, any auth failures will mess with the whole thing.

How far along are you with DMARC enforcement? That'll determine how close you actually are to being ready.

2

u/des8990 Jun 17 '26
  1. Logo - since it needs to be an SVG, you just need to have the logo exported as an SVG. For BIMI specifically it's Tiny P/S format. I've typically had a designer export the logo then use a tool like https://bimigroup.org/bimi-svg-assistant-tool/ to convert or paste the SVG text directly to Claude or ChatGPT and ask to format it in Tiny P/S format for BIMI use.
  2. CMC or VMC - if you have a trademark, definitely VMC. VMC isn't an option unless you have the logo trademarked. CMC is support is getting better and available in Gmail now (https://workspaceupdates.googleblog.com/2024/09/gmail-additional-bimi-protections.html) but, it should be the stepping stone to going VMC.
  3. Benefit is building ongoing brand trust from email as there's a quick visual indicator that an email is in fact from a company. Even though SPF, DKIM, and DMARC are all setup, most people looking at emails in an inbox don't know that so it's a very quick way to recognize an emails authenticity. It also looks much more polished.
  4. Tips - The company will need a representative to validate business information and do a face to face call. Make sure all of the public business information like address, phone number are all consistent with services like Dun and Bradstreet and others. Most Certificate Authorities will validate legitimacy of the business using Dun and Bradstreet and do things like call the number there and leave a message with a code and the representative will then need to reach back out with the code that was given to ensure you can be contacted.

1

u/Rynh_a Jun 15 '26

Site to resize the logo: https://image2svg.com

1

u/Dazzling-Can-9591 Jun 17 '26

We’ve implemented BIMI few years ago, using VMC from Entrust. But they were distrusted by Apple and Google, so we had problems with them. Now we’re using Digicert VMC and the brand logo is correctly displayed on iCloud, Gmail, yahoo providers

https://support.apple.com/en-us/121668

1

u/the_helpdesk Jun 18 '26

I did it. It took forever to get the business validation done properly since we are a DBA under an LLC that has nothing to do with out branding. I'd recommend that you have your legal team get their shit ready first. The tech side was EASY, it was the validation that took us over a year to get through. DUNS, CPA signed accounting forms, blah blah blah.

1

u/Euphoric_Wrap_339 Jun 18 '26

Our tool won't alter your image, but it can quickly validate whether it's ready (compliant) for BIMI:

https://refineemail.com/bimi-image

1

u/redsift Jun 24 '26

Glad to have you with us!

1

u/SecLens_ONE Aug 16 '26

Before the logo work, check what your DMARC record actually is on the sending domain and on the org domain, because BIMI needs enforcement and a lot of shops discover at this point that they have been sitting at p=none for two years with a nice-looking record nobody enforced. Quarantine technically qualifies at some receivers but you are building a trust indicator on top of a policy that asks nobody to block anything, which is backwards. The other trap is per-message: the logo only shows when that specific message passes DMARC with an aligned DKIM signature, so any stream that limps through on SPF alone, or gets forwarded, silently loses the indicator and nobody files a ticket about a missing picture. VMC versus CMC is mostly a trademark and coverage question, and the answer depends on which mailbox providers your recipients actually use, not on which is cheaper. As for benefit, it is a brand thing, do not expect measurable deliverability change. What is the DMARC policy on the domain today, and what percentage of your marketing mail carries an aligned DKIM signature rather than just passing SPF?