Apple Mail can show BIMI logos, but Apple's docs put the hard work on the receiving mail provider, not on a client-side DNS lookup alone. Official 

 both say the sender and the email service provider must meet BIMI and Apple Mail requirements before a mark appears.

Apple Support states that on iOS 16, iPadOS 16, macOS Ventura 13 or later, and on iCloud.com, Apple Mail supports BIMI. Senders need strong email authentication (including DMARC) and must demonstrate control over brand logos. BIMI works with VMCs and other BIMI Evidence Documents. If the sender or the email service provider has not met the requirements, logos will not show.

 is more operational. BIMI compliance is managed by the mail provider on the server. A logo appears in Apple Mail for a message when that provider has: been added to the bimigroup.org list of BIMI-supporting providers and verified by Apple; ensured message and domain compliance with the BIMI draft; verified a BIMI Evidence Document (for example a VMC the provider trusts); and added the required headers that vouch for those checks.

Publishing a perfect BIMI record does not finish the job for Apple Mail. If the recipient's mailbox provider never runs the BIMI checks or never writes the vouching headers Apple expects, Mail will not show the mark. That is a provider capability problem, not something you fix by re-uploading an SVG. Apple also points implementers at DMARC (RFC 7489) and VMC-related references on the Developer page.

Treat Apple Mail as Evidence Document territory: plan for a VMC (or another evidence form your target providers trust), not self-asserted-only. Confirm which receiving providers on your customer list are on the BIMI Group list and known to vouch into Apple Mail. Keep SPF, DKIM, and DMARC enforcement healthy. Re-read Apple's pages before promising iPhone logo display to stakeholders.

Apple's wording does not guarantee every VMC will render in every Apple Mail session. Provider verification and headers are mandatory gates. Authentication and certificates reduce spoofing risk; they do not promise inbox placement or universal logo display.

Apple Developer: Prepare your email server for BIMI support in Apple Mail

 - provider list + Evidence Document + vouching headers

Apple Support: About BIMI support in Apple Mail

 - client platforms; DMARC + VMC / Evidence Documents

 - provider list referenced by Apple Developer

Apple Mail BIMI needs a trusted Evidence Document and a vouching provider

Buying a mark certificate is not a single-vendor guess. The 

BIMI Group Mark Certificate Issuer Information page

 lists Mark Verifying Authorities (MVAs) with CPS, Certificate Transparency, CRL, root, and audit links. On 

, the current Minimum Security Requirements for Issuance of Mark Certificates is version 1.8, dated June 11, 2026. Here is how operators should read both.

, the AuthIndicators Working Group currently lists DigiCert, GlobalSign, and SSL.com. Each row points to that MVA's Certification Practice Statement, CT log URL(s), CRL(s), root certificate material, and audit report when available. Sectigo does not appear on that directory table at verification time.

The same page is careful about what listing means. The Working Group does not certify an MVA for BIMI. Each BIMI-supporting mailbox provider can apply its own acceptance criteria, may require separate vetting, and may accept one MVA without accepting another. Inclusion on the list does not guarantee any mailbox provider will honor your certificate. That disclaimer is part of the 

current Mark Certificate Requirements PDF

 identifies itself as Version 1.8, adopted and effective June 11, 2026 (revision table in section 1.2.1). 

 labels that file as Current and keeps v1.7 (Jan 27, 2025) and earlier versions for history.

 frames Mark Certificates as a binding among identity, mark, and domain for Consuming Entities. It enumerates Common Mark Certificates (prior use, modified registered, provisional) and Verified Mark Certificates (registered mark, government mark). That taxonomy lines up with the 

Confirm your target mailbox providers accept certificates from the MVA you plan to use. Start from the 

, then check each provider's own docs. Do not assume one acceptance list covers all.

 sections that apply to your mark type (3.2.16 for CMC paths, 3.2.17 for VMC paths in the requirements outline). Know what evidence you must supply before you start a sales conversation.

Finish DMARC enforcement and SVG Tiny PS prep first, following the 

. Certificate issuance will not repair failing authentication.

After issuance, keep CRL and CT expectations in your runbook. The 

 exists so relying parties can find those artifacts without hunting vendor marketing pages.

An MVA row on bimigroup.org is not a mailbox-provider allowlist. Version 1.8 updates the requirements CAs follow when issuing Mark Certificates; it does not by itself change Gmail, Yahoo, or Apple display policy. Re-check the issuer directory and your target providers whenever you renew or switch CAs.

BIMI Group: Mark Certificate Issuer Information

 - DigiCert, GlobalSign, SSL.com; acceptance disclaimer

 - MC Requirements current = Jun 11, 2026

Minimum Security Requirements for Issuance of Mark Certificates (v1.8)

BIMI Group: Understanding BIMI Certificate Types

BIMI Mark Certificate issuers and MC Requirements 1.8: what to verify

Most BIMI failures are ugly SVG problems, not exotic DNS. The 

BIMI Group guide to creating BIMI SVG logo files

 defines the SVG Portable/Secure (SVG P/S) profile used for brand marks. It is stricter than stock SVG Tiny 1.2. Export from Illustrator alone usually is not enough.

The guide requires baseProfile="tiny-ps" and version="1.2" on the root svg element. Include a title element with the company name. A desc element is optional but useful for accessibility. Ban external links or references (other than the allowed XML namespaces), scripts, animation, interactive bits, and root-level x= or y= attributes. Adobe's SVG Tiny 1.2 export often leaves those x/y attributes in. Strip them.

Use a square aspect ratio. Center the mark; receivers may crop to a circle or rounded square. Keep the file small and under 32 kilobytes. Prefer a solid background; transparent backgrounds can render oddly. Host the file over HTTPS and point the BIMI l= tag at that URL. The 

 puts SVG Tiny PS production as Step 2 after DMARC enforcement.

BIMI Group SVG Tiny-PS troubleshooting article

 covers common validator failures, including fetch errors when the response body exceeds allowed limits. The Tiny-PS size target called out there is 32KB (32,768 bytes). Simplify paths, limit fancy gradients, drop filters, embedded rasters, and animation. Optimize with tools such as SVGO, then re-validate. If the SVG embeds a PNG or JPEG, vectorize it first.

Start from a square master. Export Tiny 1.2, then hand-edit to tiny-ps. Remove x/y on the root. Add title. Weigh the file under 32KB (and under any stricter receiver limit you care about). Validate against BIMI Group guidance before you buy certificate time. Re-check after every brand redesign.

A valid SVG does not display everywhere. Receivers still apply DMARC, reputation, and sometimes mark-certificate rules. File compliance is necessary plumbing, not a logo-display promise.

 - tiny-ps attributes, banned features, square/size guidance

BIMI Group: SVG Issues / Tiny-PS compliance

 - size errors, unsupported elements, optimization tips

BIMI SVG Tiny PS: the logo file rules that block most setups

If you are hardening DMARC toward BIMI, there is a quiet mismatch worth knowing about. In May 2026, 

 put DMARC on the Standards Track and removed the pct tag. BIMI guidance and Google's BIMI setup docs still talk about full enforcement in pct terms. Here is what changed, what still applies, and what to put in DNS without guessing.

), pct asked receivers to apply quarantine or reject to only a percentage of failing mail. In practice, partial values were applied inconsistently across operators. 

 (May 2026) marks pct historic and drops it from the live tag set. The standards-track record is the one to follow for new DMARC policy language.

BIMI still sits on top of strong DMARC. The active 

BIMI Internet-Draft (draft-brand-indicators-for-message-identification-14)

 says the policy must be quarantine with an effective percentage of 100%, or reject (any percentage). It also says BIMI processing must not run when the relevant policy is p=none, or when a subdomain policy is sp=none.

Google's operator docs match that enforcement bar in pct language. 

 requires p set to quarantine or reject, and says the percent option (pct) must be set to 100. 

 likewise frames participation around DMARC at quarantine or reject with full enforcement.

For a record that fits both RFC 9989 and the BIMI/Google reading of full coverage, prefer omitting pct. Without the tag, legacy readers that still default missing pct to 100 behave like pct=100. RFC 9989-compliant readers simply have no historic tag to parse. Keeping an explicit pct=100 is usually redundant, not wrong, if you need the tag for human readability during a rollout. Do not publish a partial pct if you care about BIMI eligibility under current Google and BIMI-draft language.

Keep p=quarantine or p=reject on the organizational domain and on From domains you use for brand mail. Watch the subdomain trap: leaving sp=none while the apex is hardened is a common way to protect messy subdomains, and the 

 says that subdomain policy of none blocks BIMI processing for those messages. Inventory subdomain senders before you tighten sp.

Example shape (customize reporting addresses and alignment tags for your domain):

v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourdomain.com

Meeting DMARC enforcement is a prerequisite for BIMI consideration, not a promise that a logo will appear. Display still depends on each mailbox provider's rules, certificate requirements where they apply (VMC or CMC), SVG profile, sending reputation, and other local checks. Strong DMARC also does not by itself guarantee inbox placement or deliverability. Treat operator docs as the live machine policy when they diverge from drafts.

 - quarantine with effective 100% or reject; sp=none blocks BIMI

DMARC removed the pct tag. BIMI docs still ask for it

If your BIMI stack is clean and Gmail shows a brand mark, Outlook users will still ask why nothing appears for them. That is expected on Microsoft-hosted mail today. Official 

Microsoft Learn BIMI support for Dynamics 365 Customer Insights - Journeys

Microsoft Q&A on Exchange Online BIMI verification

 draw a hard line: sender-side help on Dynamics, no receiver rendering in Exchange Online or Outlook.

Dynamics 365 Customer Insights - Journeys BIMI article

 opens with an Important callout: the guidance applies only to mail sent from that product. Emails from other Microsoft products, including Exchange Online, do not yet support BIMI. The same page walks through SPF, DKIM, DMARC, an SVG under HTTPS, and a BIMI TXT record so Dynamics-sent mail can present a mark in mailbox providers that already support BIMI (it names Google, Fastmail, Yahoo, and similar).

Microsoft Q&A (Does Exchange Online support BIMI verification?)

, a Microsoft answer states the split plainly: Microsoft supports BIMI as a sender through Dynamics 365 Customer Insights - Journeys when SPF, DKIM, DMARC, a BIMI record, and a Verified Mark Certificate are in place for display in supported inboxes. As a receiver, Microsoft does not currently support BIMI rendering in Exchange Online or Outlook, so marks from BIMI-compliant senders will not appear in Microsoft-hosted inboxes.

Roadmap signal: no short-term receiver date

 says Microsoft has not announced an implementation date for full BIMI support and points operators to official announcements plus the Feedback portal. A separate 

 records an MVP answer that there are no short-term plans or Roadmap items for receiver support, again directing customers to the Feedback portal. Treat that as status, not a commitment.

Plan BIMI for the mailbox providers that publish receiver support. Keep Microsoft 365 / Outlook.com / Exchange Online out of your "will recipients see the mark" expectation set until Microsoft changes the Learn and Q&A position.

If you send marketing through Dynamics 365 Customer Insights - Journeys, follow the 

 so those campaigns can qualify where receivers support BIMI. That path does not unlock Outlook rendering for inbound mail to Microsoft mailboxes.

Separate Microsoft's own brand-indicator or logo systems from BIMI DNS + mark-certificate machinery. Passing BIMI checks elsewhere does not imply Outlook will consume your BIMI record.

If receiver support matters to your org, file and vote via the Feedback portal referenced on 

, and re-check Learn before you change customer-facing promises.

Skipping BIMI because Outlook does not render it is a product choice, not a standards requirement. Authentication (SPF, DKIM, DMARC) still matters for Microsoft and everyone else. BIMI readiness for Gmail, Yahoo, and other supporting receivers remains independent of Outlook UI. No certificate or DNS change will force a mark into Exchange Online until Microsoft ships receiver support.

Microsoft Learn: BIMI support (Dynamics 365 Customer Insights - Journeys)

 - sender-only; Exchange Online called out as not yet supporting BIMI

Microsoft Q&A: Does Exchange Online support BIMI verification?

 - sender vs receiver split; no full-support date announced

Microsoft Q&A: When will Exchange Online support BIMI verification as a receiver?

Exchange Online still does not render BIMI. Dynamics only helps as a sender

Google introduced BIMI in Gmail in 2021 to enhance email security. BIMI requires strong authentication and brand logo verification, allowing logos to be displayed as avatars in emails. A checkmark icon is now added for senders who have adopted BIMI, aiding users in distinguishing legitimate emails from impersonators.

Expanding upon Gmail security with BIMI - Google Workspace Updates

Fastmail is one of the smaller providers with clear, public BIMI docs. Official 

 says Fastmail supports BIMI for both received and sent mail, and it is unusually blunt about what is optional versus required.

On receive, Fastmail fetches the logo for authenticated domains that published BIMI and shows it beside the sender address when DMARC passes under a strong or enforcing policy. Logos must comply with SVG Tiny Portable Secure. Fastmail pulls logo files when mail hits its MX, then serves them from message headers. Viewing the message later does not re-hit external servers, so BIMI is not an open-tracking channel in that design.

For sending, Fastmail's steps are concrete: confirm SPF and DKIM via Settings → Domains → Recheck DNS; publish DMARC at p=reject or p=quarantine; create an SVG Portable/Secure logo under 16 KB; optionally obtain a VMC if you have a registered trademark; publish default._bimi with v=BIMI1, l= SVG URL, and a= PEM URL when you have evidence. Subdomain note: if sp= is set, it must not be sp=none, and the organizational domain still needs quarantine or reject.

Fastmail also states that some receivers (it names Gmail) will not show the logo without a VMC, and that having a VMC is not a guarantee the logo will display. That matches how you should brief stakeholders: certificate helps at certificate-gated receivers; it does not force UI rendering.

When users block remote images, Fastmail can still show a BIMI mark that was fetched at delivery time, because it is not treated as an on-open external resource. Useful for privacy-minded readers. Still not a deliverability claim.

If Fastmail is on your receiver matrix, keep SVG under Fastmail's 16 KB cap (stricter than the BIMI Group's 32 KB ceiling). Enforce DMARC before you publish BIMI. Treat VMC as optional for Fastmail itself, required for some other receivers. Validate the TXT with a BIMI inspector before you call the change done.

Fastmail support does not imply Microsoft Outlook receiver support or Gmail certificate-free display. Follow each provider's own docs. No logo or inbox placement guarantees.

 - receive + send steps; 16 KB SVG; VMC optional with Gmail caveat

 - SVG profile Fastmail points senders to

Fastmail BIMI: official send and receive steps, and a 16 KB SVG cap

Before you chase BIMI logos, check whether your sending domain even meets Gmail's baseline sender rules. Google's 

 (Help answer 81126) are the Tier 1 checklist for mail to personal Gmail accounts. BIMI sits on top of authentication. If you fail the sender guidelines, logo work is premature.

Google draws a volume line. Requirements that started February 1, 2024 apply to senders mailing Gmail accounts. If you send more than 5,000 messages per day to Gmail accounts, you must follow the bulk-sender section. Below that threshold, the baseline is lighter. Cross the line and Google expects SPF and DKIM together plus a published DMARC record, among other technical controls.

On DMARC for bulk senders, the official guidelines state that your DMARC enforcement policy can be set to none. That is the minimum publication bar for this Help article, not a recommendation to stay at p=none forever. BIMI receivers that want quarantine or reject are a separate requirement set. Do not confuse "Gmail bulk sender compliance" with "ready for BIMI logo display."

Google checks authentication on messages to Gmail. Unauthenticated mail can be marked spam or rejected (including 5.7.26 style failures called out in the guidelines). Bulk senders need SPF, DKIM, and DMARC. For direct mail, the domain in the From: header must align with either the SPF domain or the DKIM domain so DMARC can pass. Keep Postmaster Tools in your weekly ops loop so complaint and authentication signals are visible.

Bulk marketing and subscribed mail also need workable unsubscribe mechanics under the guidelines (one-click unsubscribe headers for marketing streams, plus user-visible unsubscribe where required). Spam rates must stay low. These are delivery and compliance controls. They do not grant a brand mark.

Inventory domains that send over 5,000/day to Gmail. Confirm SPF and DKIM on each. Publish DMARC at least at p=none with rua reporting, then stage toward quarantine/reject if you also need BIMI. Align From: with authenticated domains. Fix one-click unsubscribe on marketing streams. Only then queue VMC/CMC and SVG work for receivers that require them.

Meeting answer 81126 does not promise inbox placement. Google can still filter on reputation and content. A p=none DMARC record that satisfies the bulk-sender minimum still fails many BIMI receiver policies. This piece is about Google's published sender requirements, not about logo guarantees.

 - all-sender and 5,000+/day bulk requirements; DMARC may be p=none for this minimum

Gmail Help: Email sender guidelines (Workspace URL alias)

 - same article under Admin Help path commonly cited by operators

Gmail sender guidelines still set the DMARC floor for bulk mail

DMARC enforcement is necessary for BIMI, but it is not the certificate step. 

 tells operators they need third-party certification for the domain and mark: a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC). The 

 explains why those two paths exist and how they differ from self-assertion.

, you need a VMC or CMC from a certificate authority, DMARC set up for the domain, and a public web server that can serve BIMI artifacts. For DMARC, Google requires p set to quarantine or reject, and states the percent option (pct) must be 100 so the policy covers all outbound mail from the domain. The 

 matches that enforcement bar: quarantine or reject on the organizational domain and subdomains, with none policies or pct less than 100 not accepted.

 defines VMC and CMC as Mark Certificate subtypes and requires a strong DMARC policy (quarantine with effective 100 percent, or reject) before BIMI processing. Self-asserted records without evidence remain a separate, narrower path.

VMC vs CMC: mark type and what recipients may see

, VMCs cover registered or government marks. CMCs cover prior-use marks and modified registered marks when you do not have a straight registered-trademark path. Self-asserted BIMI (empty or omitted a= evidence) still needs HTTPS SVG, a BIMI record, and DMARC at enforcement, but only a few providers support that path.

 contrasts the two products it issues: VMC for registered trademark or government mark, CMC for prior-use (at least 12 months on a domain you control) or modified registered trademark. DigiCert also documents a Gmail UI difference it associates with those certs: VMC described with Google's blue checkmark path, CMC described as mark display without that checkmark. Treat that as CA product documentation for Google behavior, and remember the 

 says mailbox providers decide display details; the Working Group does not prescribe a universal checkmark rule. DigiCert's 

 restates DMARC compliance and SVG Tiny PS requirements for issuance.

1. Get SPF and DKIM aligned, then move DMARC to quarantine or reject with full coverage, matching 

 language. Fix failing senders before you buy a mark certificate.

2. Prepare an SVG Tiny PS mark that matches what the CA will validate (trademark artwork for VMC, prior-use or modified registered evidence for CMC).

3. Obtain the VMC or CMC PEM chain from an issuing CA, host it over HTTPS, and publish default._bimi with l= and a= as 

 describes. Allow DNS and provider caches time to settle.

4. Choose VMC when a registered (or government) mark and any provider checkmark behavior matter. Choose CMC when prior-use or modified-registered eligibility is the honest path and avatar-style display without a checkmark is enough for your goals.

A valid VMC or CMC does not force every client to show a mark. The 

 reminds operators that each mailbox provider sets its own criteria. Certificate choice also does not replace DMARC, reputation, or SVG profile checks. Do not treat checkmark UI as a universal BIMI property.

 - VMC or CMC; DMARC quarantine|reject; pct=100

 - DMARC enforcement; VMC/CMC recommended

 - VMC/CMC definitions; DMARC prerequisites

 - CA issuance paths and documented Gmail checkmark distinction

Google BIMI needs a VMC or CMC. Here is how that differs from DMARC alone

Yahoo and AOL still treat BIMI differently from Gmail. Official 

 says a Verified Mark Certificate is not required for logos to appear in Yahoo applications. If a BIMI record includes a VMC, Yahoo may use it when judging eligibility. That is a real operator split: self-asserted SVG plus DMARC can be enough at Yahoo, while other receivers ask for a mark certificate.

, display depends on all of the following: a BIMI record that points to a valid SVG logo; a DMARC policy of quarantine or reject; bulk mail (Yahoo does not display brand logos for personal one-to-one mail); and sufficient reputation and engagement for the sending address. Subdomain BIMI records are honored, but Yahoo prefers BIMI and DMARC at the organizational domain.

. If you just published or changed a record, Yahoo notes propagation delay and recommends checking webmail at mail.yahoo.com with a clean cache before assuming the setup failed.

Yahoo's current product language is explicit: VMCs are not required for logos to appear. That means a correctly formatted SVG on HTTPS and a BIMI TXT record can qualify without buying a mark certificate, as long as DMARC enforcement and Yahoo's bulk/reputation checks also pass. Contrast that with providers that require a VMC or CMC before any mark shows. Plan per receiver, not one global "BIMI done" checkbox.

Keep DMARC at p=quarantine or p=reject on the domains you send from. Publish default._bimi with an HTTPS SVG. Test Yahoo/AOL with bulk streams that already have healthy engagement. Do not treat a missing Yahoo mark as a DNS bug if the stream is low volume, personal, or high-complaint. And do not promise customers that Yahoo display equals Gmail display.

Yahoo not requiring a VMC does not make certificates useless. Other major receivers still may. Reputation and engagement remain Yahoo-owned gates; authentication alone does not force a logo into the UI. No provider document here guarantees inbox placement or consistent logo display.

 - display criteria; VMC not required; optional VMC may inform eligibility

 - troubleshooting when a published BIMI logo does not show

 - initiative overview linked from Yahoo's page

Industry News

Apple Mail BIMI needs a trusted Evidence Document and a vouching provider

BIMI Mark Certificate issuers and MC Requirements 1.8: what to verify

BIMI SVG Tiny PS: the logo file rules that block most setups

DMARC removed the pct tag. BIMI docs still ask for it

Exchange Online still does not render BIMI. Dynamics only helps as a sender

Expanding upon Gmail security with BIMI - Google Workspace Updates

Fastmail BIMI: official send and receive steps, and a 16 KB SVG cap

Gmail sender guidelines still set the DMARC floor for bulk mail

Google BIMI needs a VMC or CMC. Here is how that differs from DMARC alone

Yahoo Mail BIMI still allows self-asserted logos. A VMC is optional there

Industry News

Apple Mail BIMI needs a trusted Evidence Document and a vouching provider

BIMI Mark Certificate issuers and MC Requirements 1.8: what to verify

BIMI SVG Tiny PS: the logo file rules that block most setups

DMARC removed the pct tag. BIMI docs still ask for it

Exchange Online still does not render BIMI. Dynamics only helps as a sender

Expanding upon Gmail security with BIMI - Google Workspace Updates

Fastmail BIMI: official send and receive steps, and a 16 KB SVG cap

Gmail sender guidelines still set the DMARC floor for bulk mail

Google BIMI needs a VMC or CMC. Here is how that differs from DMARC alone

Yahoo Mail BIMI still allows self-asserted logos. A VMC is optional there

Share this Industry News page