BIMI best practices for SaaS companies

Transactional and lifecycle mail share a brand, so one bad campaign can degrade password-reset delivery.

What BIMI is#

BIMI (Brand Indicators for Message Identification) is a DNS record that points to a brand's logo so mailbox providers can display it next to authenticated messages. It depends on DMARC enforcement and, at Gmail and Apple, on a Verified Mark Certificate.

Why it matters#

A verified logo increases open rates and trust, and the DMARC prerequisite forces a domain to finish its authentication work. It is also a visible signal that a message is not a phish.

Implementation plan for SaaS companies#

1. Reach DMARC p=quarantine (pct=100) or p=reject on the sending domain.
2. Produce your logo as an SVG Tiny 1.2 Portable/Secure file, square, centered, with a solid background.
3. Obtain a VMC or CMC from an approved certificate authority if you want display in Gmail and Apple Mail.
4. Publish default._bimi.yourdomain.com with l= (logo URL) and a= (certificate URL).
5. Validate with a BIMI inspector and send a test to Gmail, Yahoo, and Apple seed accounts.

default._bimi.example.com.  IN TXT  "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

Priorities specific to SaaS companies#

Transactional and lifecycle mail share a brand, so one bad campaign can degrade password-reset delivery. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how SaaS companies generate value from email.

Common mistakes#

• Publishing BIMI while DMARC is still at p=none; providers ignore the record.
• Uploading a standard SVG exported from a design tool; it must be the Tiny PS profile with no scripts or external references.
• Hosting the logo on a non-HTTPS URL or behind a redirect.

Frequently asked questions#