All help articles

Sender logos (BIMI)

Some companies publish their logo for email through BIMI (Brand Indicators for Message Identification). Webmail shows that logo next to the sender in the message list and on the open message, so you can tell real mail from those companies at a glance.

When a logo is shown

Only for mail that arrived from another server and:

  1. passed DMARC, so the sender's domain really sent it;
  2. comes from a domain whose DMARC policy is quarantine or reject for all of its mail (pct=100), so spoofed copies of its mail are refused or sent to Junk rather than delivered;
  3. has a single From address; and
  4. comes from a domain that publishes a BIMI record (default._bimi.example.com) with an https:// logo.

Domains hosted here that have their own logo (see Showing your own logo) show it sooner: on mail between users here, on the server's own notices from the domain, and on mail from outside that passes DMARC, even before the BIMI record is published or the DMARC policy enforced. The sender must have proved the address (signed in to send it, or DMARC passed).

Every other sender gets a round picture with their initials, on a colour of their own, in the message list and above the message.

Mail you write, import, or copy in with a mail app never gets a logo. Any BIMI-Location or BIMI-Indicator header a sender adds is removed on arrival, and the result is recorded in the message's Authentication-Results header as bimi=pass.

How the logo is fetched

Your browser never contacts the sender. The server fetches the logo the first time it is needed, over HTTPS only, and keeps it for a day:

If a logo cannot be fetched or does not pass these checks, the message is shown without one, and the server tries again an hour later.

Your domain can have its logo shown next to its mail by providers that support BIMI (Yahoo, AOL, Fastmail; Gmail and Apple Mail only with a mark certificate).

  1. Make the logo. It must be SVG Tiny Portable/Secure: a square viewBox, version="1.2" and baseProfile="tiny-ps" on the svg element, a <title> with the brand's name, no scripts, links, images, animation, styles or outside references, and at most 32 KB. Most design tools export plain SVG; the BIMI group's converters and validators turn it into Tiny PS.
  2. Upload it. In the domain admin panel (or the admin panel, for the operator), open the domain and use Brand logo (BIMI). Any problem with the file is listed. Add a mark certificate (VMC or CMC, as a PEM file with its chain) if you have one.
  3. Publish the record. The default._bimi TXT record appears with the domain's other DNS records (and in the zone file). The logo and certificate are served by Mailocity at /bimi/<domain>.svg and .pem, so the record points there.
  4. Check. Check DNS compares what is published with what it should be.

Receivers show the logo only for mail that passes DMARC under a quarantine or reject policy that applies to all of it; the card warns you when the domain's DMARC settings do not. Command line: corpsuite domain bimi set TEAM DOMAIN svg=@logo.svg [certificate=@vmc.pem], domain bimi check, domain bimi remove, and shared-domain bimi ... for shared domains.

Not checked yet

Large mail services also require a Verified Mark Certificate (VMC), which proves the company owns the trademark in its logo. Zappocity does not check these certificates yet, so a logo can show for any domain that meets the rules above. It is still bound to that domain: nobody can show another domain's logo on their own mail.

Publishing BIMI records for your own hosted domains, so that other mail services show your logo, is planned.

For developers

JMAP Email/get returns bimiDomain (a Zappocity extension) when you ask for it in properties: the domain whose logo GET /api/mail/bimi/{domain} serves to a signed-in webmail session, or null.