How to Configure BIMI and VMC Verification in Google Workspace Gmail for Brand Trust

Email spoofing, executive impersonation, and phishing attacks cause enterprise communication to suffer from low open rates and compromised recipient trust. Standard cryptographic signatures like SPF and DKIM operate silently behind mail headers without offering visual confirmation to end users. Brand Indicators for Message Identification (BIMI) is an email specification that enables authenticated organizations to display verified brand logos and blue verification checkmarks directly alongside outgoing messages in the Gmail inbox interface.

BIMI Architectural Prerequisites in Google Workspace

Gmail enforces strict email authentication and intellectual property validation before rendering your corporate logo in user inboxes:

Authentication Pillar	Configuration Requirement for BIMI	Verification Function
SPF (Sender Policy Framework)	Valid DNS TXT record declaring all authorized sending IPs	Prevents unauthorized IP servers from sending on behalf of your domain
DKIM (DomainKeys Identified Mail)	2048-bit cryptographic key signing all outgoing message payloads	Guarantees that message bodies and headers were not altered in transit
DMARC Alignment & Enforcement	Policy must be explicitly set to p=quarantine (pct=100) or p=reject	Ensures all unauthorized unaligned messages are rejected or quarantined
VMC (Verified Mark Certificate)	Digitally signed PEM certificate from an authorized CA (DigiCert or Entrust)	Cryptographically verifies legal registered trademark ownership of the logo
SVG Tiny-PS Format	Specific vector graphic format stripped of scripts, external links, and text	Ensures consistent, secure rendering across desktop, mobile, and web clients

Achieving Strict DMARC Policy Enforcement

Google Workspace Gmail will completely disregard any BIMI DNS assertion if your root domain’s DMARC policy remains in permissive monitoring mode (p=none):

1. Access your domain registrar or public DNS provider dashboard (Cloudflare, Route 53, Google Cloud DNS).
2. Inspect your existing DMARC TXT record at _dmarc.yourdomain.com.
3. Ensure alignment rules are strict and the policy is fully enforced:

   _dmarc.yourdomain.com. IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[email protected]; aspf=s; adkim=s;"

4. Allow 48 to 72 hours for international DNS propagation and confirm zero legitimate message delivery failures via your DMARC aggregator portal.

Formatting Your Official Logo to SVG Tiny Portable/Secure (Tiny-PS)

Gmail rejects standard SVG files containing raster embeddings, CSS stylesheets, or external XML namespace declarations:

1. Open your vector editing application (Adobe Illustrator or open-source Inkscape).
2. Format the artwork boundaries:
   • Square aspect ratio (1:1), recommended viewBox="0 0 512 512".
   • Center the artwork with adequate margins so circular cropping in mobile apps does not truncate outer edges.
   • Solid or transparent background (solid colored backgrounds offer superior contrast across dark/light mode toggles).
3. Convert all type and text fonts into vector outlines (Create Outlines).
4. Save or export the file ensuring compliance with the SVG Tiny 1.2 specification profile.
5. Manually inspect the raw SVG markup using a code editor to confirm no base64 bitmap images (<image>) or JavaScript <script> tags exist within the definition.

Obtaining and Hosting the Verified Mark Certificate (VMC)

While some mail providers display self-asserted BIMI logos, Gmail strictly mandates a Verified Mark Certificate (VMC) issued by a recognized certificate authority to activate the blue verification checkmark:

1. Ensure your corporate logo is registered as an official trademark with a recognized intellectual property office (USPTO, EUIPO, UKIPO, etc.).
2. Submit your trademark documentation and sanitized SVG file to an authorized Mark Verifying Authority (such as DigiCert or Entrust).
3. Upon validation, the CA issues a Privacy Enhanced Mail (.pem) certificate chain containing the embedded, cryptographically signed SVG vector artwork.
4. Upload both the standalone logo.svg file and the issued cert.pem file to an accessible HTTPS web server:
   • https://yourdomain.com/bimi/logo.svg
   • https://yourdomain.com/bimi/cert.pem
5. Verify that your web server returns HTTP 200 OK with correct Content-Type: text/plain or application/x-pem-file and no redirect chains.

Publishing the BIMI DNS Assertion Record

Publish the authoritative BIMI discovery pointer in your domain’s public DNS zone:

1. Navigate to your DNS management console.
2. Create a new TXT Record with the following parameters:
   • Host / Name: default._bimi.yourdomain.com
   • TTL: 3600 (1 hour)
   • Value / Target:

     v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/cert.pem;

3. Save the record and commit changes to the nameservers.

Validating BIMI Deployment and Inbox Verification in Gmail

Verify your BIMI deployment before rolling out critical marketing or executive email campaigns:

1. Use the official BIMI Group Inspector tool (bimigroup.org) to validate DNS record syntax, certificate trust path, and SVG Tiny-PS compliance.
2. Send an authenticated test email from your Google Workspace domain to an external Gmail personal or enterprise address.
3. Open the message in Gmail desktop web interface:
   • The official corporate logo renders as the sender avatar image next to the sender display name.
   • Hover over the blue checkmark icon adjacent to the sender name; Gmail displays: “The sender of this email has verified that they own [yourdomain.com] and the logo in the profile image.”