BIMI Will Not Fix a Client's Cold Email Deliverability
Every few months a client asks for the logo. They've seen a competitor's brand mark next to an email in Gmail, sometimes with a checkmark, and they want the same thing on their outbound. The request usually comes framed as a deliverability fix: "If we had the logo, we'd land in the inbox."
That's not how BIMI works. It's a reasonable brand project for a company's main domain. For a cold outbound program, it's the wrong thing to spend the first month on, and an agency should say so plainly.
What BIMI actually is
BIMI stands for Brand Indicators for Message Identification. A domain publishes a DNS record that points to a logo, and mailbox providers that support it may show that logo next to authenticated mail.
The group that maintains the standard is direct about its limits. The BIMI Group's sender FAQ says: "BIMI does not change message delivery; it is a display signal on top of strong authentication." It also says logos "aren't a guarantee of trust; they're a signal layered on top of authentication and good sending practices."
So the logo is something you earn after the deliverability work is done. It isn't the work.
What it takes to get one
The requirements are real, and most of them take time or money.
DMARC at enforcement. Google's BIMI setup page says the domain's DMARC policy must be p=quarantine or p=reject, and "BIMI doesn't support DMARC policies that have the p option set to none." Google also asks for pct=100. The BIMI Group's implementation guide asks for enforcement on the organizational domain and its subdomains.
A certificate for the logo, for Gmail. Google requires a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) from a third-party certificate authority. A VMC needs a registered trademark, and Google warns that "the trademark process can take 6 to 12 months." A CMC doesn't need a trademark, but in Gmail, a CMC shows the logo without the checkmark. Google's own announcement says the checkmark is for VMCs only.
An annual renewal. The BIMI Group FAQ says mark certificates have a maximum validity of 398 days and that you should "expect an annual fee."
A specific logo file. It has to be SVG Tiny PS, served over HTTPS, with Gmail's extra size rules on top.
None of this is hard for a company with a legal team and a registered mark. It is a poor fit for a client who wants outbound live next week.
Why it doesn't fit cold outbound
Here's my actual objection, beyond the time cost.
Display depends on reputation you haven't built yet. The BIMI Group lists "provider reputation thresholds not met" as a common reason a logo doesn't appear. A new or recently warmed sending domain is exactly the domain that hasn't built that reputation. You'd pay for the certificate and still see nothing.
Some providers don't show it on one-to-one mail. The BIMI Group's description of Yahoo's implementation says the logo appears when "the mailing is sent to a large number of recipients (bulk mail), BIMI will not be displayed on personal mail." Good cold outreach is meant to look like personal mail, sent at low daily volume from a real person's mailbox. That's the opposite of the traffic Yahoo describes.
The enforcement step has its own risk. Moving a client's main domain from p=none to p=reject is a good security goal. It can also break mail streams nobody has mapped, like an old invoicing tool or a forgotten form handler, which is why the new DMARC standard (RFC 9989) tells domains to spend "at least a month" at p=none and then a similar period at p=quarantine before reject. That's a project for the client's IT team, done on their schedule. Rushing it so a logo shows up on cold mail puts their regular business email at risk for a cosmetic gain.
A logo doesn't change what makes people report spam. Gmail's sender FAQ tells senders to keep the user-reported spam rate below 0.1% and never let it reach 0.3%. What moves that number is who you email and what you say. A brand mark on a message the prospect didn't want doesn't change their decision to click "Report spam."
What to do with the request instead
When a client asks for BIMI, I'd split it into two conversations.
For the client's main brand domain: BIMI is a fine long-term goal if they send newsletters or product mail at volume. Point them to Google's setup guide and the BIMI Group's implementation steps, and let their marketing or IT team own it. If they already have DMARC at enforcement and a registered trademark, most of the hard part is done.
For the outbound program: put the effort where it changes results.
- Confirm SPF, DKIM, and DMARC pass and align on every sending domain.
- Keep daily volume per mailbox inside the warm-up plan.
- Check list quality before entry, not after the bounces.
- Write from evidence about the prospect, so the email reads as relevant to them.
- Watch the spam rate in Google Postmaster Tools where volume allows, and pause a campaign that drifts up.
If the client's main domain later earns its BIMI logo and the outbound program sends from that domain, fine. The logo can show up on its own once the reputation supports it. Just don't sell it, or buy it, as the reason mail lands.
Where GTM fits
GTM runs outbound for each client in an isolated workspace with its own connected sending domains, send windows, and limits. Writing starts from the prospect's profile and signals, and a compliance gate blocks any send without a verdict and an unsubscribe URL. That's the part of deliverability an agency controls day to day.
If you run outbound for several clients and want those controls in one place, join the waitlist.
Sources
- BIMI Group, "FAQs for Marketers and ESPs": https://bimigroup.org/faqs-for-senders-esps/
- BIMI Group, "Implementation Guide": https://bimigroup.org/implementation-guide/
- Google Workspace Admin Help, "Set up BIMI": https://support.google.com/a/answer/10911320
- Google Workspace Updates, "Gmail allows more senders to protect their brand using BIMI Common Mark Certificates" (September 2024): https://workspaceupdates.googleblog.com/2024/09/gmail-additional-bimi-protections.html
- Gmail Help, "Email sender guidelines FAQ": https://support.google.com/a/answer/14229414
- RFC 9989, "Domain-Based Message Authentication, Reporting, and Conformance (DMARC)": https://www.rfc-editor.org/rfc/rfc9989.txt