BIMI stands for Brand Indicators for Message Identification. The idea is simple: whoever protects their domain properly against spoofing may show their logo next to every genuine email. Recipients recognise real mail at a glance, and a forgery stands out more easily because the logo is missing.

The precondition is an enforced DMARC policy

BIMI only works when DMARC for the domain demands something. With p=none, no mailbox shows a logo.

The policy is p=quarantine or p=reject.
It applies to all mail, so pct=100 or no pct at all.
Subdomains are not exempted with sp=none.

That makes BIMI the visible reward at the end of the road to p=reject.

The logo

The logo is expected as an SVG in a dedicated profile, SVG Tiny Portable/Secure. The key rules:

square, ideally with some margin, because many mailboxes crop the logo into a circle,
version="1.2" and baseProfile="tiny-ps" on the svg element,
a title element with the brand name,
no scripts, no embedded raster images, no references to other files,
at most 32 KB.

Most design tools do not export directly into this profile. A short rework by your agency or in-house design is usually enough.

Mark certificate: VMC or CMC

Large mailbox providers only show the logo when a mark certificate proves that it belongs to you. You apply for it yourself at a certificate authority such as DigiCert or GlobalSign. The certificate authority charges an annual fee, and the certificate is renewed every year.

VMC, Verified Mark Certificate: requires a registered trademark. Gmail then also shows a check mark, and Apple Mail requires a VMC.
CMC, Common Mark Certificate: works without a registered trademark if the logo has demonstrably been in public use for some time. Gmail then shows the logo without the check mark.

Without a certificate, only some mailboxes show the logo, such as Yahoo.

The DNS record

The logo is published through a TXT record at default._bimi of your domain. It names the address of the logo and, if available, that of the certificate:

default._bimi.your-company.com  TXT  "v=BIMI1; l=https://…/logo.svg; a=https://…/cert.pem"

Both files must remain reachable at an HTTPS address.

How it works with Conbool DMARC Manager

DMARC Manager takes your domain to p=reject in stages and then also handles BIMI:

In the domain's DNS area you upload the logo, optionally with a certificate.
Conbool checks both right away and names every issue, such as a non-square format or a certificate for another domain.
Conbool hosts your logo and your certificate and shows the finished DNS record to copy.
The card shows whether the record is in place and whether DMARC is strict enough for the logo to appear.
Conbool warns in good time before the certificate expires.

To change the logo or renew the certificate, simply upload it again. The DNS record stays the same. Checking, hosting and expiry alerts are included in the per-domain price; you obtain the mark certificate from the certificate authority.

Conclusion

BIMI makes visible what DMARC does in the background. Most of the effort lies in reaching p=quarantine or p=reject and in the mark certificate. Once both are done, your logo appears next to every genuine email from your domain.