How can I display my logo in Gmail and Microsoft, and what are the potential security risks?

12 Marketer opinions 2 Expert opinions 5 Technical articles 1 Resource

Summary

Displaying logos in Gmail and Microsoft involves a multi-faceted approach. BIMI (Brand Indicators for Message Identification) is a key method for Gmail, requiring strong authentication (DMARC, SPF, DKIM) and a Verified Mark Certificate (VMC) to confirm logo ownership and enhance trust. However, the specifics of Gmail's BIMI pilot program are unclear, and logos may appear through other means like annotations or account setups. Microsoft offers customization of the 365 sign-in page, although logo display in Outlook can be achieved by embedding images in signatures. The primary security risk is spoofing; bad actors can leverage similar techniques to impersonate brands, emphasizing the need for domain reputation and user awareness. Achieving consistent logo display across all email clients is challenging due to varying rendering engines and security settings, necessitating thorough testing.

Key findings

BIMI for Gmail: BIMI is a leading method for displaying logos in Gmail, necessitating DMARC, SPF, DKIM, and a Verified Mark Certificate (VMC).
BIMI Pilot Uncertainty: The workings of Gmail's BIMI pilot are not fully clear, and logos can appear through alternative routes.
Microsoft Customization: Microsoft enables logo integration through 365 sign-in page customization, while Outlook supports logo embedding in signatures.
Spoofing Threat: Spoofing is a key risk, as malicious actors can mimic branding, making domain reputation and user vigilance crucial.
VMC Importance: A Verified Mark Certificate (VMC) is crucial for validating logo ownership and enhancing trust through BIMI.
DMARC Requirement: BIMI implementation requires a DMARC policy to secure the domain.
Inconsistent Rendering: Rendering differences across email clients make consistent logo display a challenge.

Key considerations

Authentication Standards: Implement robust authentication standards, including DMARC, SPF, and DKIM.
VMC Validation: Obtain and validate a VMC to strengthen your logo's authentication and legitimacy.
Branding Cohesion: Create a consistent brand experience through Microsoft 365 branding customization.
User Education: Educate users on phishing risks and how to identify legitimate communications.
Testing and Compatibility: Test logo display across various email clients to ensure compatibility and visual appeal.
Domain Reputation Management: Proactively manage your domain's reputation to minimize spoofing risks and maximize deliverability.
Outlook Specific Design: Consider Outlook signature requirements for logo display in the email client.

What email marketers say
12Marketer opinions

Displaying logos in Gmail and Microsoft involves various methods, each with its own challenges and security implications. BIMI (Brand Indicators for Message Identification) is a prominent solution for Gmail, requiring DMARC, SPF, DKIM, and a Verified Mark Certificate (VMC) to ensure brand authenticity and prevent spoofing. However, achieving consistent logo display across all email clients remains difficult due to varying rendering engines and security settings. Alternative methods for both Gmail and Microsoft include using inline images in email signatures and setting up Google Profiles or Microsoft 365 branding. The main security risk stems from potential spoofing, where malicious actors could leverage similar techniques to impersonate legitimate brands. Implementing robust email authentication and obtaining VMCs are crucial steps in mitigating these risks.

Key opinions

BIMI for Gmail: BIMI allows logo display in Gmail, requiring DMARC, SPF, DKIM, and a Verified Mark Certificate (VMC).
Spoofing Risks: Spoofing remains a significant risk, even with BIMI, as malicious actors can register lookalike domains.
VMC Necessity: A Verified Mark Certificate (VMC) from an authorized provider is necessary for BIMI implementation to verify logo ownership.
Microsoft Alternatives: Microsoft allows logo display in email signatures (but relies on settings) and company branding within the 365 environment.
Complexity of Implementation: Implementing BIMI can be technically challenging, requiring expertise in DMARC, DNS records, and certificate management.
Inconsistent Rendering: Consistent logo display across all email clients is difficult due to varying rendering engines and security settings.
BIMI Isn't Everything: Logos can appear without BIMI, and the interaction between the BIMI pilot and other methods remains unclear.
Reputation Matters: Even with advanced methods, a domain's reputation is crucial for logo display.

Key considerations

Email Authentication: Ensure robust email authentication (SPF, DKIM, DMARC) is in place to protect against spoofing.
VMC Acquisition: Obtain a Verified Mark Certificate (VMC) from an authorized provider for BIMI implementation.
Client Compatibility: Test logo display across different email clients and devices to ensure compatibility.
Domain Reputation: Maintain a positive domain reputation to increase the likelihood of logo display.
Security Awareness: Educate recipients about potential spoofing risks and how to identify legitimate emails.
Image Hosting: If using inline images for email signatures, host the logo on a reputable and secure server.
Future-Proofing: Keep up-to-date with evolving email standards (like the move towards mandatory certs for BIMI) to adapt your strategy.

Marketer view

Email marketer from Litmus shares that implementing BIMI can be technically challenging, requiring expertise in DMARC, DNS records, and certificate management. They recommend consulting with email authentication specialists.

April 2021 - Litmus

Marketer view

Email marketer from StackOverflow shares that displaying logos consistently across all email clients is challenging due to varying rendering engines and security settings. They recommend testing emails on different platforms to ensure compatibility.

June 2023 - StackOverflow

Marketer view

Marketer from Email Geeks theorizes that Verizon (Yahoo/AOL) and Gmail will eventually only show logos with BIMI, and those logos will have to have certs.

December 2022 - Email Geeks

Marketer view

Marketer from Email Geeks explains that the only catch in the spoofing theory is that you need to have the appropriate reputation on your lookalike domain to have your logo displayed.

October 2024 - Email Geeks

Marketer view

Email marketer from Reddit explains that while BIMI can enhance trust, it doesn't completely eliminate spoofing risks. Phishers can still register lookalike domains and implement BIMI to trick users if they're not careful.

May 2022 - Reddit

Marketer view

Marketer from Email Geeks shares that you can get your logo to display in Gmail and Microsoft without BIMI at all, and that it's all very confusing, and how Gmail's BIMI pilot works with all the other methods is unknown.

April 2021 - Email Geeks

Marketer view

Marketer from Email Geeks raises a concern about setting up a spoof domain with SPF, DKIM, DMARC, logo in a Google Profile + Annotations, and BIMI to create a convincing user experience in Gmail and Yahoo, noting that you can't fake the logo in Microsoft, as a human has to approve that.

March 2022 - Email Geeks

Marketer view

Email marketer from SparkPost explains that BIMI provides a secure way to display logos, enhancing brand recognition and providing assurance to recipients that the email is authentic and hasn't been spoofed. Implementation involves setting up DMARC and acquiring a VMC.

September 2024 - SparkPost

Marketer view

Email marketer from EmailVendorSelection shares that to display your logo with BIMI, you'll need a Verified Mark Certificate (VMC) from an authorized provider. This certificate verifies your logo and confirms your brand's authenticity.

May 2024 - EmailVendorSelection

Marketer view

Email marketer from Mailjet shares that BIMI allows you to display your brand's logo next to your messages in supporting email clients like Gmail. It requires DMARC, SPF, and DKIM authentication, along with a Verified Mark Certificate (VMC).

January 2025 - Mailjet

Marketer view

Email marketer from OutlookForums shares that displaying logos in Outlook can be achieved by embedding the image directly in the email signature or using a linked image hosted on a secure server. However, image display depends on the recipient's email client settings.

October 2021 - OutlookForums

Marketer view

Email marketer from Gmass explains that using inline images in email signatures can display logos in some email clients, but these images may be blocked by default. They recommend hosting the logo on a reputable server.

May 2024 - Gmass

What the experts say
2Expert opinions

Displaying logos in Gmail often involves BIMI (Brand Indicators for Message Identification), but unless part of the Gmail BIMI pilot program, images are likely displayed through other means. BIMI relies on authentication and requires a Verified Mark Certificate (VMC) to verify logo ownership, reducing the risk of spoofing. Other methods include Gmail annotations, which also require effort and authentication, and 'hacks' like setting up an account with the sending domain, although these aren't trust signals. VMCs help legitimize BIMI. Microsoft Outlook logo display is separate and requires other methods that aren't included in these answers.

Key opinions

BIMI & VMC: BIMI uses a Verified Mark Certificate (VMC) to ensure logo ownership and reduce spoofing risks.
Gmail BIMI Pilot: Without being in the Gmail BIMI pilot program, logo display is likely achieved through other methods.
Alternative Gmail Methods: Gmail annotations and account setup with the sending domain are alternative methods, although not trust signals.
Outlook is different: Logo display is handled through other methods, not BIMI in outlook.

Key considerations

Authentication: Implement authentication methods to increase the chance of logo display and signal trustworthiness.
BIMI Requirements: If pursuing BIMI, obtain a VMC to legitimize your logo.
Spoofing Awareness: Recognize the potential for spoofing, even with BIMI, and take steps to protect your brand.
Outlook solutions: Logo display requires separate approach and may not be the same solution as Gmail.

Expert view

Expert from Word to the Wise explains that BIMI (Brand Indicators for Message Identification) allows for displaying logos in supporting email clients after passing authentication checks. This requires a Verified Mark Certificate (VMC) to ensure logo ownership and legitimacy, reducing spoofing risks. However, the article primarily focuses on BIMI setup and doesn't offer solutions for logo display in Microsoft Outlook. Security risks associated with spoofing and potential misrepresentation using BIMI are mentioned.

May 2022 - Word to the Wise

Expert view

Expert from Email Geeks explains that unless you're in the BIMI pilot with Gmail you're not seeing images as a result of BIMI. Annotations also support logos but that also requires a minimum level of effort, engagement and authentication with Gmail. There are other "hacks" to get your logo to display at Gmail like setting up an accounts/profile with the sending domain, but none are "trust" signals

July 2023 - Email Geeks

What the documentation says
5Technical articles

Displaying logos in Gmail and Microsoft environments involves using BIMI (Brand Indicators for Message Identification) in Gmail, which requires strong authentication (DMARC) and a Verified Mark Certificate (VMC) to verify logo ownership. Microsoft allows customization of the Microsoft 365 sign-in page with logos and color schemes to enhance brand recognition and reduce phishing risks. DMARC is a prerequisite for BIMI, ensuring only authenticated emails are delivered. Obtaining a VMC necessitates validating trademarked logos with a certification authority. While not directly related to logo display, digital certificates from providers like Entrust verify the sender's identity and improve overall email security.

Key findings

BIMI Requirements: BIMI requires strong authentication (DMARC) and logo verification through a Verified Mark Certificate (VMC).
Microsoft Customization: Microsoft 365 allows visual branding of the sign-in page with logos and colors.
DMARC Foundation: BIMI builds upon DMARC, necessitating a 'p=quarantine' or 'p=reject' policy.
VMC Validation: Obtaining a VMC involves validating trademarked logos with a certification authority.
Digital Certificates: Digital certificates enhance email security by verifying sender identity, but are not directly related to logo display.

Key considerations

Strong Authentication: Implement DMARC, SPF, and DKIM to establish strong email authentication.
VMC Acquisition: Validate your trademarked logo and obtain a Verified Mark Certificate (VMC) from a certification authority.
Branding Consistency: Customize the Microsoft 365 sign-in page to maintain consistent branding.
Phishing Prevention: Employ digital certificates to enhance email security and reduce the risk of phishing and spoofing.
Policy Enforcement: Enforce a DMARC policy of 'p=quarantine' or 'p=reject' to prevent unauthenticated emails from reaching recipients.

Technical article

Documentation from DMARC.org explains that BIMI builds upon DMARC, requiring a DMARC policy of 'p=quarantine' or 'p=reject' for your domain. This ensures that only authenticated emails are delivered, reducing the risk of spoofing.

June 2021 - DMARC.org

Technical article

Documentation from DigiCert explains that obtaining a VMC requires validating your trademarked logo with a certification authority. The VMC cryptographically links your logo to your domain, proving ownership and authenticity.

November 2021 - DigiCert

Technical article

Documentation from Google Support explains that BIMI requires strong authentication (DMARC) and verifies logo ownership via a Verified Mark Certificate (VMC) to display a brand's logo, enhancing trust and email security.

July 2023 - Google Support

Technical article

Documentation from Entrust explains that digital certificates can be used to secure email communications and verify the sender's identity, reducing the risk of phishing and spoofing. Though not directly related to logo display, these certificates enhance overall email security.

December 2021 - Entrust

Technical article

Documentation from Microsoft explains that you can customize the Microsoft 365 sign-in page with your company logo and color scheme. This visual branding helps users recognize the login page as legitimate, reducing phishing risks.

September 2021 - Microsoft