To create a BIMI record, enforce DMARC at p=quarantine or p=reject, then host an SVG logo over HTTPS. Publish a TXT record at default._bimi.example.com with v=BIMI1, your l= logo URL and an optional a= certificate URL.
BIMI (Brand Indicators for Message Identification) lets receiving mailbox providers show your brand logo next to authenticated messages. The DNS record is short. Most of the work is getting the prerequisites right, so this guide walks through them in order.
What do you need before you create a BIMI record?
You need a domain with DMARC enforced (p=quarantine or p=reject), mail that passes SPF or DKIM with alignment, and a logo in the SVG Tiny PS format hosted at a public HTTPS URL. A certificate is optional in DNS but required by some mailbox providers.
Work through this checklist:
- Enforced DMARC. BIMI requires a DMARC policy of quarantine or reject on the domain. A policy of p=none does not qualify. If you use the pct tag, it should be 100. Subdomain policy (sp) matters too if you send from subdomains.
- Aligned authentication. Your mail must pass DMARC, which means SPF or DKIM must pass and align with the From domain. See RFC 7489 for the alignment rules.
- A compliant logo. The file must be SVG Tiny Portable/Secure (SVG Tiny PS), square, and served over HTTPS. A normal SVG exported from a design tool usually needs cleaning up first.
- Optional certificate. A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) ties the logo to your domain.
Start by checking your current policy with the DMARC lookup tool. If it shows p=none, you must move to enforcement before BIMI can work. The domain scanner can also check your DMARC, SPF and DKIM records in one pass.
How do you prepare the logo for a BIMI record?
Export your logo as a square SVG that follows the SVG Tiny PS profile, which means no scripts, no external references and no embedded raster images. Host the file at a stable HTTPS URL that mailbox providers can fetch without logging in.
A few practical points:
- Use a simple, square-friendly mark. Receivers usually display it in a small circle or rounded square, so fine detail is lost.
- Include a title element and the correct SVG version and base profile attributes. The header typically looks like this:
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
<title>Example Inc</title>
<!-- vector shapes only -->
</svg>
- Keep the file small and avoid redirects on the URL.
- Use a path you will not change, such as https://example.com/brand/logo.svg. If you replace the file, any certificate tied to the old logo no longer matches.
What does a BIMI record look like?
A BIMI record is a DNS TXT record published at a selector name, usually default, under the _bimi label of your domain. It starts with v=BIMI1, then uses l= for the logo URL and optionally a= for the certificate URL.
Here is a complete example for example.com:
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem"
The tags are:
| Tag | Meaning | Required |
|---|---|---|
| v | Version, always BIMI1 and first in the record | Yes |
| l | HTTPS URL of the SVG logo | Yes |
| a | HTTPS URL of the PEM certificate file (VMC or CMC) | No, but needed by some receivers |
If you do not need a certificate, leave out a= or publish it with an empty value:
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=;"
You can also generate the string with the BIMI generator to avoid typos in the syntax, then paste it into your DNS provider.
Publishing the record
In your DNS control panel, add a TXT record. Many providers append the domain automatically, so the host field would be just default._bimi. Paste the value, including the quotes only if your provider requires them. Keep each record to one BIMI string; multiple records at the same selector cause ambiguity.
Do you need a VMC to create a BIMI record?
No certificate is needed to publish a valid BIMI record, but some mailbox providers will not show your logo without one. Gmail, for example, expects a VMC or CMC. Other providers may display logos without a certificate, so behavior varies by receiver.
The two certificate types differ in what they prove:
- VMC: ties the logo to a registered trademark. It is issued by a certificate authority approved for the purpose.
- CMC: a newer option for logos that do not have a registered trademark, subject to the issuing authority's requirements.
Check current requirements with the certificate authority and with each mailbox provider you care about, as these rules change. The certificate is delivered as a PEM file. Host it at an HTTPS URL and reference it with a=. The logo in the certificate must match the SVG you publish in l=.
How do you check that your BIMI record works?
Query the TXT record at default._bimi.yourdomain, confirm that it begins with v=BIMI1 and that the URLs load over HTTPS, then confirm that DMARC passes on real messages. Finally, send a test message to a mailbox at a provider that supports BIMI.
Use these steps:
dig +short TXT default._bimi.example.com
- Confirm the output contains exactly one BIMI string with valid l= and, if used, a= values.
- Open both URLs in a browser or with curl. They should return the files directly without redirects to a login page.
- Verify your DMARC record with the DMARC lookup and confirm the policy is quarantine or reject.
- Send a message from the domain and check the headers for dmarc=pass.
- Allow time for DNS caching and for the receiver to fetch and cache the logo. The logo may not appear immediately.
Why is my BIMI logo not showing?
The most common causes are a DMARC policy that is still p=none, messages failing alignment, an SVG that does not meet the Tiny PS profile, a missing or mismatched certificate, or a receiver that does not support BIMI.
Troubleshoot in this order:
- DMARC policy. Confirm enforcement on the exact domain in the From header, and on subdomains if they send mail.
- Alignment failures. Third-party senders that are not aligned will fail DMARC and lose the logo for those messages. DMARC monitoring shows aggregate report data so you can find which sources fail.
- Record location. The record must be on the _bimi label of the domain used in the From address, or discoverable through the organizational domain fallback.
- File problems. Non-HTTPS URLs, redirects, a file that is too complex, or a wrong content type can stop the logo being fetched.
- Certificate mismatch. If you changed the logo, the certificate may no longer match it.
If you are still moving from p=none to enforcement, yourDMARC offers DMARC monitoring for aggregate reports and a managed service where its team runs the rollout to p=reject. Enforcement is also increasingly expected by bulk-sender rules, covered on the compliance page.
Key takeaways
- To create a BIMI record, first enforce DMARC at p=quarantine or p=reject. BIMI does not work with p=none.
- Prepare a square SVG Tiny PS logo and host it at a stable HTTPS URL.
- Publish a TXT record at default._bimi.yourdomain with v=BIMI1; l= and, if you have a certificate, a=.
- A VMC or CMC is optional in DNS but required by some mailbox providers, including Gmail, before they show a logo.
- Verify the record with dig, check that your DMARC passes, and expect some delay before logos appear.
- Most missing-logo problems come from DMARC policy, alignment failures or logo file issues, so check those first.
- Use the BIMI generator to build the record string and the DMARC lookup to verify your policy.
