BIMI Record Generator

What BIMI is

BIMI (Brand Indicators for Message Identification) puts a company logo next to its messages in the inbox. The domain owner publishes a TXT record pointing at the logo, and the mailbox provider fetches it; the recipient does nothing. The AuthIndicators working group maintains the specification, which is still an IETF draft. The latest version, 14, came out on 1 May 2026.

Logos are shown only for mail that passes DMARC, so nobody can borrow yours without control of your DNS. BIMI does not stop phishing from lookalike domains, though: such a domain can have its own DMARC and its own logo.

How to set up BIMI

1. Get DMARC to quarantine or reject and confirm from reports that your own mail passes.
2. Prepare the logo as SVG Tiny PS and serve it over https.
3. If you need Gmail or Apple Mail, obtain a certificate. This is the slow part, measured in weeks.
4. Publish the TXT record at default._bimi on your domain and check it, for example with the BIMI Validator on the BIMI Group site. It checks the record syntax and the DMARC policy, not the logo or the certificate.

The DMARC policy BIMI needs

The BIMI draft requires the sender's DMARC policy to be p=reject, or p=quarantine applied to 100% of mail, and the subdomain policy must not be none. If the domain or its organizational domain has p=none, receivers skip BIMI entirely. Google puts it the same way: quarantine or reject with pct=100. RFC 9989 dropped the pct tag, and without it the policy covers all mail anyway.

Beyond the policy, the check itself has to pass: the message needs DMARC with SPF or DKIM alignment. Check your record in the DMARC checker or build a new one in the DMARC generator.

Where the logo shows up, and which certificate it needs

According to BIMI Group, logos are displayed by Apple, AU (KDDI), Fastmail, Gmail, La Poste, Yahoo and Zone. Their certificate requirements differ:

• Gmail accepts a VMC or a CMC. A VMC adds a blue checkmark next to the logo; a CMC does not.
• Apple Mail shows the logo on iOS 16, macOS Ventura and later, and on iCloud.com. The only certificate Apple names is the VMC.
• Yahoo requires no certificate, but shows the logo only for bulk mail with sufficient reputation and engagement.
• Fastmail requires no certificate either. A VMC is optional there.

Any provider may decline to show a logo if it has doubts about the sender's reputation.

VMC and CMC

A VMC (Verified Mark Certificate) is issued for a logo registered as a trademark with an office the certificate authorities recognise. The CMC (Common Mark Certificate) came later, and Gmail has accepted it since 24 September 2024. It needs no trademark registration. The authority checks that the logo has been in public use for at least 12 months, usually through the website archive.

As of September 2026 BIMI Group lists three authorities issuing both types: DigiCert, GlobalSign and SSL.com. Entrust sold its public certificate business to Sectigo and stopped issuing VMCs on 12 May 2025. Sectigo sells VMCs on its own site but does not appear on the BIMI Group list. The certificate is published as a PEM file over https, and its URL goes into the a= tag.

Preparing the logo in SVG Tiny PS

BIMI accepts only the SVG Tiny PS (Portable/Secure) profile, a restricted form of SVG Tiny 1.2. A plain export from Figma or Illustrator nearly always needs work. BIMI Group has released converters from SVG Tiny 1.2 to Tiny PS for this, standalone apps for Windows and macOS and an export script for Illustrator.

• The root element needs baseProfile="tiny-ps" and version="1.2", and the file needs a title element with the company name.
• No scripts, animation, filters or embedded raster images. Text is safer converted to outlines.
• Square image, logo centred, because clients crop it into a circle or a rounded square. Google asks for the size in pixels, for example width="96".
• A solid background is safer, since transparency does not render as intended everywhere.
• BIMI Group recommends staying within 32 KB. Fastmail asks for a file under 16 KB.

What the record is made of

v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem

• v=BIMI1: the version, which comes first.
• l=: the https URL of the SVG Tiny PS logo.
• a=: the https URL of the VMC or CMC. Optional per the specification.
• avp=: what to show when the provider supports personal avatars, brand (the default) or personal.
• lps=: local-part prefixes the record applies to. Rarely needed.

Both URLs must use https. A record with empty l= and a= is an explicit refusal to take part in BIMI, which is how a single subdomain opts out while the main domain keeps its logo.

Checking the published record

dig +short TXT default._bimi.example.com
curl -sI https://example.com/brand/logo.svg | head -3

The DNS answer must start with v=BIMI1, and the logo must load over https without errors. Common slips: a record at _bimi.example.com with no selector, or a CNAME instead of a TXT. Receivers that evaluate BIMI record the outcome in the Authentication-Results header as bimi=pass, which you can read in the email header analyzer. Gmail is not instant. Google warns it can take up to 48 hours after you publish the record.

BIMI not working: why the logo does not appear

• DMARC at p=none on the domain or its organizational domain. The most common case.
• DMARC does not pass. The policy is strict, but mail goes out through a service that signs with its own domain, so nothing aligns.
• The logo is a plain SVG. No baseProfile, a script or raster image inside, or a file over the recommended 32 KB.
• No certificate, and you are looking in Gmail or Apple Mail. Without one, the logo can still appear in Fastmail and Yahoo, and Yahoo shows it only for bulk mail with a good reputation.
• The provider does not trust the sender. Any receiver may withhold the logo if the domain's reputation raises doubts.
• Not enough time has passed. Up to 48 hours in Gmail.

Subdomains, selectors and several logos

For mail from news.example.com the client first looks at default._bimi.news.example.com, and if nothing is there, falls back to the organizational domain's default._bimi.example.com. A separate subdomain record is needed only when that subdomain should show a different logo, or none.

The default part is a selector, just as in DKIM. A BIMI-Selector: v=BIMI1; s=promo header in the message asks for the record at promo._bimi, which lets a large sender with several brands show different logos from one domain. If you have no such need, stick with default, which every client looks for.

What it costs, and whether it is worth it

The record itself is free; the certificate is what you pay for, and the price is set by the issuing authority. For a VMC, add the time and cost of registering a trademark if you do not have one. Validation takes weeks and covers your rights to both the logo and the domain.

Do not count it as a deliverability investment, because BIMI has no effect on whether mail reaches the inbox. It affects how recognisable the message is in the list and, indirectly, open rates. So the order is SPF, DKIM and DMARC first, then a clean list, and only then the logo.