BIMI Record Generator

The order to do this in

1. Get DMARC to quarantine or reject and confirm from reports that your own mail passes.
2. Prepare the logo as SVG Tiny P/S and serve it over https on your own domain.
3. Obtain a VMC if you need Gmail support, and this is the slow part, measured in weeks.
4. Publish the TXT record at default._bimi.

Where the logo shows up

Gmail, Yahoo, Apple Mail, Fastmail and La Poste support BIMI. Support is not universal, and each provider applies its own additional conditions on top of the specification, so expect the logo to appear gradually rather than everywhere at once.

What the record contains

There are only three tags, and just two of them matter in practice:

• v=BIMI1 — the version. It comes first and never changes.
• l= — the https URL of the logo in SVG Tiny P/S. An empty l= is a deliberate opt out, used to override a record inherited from a parent domain.
• a= — the URL of the VMC certificate in PEM form. Optional per the specification, but Gmail shows nothing without it.

Tag order does not matter and the separator is a semicolon. Both URLs must be served over https with a valid certificate, since plain http or a self-signed certificate voids the whole record.

Why the logo does not show up

Roughly in order of how often each one is the actual cause:

• DMARC is still at p=none. By far the most common. BIMI needs quarantine or reject, and the policy has to cover the whole domain, a pct= below 100 does not qualify either.
• The logo is an ordinary SVG. An export from a design tool almost always carries something forbidden: scripts, animation, external references, text elements, embedded raster images. What you need is the SVG Tiny P/S profile, with mandatory baseProfile="tiny-ps" and version="1.2" attributes, a square canvas and a title element.
• No VMC, but you are checking Gmail. Apple Mail and Yahoo will already be showing the logo, so test there first to separate a broken record from a missing certificate.
• The domain has no reputation yet. Providers do not display the logo immediately; they want sending history. On a fresh domain the record can be perfectly valid and still show nothing for weeks.
• Mail is sent from a subdomain. BIMI looks for the record on whatever domain appears in From. Sending as news.example.com requires its own record at default._bimi.news.example.com.

Selectors and multiple logos

The default part of the record name is a selector, exactly as in DKIM. A BIMI-Selector header on the message can point at a different one, say promo._bimi for campaigns and default._bimi for transactional mail. Support is patchy across providers and the feature only earns its keep for large senders running several brands. Without that problem, stay on default: it is what every client looks for.

What it costs, and whether it is worth it

DigiCert and Entrust issue VMCs at roughly a thousand dollars a year, and issuance requires a registered trademark, a completed registration, not a pending application. Vetting takes weeks and covers both the mark and control of the domain.

Do not file this under deliverability: BIMI has no effect on whether you reach the inbox. It affects how recognisable the message is in a crowded list and, indirectly, open rates. Which fixes the order of work: SPF, DKIM and DMARC at reject first, then a clean list, then the logo. A shopfront is worth building once there is something behind it.