mailauth logomailauth

How to set up BIMI

BIMI puts your logo beside your name in the inbox. The hard part is not the DNS record — it is the order, because three things have to be true before the record does anything at all.

Start at the right end

People buy the certificate first and wonder why no logo appears. Nothing about BIMI works while DMARC is at p=none, no matter how correct the record and the artwork are. Move the policy first; everything else is wasted until then.

In order

  1. 1
    Get DMARC to quarantine or reject. This is the prerequisite, not a nice-to-have — mailboxes check it before they look at anything else.Build a DMARC record
  2. 2
    Produce the logo as SVG Tiny Portable/Secure. This is not an ordinary SVG: it has to be square, declare the tiny-ps profile, carry a title, and contain no scripts or external references. A normal export from a design tool will not qualify.
  3. 3
    Decide whether you need a certificate. Gmail requires one — a VMC, or a CMC where the mark is not registered. Yahoo does not: it says it does not require a VMC for the logo to appear, though it takes one into account if present, and Fastmail and La Poste display self-asserted logos too. Only a few certificate authorities issue them, they cost money, and a VMC needs a registered trademark — so if Gmail is not where your recipients are, you can publish without this step.
  4. 4
    Publish the record at default._bimi, pointing l= at the SVG and a= at the certificate. Both have to be reachable over HTTPS.

What the record looks like

One TXT record. l= is the logo, a= is the certificate. A record without a= is valid and Yahoo, Fastmail and La Poste will still show the logo; Gmail will not.

default._bimi.example.com.   IN   TXT
  "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

What this page cannot do for you

  • We can give you the record text. We cannot produce the SVG or obtain the certificate — those are the two parts that take real work.
  • We cannot check the SVG after you publish it either. BIMI logos are served without CORS headers, so a browser cannot read them; validating the profile needs a server.
  • We do not quote a price. Certificates are paid and the cost varies by authority, and repeating a number we have not verified would be worse than saying nothing.
Check a BIMI record