BIMI – your logo next to the message in the inbox
BIMI puts your logo next to your messages in the inbox. It only works with enforced DMARC, an SVG in a narrow profile and a mark certificate. Here is every requirement and finding.
BIMI is the last step, not the first. It puts your logo next to your name in the recipient's inbox – a small visual signal that the message really is from you, and one your customers notice long before they read a header. The idea is simple: you publish the address of a logo file in your DNS, and mailbox providers that support BIMI fetch it and show it.
What makes BIMI unusual is the price of admission. A logo beside a message is a statement of identity, so nobody is allowed to make it lightly. Three things must be true at once: your DMARC policy is enforced, your logo file meets a narrow technical profile, and – at the largest providers – a certificate proves the logo is a trademark that belongs to you. Miss any one of them and the record does nothing, silently.
What the record looks like
BIMI is a TXT record under default._bimi on your domain.
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"| Part | What it means |
|---|---|
default | The selector. default is the one every provider looks for unless a message says otherwise. |
v=BIMI1 | Marks the record as BIMI. |
l=https://…/logo.svg | The address of the logo file. HTTPS only, publicly reachable, valid certificate. |
a=https://…/vmc.pem | The address of the mark certificate. Without it, Gmail and Apple Mail show nothing. |
Both files are ordinary files on your web server. No special hosting is needed – only a valid certificate and a URL that stays put.
The logo file: SVG, but a very particular one
An SVG exported from a design tool will not do. BIMI requires the profile SVG Tiny 1.2 Portable/Secure, which strips out everything that could load, move or execute. These are the points this check tests, and a failure on any of them means the logo is rejected:
| Requirement | Why |
|---|---|
baseProfile="tiny-ps" and version="1.2" | The declaration that marks the file as the restricted profile. |
A <title> element | The accessible name of the logo. |
No <script> | Mail clients will not execute anything. |
No <image> | An embedded photo is not a logo. |
No animation, no <a>, no <foreignObject> | Nothing may move, link or escape the image. |
| Nothing loaded from elsewhere | No @import, no external xlink:href. |
Square, with a viewBox | It is shown in a circle or square, so a wide logo is cropped. |
| Not larger than 32 KB | Providers fetch it on every display. |
In practice the job is: take your logo, make it square with generous padding, place it on a solid background, convert it to tiny-ps, add a <title>, and remove everything else. Several free converters do this, and your designer can do it by hand in ten minutes. Then check the result here before you publish the record.
The mark certificate, and what it costs
A Verified Mark Certificate (VMC) is a certificate that states: this logo is a registered trademark, and it belongs to this domain's owner. A Common Mark Certificate (CMC) works similarly for logos with a different kind of proof. The certificate file is a PEM you publish on your own web server and reference with a=.
This is where most BIMI projects stop, and there is no point pretending otherwise:
- A registered trademark is a precondition. Without one, a VMC is not available.
- The verification is a formal process with a certificate authority and takes weeks, not minutes.
- The certificate costs money every year, and it has to be renewed before it expires or the logo simply disappears.
Gmail and Apple Mail will not display a logo without a certificate. Some other providers are more relaxed. So a BIMI record without a= is not wrong – it is preparation, and it is honest to treat it as such rather than as a feature that is switched on.
DMARC first, on p=quarantine or p=reject and applied in full. Then the logo file. Then, only if it is worth it to you, the certificate. Doing it the other way round means paying for a certificate that cannot take effect.
How to set it up
- Check that your DMARC record is at
quarantineorreject, with nopctbelow 100. - Have the logo converted to SVG Tiny 1.2 Portable/Secure, square, under 32 KB, with a
<title>. - Upload it to your own web server, for example at
https://example.com/bimi/logo.svg, and open that address in a browser to be sure it is public. - If you want the logo at Gmail and Apple Mail, order a VMC from a certificate authority and upload the PEM file they supply, unchanged.
- At your DNS host – GoDaddy: My Products, DNS, Add New Record – add a TXT record named
default._bimiwith the valuev=BIMI1; l=…; a=…. - Run this check again. It fetches both files the way a mailbox provider does and reports what it finds.
The record is identical at Namecheap, Cloudflare, Bluehost, Rackspace, Fasthosts and 123-reg; only the panel differs. Microsoft 365 and Google Workspace have no BIMI setting of their own – the record lives with your DNS.
The findings in detail
Multiple BIMI records
More than one TXT record at default._bimi begins with v=BIMI1. Only one is allowed, and with several no provider shows anything – the ambiguity is resolved by ignoring the domain.
What to do: keep the current record, delete the others, and check that exactly one remains.
BIMI without enforced DMARC
Your DMARC policy is not quarantine or reject, or it is not applied to all mail. BIMI requires an enforced policy, because a logo on a domain that still permits forgeries would be a gift to a forger. However correct the rest of your setup is, the logo stays invisible.
What to do: tighten DMARC first – raise the policy, remove any pct below 100, and make sure sp is not set to none. BIMI then takes effect on its own, with no further change to the BIMI record.
BIMI without a logo address
The record exists but has no l= field, so there is no logo to fetch. This usually happens when a record is published as a placeholder before the file is ready.
What to do: add l=https://…/logo.svg pointing at the finished file. Until the file exists, the record has no purpose and can be removed.
BIMI logo not retrievable
We requested the address in l= and did not get the file – a 404, a redirect that led nowhere, a certificate error, or a server that did not answer. Mailbox providers fetch it exactly as we did and will show nothing.
What to do: open the address in a private browser window. Check that it is HTTPS, that the certificate is valid, that the file is not behind a login or a firewall rule, and that no redirect points elsewhere. A logo moved during a site relaunch is the usual cause.
BIMI logo in the wrong format
The file was retrieved but does not meet SVG Tiny 1.2 Portable/Secure. The finding names the specific points: a missing baseProfile, a missing <title>, an embedded image, animation, a non-square canvas, or a file above 32 KB.
What to do: work through the list in the finding. Most failures come from an ordinary SVG export: the profile declaration is missing, the canvas is wide rather than square, and the file carries editor metadata. Convert, trim, re-upload, check again.
BIMI without a mark certificate
The record has no a= field. That is permitted by the standard, but Gmail and Apple Mail – between them a very large share of the inboxes your mail reaches – will not show a logo without one.
What to do: decide deliberately. If the logo matters, obtain a VMC, which requires a registered trademark. If it does not, leave the record as preparation and know that it currently has little effect. Both are defensible; assuming it works is not.
Mark certificate not retrievable
The address in a= did not deliver a file. Without the certificate, the providers that require one show nothing, and the whole chain stops here.
What to do: check the address the same way as the logo: HTTPS, valid certificate, publicly reachable, no login. Serve the PEM file as a static file; some servers block the .pem extension by default.
File is not a certificate
Something was retrieved from the a= address, but it is not a PEM file containing a certificate – often an HTML error page returned with a 200 status, or the wrong file uploaded.
What to do: open the address and look at what comes back. It must begin with the BEGIN CERTIFICATE line. Upload the file your certificate authority supplied, without editing it.
Mark certificate unreadable
A PEM file arrived but the certificate inside it could not be parsed – usually damage from copying: changed line breaks, a lost character, or a file opened and saved by a text editor that reformatted it.
What to do: download the file from the certificate authority again and upload it unchanged, in binary form. Do not paste it through a text editor.
Mark certificate expired
The certificate's validity has ended. Expired certificates are not accepted, so the logo has already disappeared from the inbox – this is one of the few BIMI faults that has a visible effect.
What to do: renew the certificate with your certificate authority and publish the new file at the same address. There is no grace period.
Mark certificate expires soon
Validity ends in fewer than 30 days. Nothing is broken yet, and it will break on a known date.
What to do: start the renewal now. Re-verification can take longer than expected, especially if the trademark registration or the company details have changed since the last time.
Certificate without the logotype extension
The file is a valid certificate, but it lacks the extension that carries the verified logo. In other words, it is not a mark certificate at all – most often a TLS certificate uploaded by mistake, because both are PEM files.
What to do: publish the VMC or CMC issued for this purpose. A web server certificate cannot do this job, whatever its name suggests.
Frequently asked questions
Do I need BIMI?
No. It changes nothing about delivery, protection or authentication. It is a visual signal for recipients, and it is worth the effort mainly for brands that people recognise by their logo. SPF, DKIM and DMARC are the parts that matter.
Will my logo appear everywhere?
No. Support differs by provider, and the largest ones require a certificate. Even where everything is in place, display depends on the recipient's client and settings.
Can I use my normal website logo file?
Almost never. The profile forbids things ordinary SVG exports contain, and the image must be square. Converting is quick; skipping the conversion means the logo is fetched and rejected.
What happens when the certificate expires?
The logo disappears. Nothing else breaks – mail is delivered exactly as before, and DMARC is unaffected. Put the renewal date in a calendar, because nobody sends a reminder.
The Mail Check measures exactly what this page describes – on your own domain, in one to three seconds, without signing up.
Check a domain now →