Visual Sovereignty
for your Inbox.
Configure Brand Indicators for Message Identification (BIMI) to display your logo beside authenticated emails. Boost trust and increase open rates.
settings_ethernet Generator Inputs
Your domain must have DMARC enforcement (p=quarantine or p=reject).
Must be an SVG file exported with "Tiny 1.2" profile.
Verified Mark Certificates are required for many major receivers like Gmail.
Protocol Prerequisites
DMARC Policy
Domain must have DMARC set to p=quarantine or p=reject.
SVG Formatting
Strict adherence to SVG Tiny Portable/Secure profile is non-negotiable for display.
Inbox Preview
Your Security Audit Report is Ready
We've completed the monthly analysis...
BIMI isn't just about the logo—it requires a complete trust chain. Ensure your VMC is hosted on an HTTPS server with a valid certificate.
Why BIMI requires Enforced DMARC
Authenticated Trust
Receivers only show logos if they are 100% certain the email is authentic. DMARC at enforcement provides that guarantee.
Enhanced Visibility
Brands using BIMI see a median 10% increase in open rates due to higher visual prominence in the inbox list.
Example BIMI records
Two patterns you see in production: a BIMI record with a Verified Mark Certificate (required by Gmail, Apple Mail, Yahoo for full logo display) and a simpler BIMI record without a VMC (logo display limited to receivers that don't require a certificate).
default._bimi.example.com TXT v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem
default._bimi.example.com TXT v=BIMI1; l=https://example.com/bimi/logo.svg
Every BIMI record tag, explained
-
vVersion Required - Always BIMI1. Must be the first tag. v=BIMI1
-
lLogo URL Required - HTTPS URL of the SVG Tiny PS logo. Must be an exact-spec SVG; ordinary SVGs will not pass validation. l=https://example.com/bimi/logo.svg
-
aAuthority Evidence (VMC / CMC) - HTTPS URL of the Verified Mark Certificate or Common Mark Certificate (.pem). Required by Gmail, Apple Mail, and Yahoo for full brand display. a=https://example.com/bimi/vmc.pem
Common BIMI mistakes and how to fix them
Six failure modes the generator catches. Most are structural — BIMI is unforgiving about prerequisites.
| Issue | What it means | How to fix it |
|---|---|---|
|
DMARC policy not at quarantine or reject
|
BIMI requires the apex domain to be at p=quarantine or p=reject with pct=100. p=none disqualifies the domain entirely. | Move DMARC to p=quarantine first; BIMI is the reward for completing DMARC enforcement, not a workaround. |
|
Logo URL returns non-200 over HTTPS
|
The l= URL must resolve over HTTPS with a 200 response and a valid TLS certificate. | Host the logo at an HTTPS URL with a public certificate. CDNs work; private endpoints do not. |
|
SVG is not SVG Tiny Portable / Secure
|
BIMI requires the SVG Tiny PS profile — a strict subset of SVG without scripts, fonts, animations, or external references. | Re-export the logo from a vector editor with the SVG Tiny PS profile, or use a BIMI-specific tooling that validates the profile. |
|
Missing VMC for Gmail / Apple Mail
|
The l= tag is published but a= is empty or missing. Gmail and Apple Mail will not display the logo without the certificate. | Obtain a VMC from DigiCert or Entrust (the two current issuers). The CMC alternative covers trademark-eligible brands in fewer jurisdictions. |
|
BIMI selector mismatch
|
Mail is signed with a non-default BIMI selector, but only default._bimi is published. | Publish the matching selector. Most domains only need default; specific subdomain branding may require selector1, selector2, etc. |
|
Wrong subdomain published
|
The BIMI record is published at the apex instead of the subdomain that actually sends the mail (or vice versa). | BIMI records live at default._bimi.{sending-domain}. If marketing.example.com is the sending domain, publish at default._bimi.marketing.example.com. |
- What it means
- BIMI requires the apex domain to be at p=quarantine or p=reject with pct=100. p=none disqualifies the domain entirely.
- How to fix it
- Move DMARC to p=quarantine first; BIMI is the reward for completing DMARC enforcement, not a workaround.
- What it means
- The l= URL must resolve over HTTPS with a 200 response and a valid TLS certificate.
- How to fix it
- Host the logo at an HTTPS URL with a public certificate. CDNs work; private endpoints do not.
- What it means
- BIMI requires the SVG Tiny PS profile — a strict subset of SVG without scripts, fonts, animations, or external references.
- How to fix it
- Re-export the logo from a vector editor with the SVG Tiny PS profile, or use a BIMI-specific tooling that validates the profile.
- What it means
- The l= tag is published but a= is empty or missing. Gmail and Apple Mail will not display the logo without the certificate.
- How to fix it
- Obtain a VMC from DigiCert or Entrust (the two current issuers). The CMC alternative covers trademark-eligible brands in fewer jurisdictions.
- What it means
- Mail is signed with a non-default BIMI selector, but only default._bimi is published.
- How to fix it
- Publish the matching selector. Most domains only need default; specific subdomain branding may require selector1, selector2, etc.
- What it means
- The BIMI record is published at the apex instead of the subdomain that actually sends the mail (or vice versa).
- How to fix it
- BIMI records live at default._bimi.{sending-domain}. If marketing.example.com is the sending domain, publish at default._bimi.marketing.example.com.
From manual to managed
From BIMI generator to ongoing brand-display monitoring
A BIMI generator builds the right record. What it cannot do is watch what happens after deployment — the day the DMARC policy gets lowered, the day the logo URL host changes, the day the VMC expires.
DMARC AI monitors every client BIMI record across the portfolio: prerequisite DMARC posture, SVG host reachability, VMC validity, brand-display status at the major receivers. When the BIMI story breaks, you find out before the client's marketing team does.
- Continuous validation of BIMI prerequisites (DMARC + SPF + DKIM)
- Logo URL reachability + SVG validation
- VMC / CMC expiry tracking with advance alerts
- Brand-display posture tracking at Gmail / Apple Mail
- Multi-tenant view across the full client portfolio
Related tools
BIMI requires DMARC enforcement plus working DKIM and SPF. Validate the prerequisites here.
DMARC Checker
Confirm DMARC is at p=quarantine or p=reject with rua= reporting before publishing a BIMI record.
Open tool verifiedSPF Analyzer
BIMI alignment leans on the same SPF / DKIM mix that DMARC enforces. Validate SPF first.
Open tool keyDKIM Validator
DKIM signing must work cleanly for BIMI to display. Verify the selectors before the BIMI step.
Open toolContinue learning
Deeper Academy reading on BIMI and the protocols it sits on top of.
BIMI — Display your verified brand logo
Prerequisites, SVG Tiny PS specs, VMC certificates, and the deliverability story that justifies the project budget.
5 min readDMARC explained — Complete guide
DMARC enforcement is the prerequisite. Tags, policies, alignment, aggregate reports, and a phased rollout plan.
8 min readDKIM — Complete guide
Selectors, key rotation, signature anatomy. DKIM alignment is the most reliable path to DMARC pass — and to BIMI.
6 min readSPF (Sender Policy Framework) — Complete guide
Every mechanism and qualifier, the 10-lookup limit, void lookups.
7 min readFree check is good — running a portfolio is better
Two ways to go from a one-off check to a managed practice.
Start a free 30-day Premium trial
Sign up, add a domain, see real DMARC reports inside 48 hours. No credit card. Premium AI features included for the trial; drop back to free Basic monitoring afterwards or convert per-active-domain.
Book demo
Walk through the multi-tenant dashboard with a real engineer. Bring a client domain — we will load it live and show what the reports look like for your portfolio.
BIMI FAQ for Professionals
What is BIMI? expand_more
Brand Indicators for Message Identification — a DNS record that lets receivers display your verified brand logo next to authenticated email. BIMI requires DMARC enforcement (p=quarantine or p=reject) and an SVG Tiny Portable / Secure logo file; major receivers also require a Verified Mark Certificate.
Do I need a Verified Mark Certificate? expand_more
For Gmail, Apple Mail, and Yahoo display, yes. The VMC proves you own the trademark on the logo. DigiCert and Entrust are the current issuers. The CMC alternative is cheaper but covers fewer jurisdictions and fewer receivers.
Why is my logo not showing in Gmail? expand_more
Three common reasons: (1) DMARC is not at p=quarantine or p=reject with pct=100, (2) the VMC has not been issued or is expired, (3) the SVG is not strictly compliant with the SVG Tiny PS profile. The generator above catches all three.
Can I publish BIMI without DMARC at p=reject? expand_more
You can publish the record but receivers won't display the logo until DMARC is enforced. p=quarantine with pct=100 is the minimum bar; some receivers require p=reject. Do the DMARC work first; BIMI is the reward, not a workaround.
What's the difference between BIMI selectors? expand_more
Most domains only need the default selector (default._bimi). Multi-brand companies may publish selector1, selector2, etc. for different subdomains or sending identities. Each selector points at a different logo / VMC pair.
How much does BIMI cost an MSP to deliver? expand_more
The VMC itself is the headline cost — $1,500–$2,000 per year per certificate at current pricing. Beyond that, costs are SVG creation (if the client does not have a designer-built Tiny PS version), DNS work (small), and ongoing monitoring. Most MSPs price BIMI as a one-time setup fee plus monthly monitoring.