MXCorrect

← Blog · September 15, 2026

BIMI Setup Guide: Get Your Logo to Show Up in Inboxes

BIMI (Brand Indicators for Message Identification) lets your company logo appear next to your emails in supported inboxes like Gmail, Yahoo, and Apple Mail. It’s a DNS-based standard, but unlike SPF or DKIM, it doesn’t work in isolation — it sits on top of a fully enforced DMARC policy. If you’ve tried publishing a BIMI record and the logo still isn’t showing up, the cause is almost always a missing prerequisite, not a syntax error. This guide walks through what BIMI actually checks, the exact record format, and the most common reasons it fails to render.

What BIMI Actually Requires

Mailbox providers only look up your BIMI record if your mail already passes strict authentication. Before touching BIMI DNS records, you need:

  • A valid SPF record for your sending domain
  • A valid DKIM signature on your outgoing mail
  • A DMARC record at enforcement — p=quarantine or p=reject, with pct=100
  • A square logo in SVG Tiny 1.2 format, hosted over HTTPS
  • For some providers (notably Yahoo, and Gmail’s verified checkmark), a Verified Mark Certificate (VMC) issued by a recognized certificate authority

If your DMARC policy is still p=none, stop here — no mailbox provider will evaluate your BIMI record until enforcement is in place. See our guide on choosing between p=none, p=quarantine, and p=reject if you’re not there yet.

The BIMI DNS Record

BIMI records are published as TXT records under a _bimi subdomain, similar in structure to DKIM selectors:

default._bimi.example.com.  IN  TXT  "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

Breaking down the tags:

  • v=BIMI1 — required version tag, must be first
  • l= — HTTPS URL to your logo, an SVG file conforming to the SVG Tiny Portable/Secure (PS) profile
  • a= — HTTPS URL to your VMC (or CMC) certificate chain in PEM format; omit this tag entirely if you don’t have a VMC yet, don’t leave it empty

The selector defaults to default unless your DKIM signatures or provider instructs otherwise. You can also use per-provider selectors, e.g. google._bimi.example.com, if a mailbox provider requires a distinct certificate or logo.

Publishing Without a VMC

You can publish a BIMI record without a VMC, and Apple Mail will display the logo based on SPF/DKIM/DMARC alignment alone. However, Gmail and Yahoo currently require a VMC before they’ll render anything — without one, your record is published but invisible in those clients:

default._bimi.example.com.  IN  TXT  "v=BIMI1; l=https://example.com/logo.svg;"

Note the trailing semicolon is fine, but do not include a= with an empty value like a=; — some validators treat that as malformed.

Logo File Requirements

The single most common reason a correctly published BIMI record still fails validation is the SVG file itself. Requirements are strict:

  1. Must be SVG Tiny PS (Portable/Secure) — a restricted profile, not a regular SVG export from Illustrator or Figma
  2. No scripts, animations, external references, or embedded raster images beyond what the profile allows
  3. Must include a baseProfile="tiny-ps" attribute and a title element
  4. Square aspect ratio (1:1), typically with the logo centered inside a padded canvas
  5. Served over HTTPS with a valid certificate and a content type of image/svg+xml

Tools like the free BIMI SVG validators from major BIMI Group members can catch profile violations before you publish. A logo that renders fine in a browser can still fail BIMI validation because browsers are far more permissive than the Tiny PS spec.

Getting a Verified Mark Certificate

A VMC proves your organization legally owns the trademark shown in the logo. To obtain one:

  1. Have a registered trademark for your logo mark in a jurisdiction the CA recognizes
  2. Choose a CA that issues VMCs — currently DigiCert and Entrust are the main providers
  3. Submit the trademark registration and organization verification documents
  4. Once issued, host the full certificate chain (not just the leaf cert) at the HTTPS URL referenced by the a= tag

VMCs typically cost several hundred dollars per year and take days to weeks to issue, since it involves manual trademark and organization vetting — budget for this separately from your DNS work.

Debugging a BIMI Record That Isn’t Showing

If DNS, DMARC, and SVG are all correct but the logo still doesn’t appear, check these in order:

  • DMARC alignment failures — the domain in the From: header must align with either your SPF or DKIM domain under your DMARC policy, not just pass authentication somewhere in the chain
  • Inconsistent sending — some providers require a sending reputation/volume history for the domain before they’ll trust BIMI at all
  • Caching — mailbox providers cache BIMI lookups; changes can take up to 24-48 hours to reflect
  • Wrong selector — verify the selector in your DKIM signature matches what you published under _bimi, if you’re using non-default selectors
  • Certificate chain order — VMC files must include intermediate certificates in the correct order; a leaf-only cert will fail validation silently on some providers

Use dig TXT default._bimi.yourdomain.com to confirm the record is publishing and propagating correctly, and cross-check your DMARC record with dig TXT _dmarc.yourdomain.com to confirm you’re actually at enforcement before assuming the BIMI setup itself is broken.