BIMI requires three DNS records to work: a DMARC record at an enforcement level (p=quarantine or p=reject), an SPF or DKIM record to satisfy DMARC alignment, and a BIMI TXT record pointing to your brand logo. Without all three in place, email clients will not display your logo in the inbox. This article unpacks each requirement and answers the most common questions senders run into during BIMI setup.
Which DNS records does BIMI actually require?
BIMI depends on three DNS records working together: a DMARC record set to an enforcement policy, at least one email authentication record (SPF or DKIM) that satisfies DMARC alignment, and a BIMI TXT record that points to your Scalable Vector Graphics (SVG) logo file. All three must be correctly configured before any participating inbox provider will render your logo.
Here is what each record does in the context of BIMI:
- DMARC record: Tells receiving mail servers how to handle messages that fail authentication. BIMI requires the policy to be at an enforcement level, meaning p=quarantine or p=reject. A p=none policy does not qualify.
- SPF and/or DKIM record: These authentication records are what DMARC evaluates. You need at least one to pass DMARC alignment, but having both is strongly recommended for resilience.
- BIMI TXT record: Published in your DNS at the subdomain default._bimi.yourdomain.com, this record contains a URI pointing to your SVG logo and, optionally, a Verified Mark Certificate (VMC).
Think of DMARC as the gatekeeper, authentication records as the credentials, and the BIMI TXT record as the display instruction. Remove any one of them and the whole chain breaks.
What DMARC policy is needed for BIMI?
BIMI requires a DMARC policy of either p=quarantine or p=reject. A monitoring-only policy of p=none does not meet the BIMI specification because it provides no enforcement signal to receiving mail servers. The policy must apply to your root domain, and the DMARC record must pass without errors.
Beyond the policy value itself, there are a few additional DMARC conditions worth checking:
- The pct tag (percentage) should be set to 100, meaning the policy applies to all messages. Some inbox providers will not honor BIMI if the percentage is lower.
- If you use subdomain policies, make sure the sp tag is also at an enforcement level, or that your BIMI record is published at the specific subdomain you are sending from.
- Your DMARC record must be free of syntax errors. Even a minor formatting mistake can cause the entire record to fail validation.
If you are moving from p=none to an enforcement policy, do it gradually. Start with p=quarantine at a low percentage, monitor your DMARC reports for legitimate sources that might be failing, correct any misconfigurations, and then raise the percentage before moving to p=reject.
How does the BIMI TXT record work?
The BIMI TXT record is a DNS entry published at default._bimi.yourdomain.com that tells participating inbox providers where to find your brand logo and, if applicable, your Verified Mark Certificate. The record uses a simple tag-value format. The v tag declares the BIMI version (always BIMI1), the l tag holds the URL of your SVG logo, and the optional a tag holds the URL of your VMC.
A basic BIMI TXT record looks like this:
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/certificate.pem
The logo file itself must meet specific technical requirements. It must be an SVG Tiny PS file (a specific SVG profile), it must have a square aspect ratio, and it must not contain any embedded scripts or external references. Many standard SVG files exported from design tools will fail BIMI validation because they do not conform to the SVG Tiny PS specification. Converting the file correctly is one of the most common stumbling blocks in BIMI implementation.
Do you need a VMC certificate for BIMI?
A Verified Mark Certificate (VMC) is not required for BIMI to work on all platforms, but it is required for your logo to display in Gmail and Apple Mail. These two providers only render BIMI logos when a valid VMC is present. For smaller or less widely adopted inbox providers that support BIMI without VMC verification, the certificate is optional.
A VMC is issued by a Certificate Authority (currently either DigiCert or Entrust) and ties your trademarked logo to your domain identity. To obtain one, your logo must be a registered trademark in the relevant jurisdiction. The certificate is then referenced in your BIMI TXT record using the a tag.
Given that Gmail represents a significant share of consumer inboxes, most brands pursuing BIMI for meaningful reach will need a VMC. The trademark registration requirement is the most common barrier, as it adds both time and cost to the process before a certificate can even be applied for.
Why is my BIMI logo not showing even with the right records?
If your BIMI records appear correct but your logo is still not displaying, the issue is almost always one of several common misconfigurations. The most frequent causes are an SVG file that does not conform to the SVG Tiny PS profile, a DMARC policy that has not fully propagated or is set below an enforcement level, a missing or invalid VMC for providers that require it, or DNS propagation delays after a recent record change.
Work through this checklist to isolate the problem:
- Validate your SVG file using a BIMI-specific SVG validator. Standard SVG validators will not catch SVG Tiny PS compliance issues.
- Check your DMARC record with a DMARC lookup tool and confirm the policy is p=quarantine or p=reject with pct=100.
- Verify DNS propagation has completed for your BIMI TXT record. Changes can take up to 48 hours to propagate fully.
- Test with a BIMI inspector such as the tools provided by the BIMI Group or major email testing platforms to get a full diagnostic readout.
- Confirm VMC validity if you are targeting Gmail or Apple Mail. An expired or incorrectly referenced VMC will silently prevent logo display.
- Check the inbox provider’s support for BIMI. Not every email client renders BIMI logos, and some only support it for certain account types.
One often overlooked issue is the hosting of the logo file itself. The SVG must be hosted on a publicly accessible HTTPS URL, and the server must return the correct content type header. If the file is behind authentication or returns a redirect, BIMI lookup will fail silently.
How Email Industries helps with BIMI implementation
Getting BIMI right involves more than publishing a DNS record. It requires a correctly enforced DMARC policy, properly authenticated sending infrastructure, a spec-compliant SVG file, and in most cases a VMC backed by a trademark registration. That is a lot of moving parts, and a misconfiguration at any layer means your logo simply will not appear. We help brands work through every layer of this process, including:
- Auditing and hardening existing DMARC, SPF, and DKIM configurations to meet BIMI requirements
- Diagnosing why an existing BIMI setup is not rendering correctly across target inbox providers
- Guiding teams through SVG file preparation and VMC procurement
- Ongoing monitoring to catch authentication drift before it breaks BIMI display
Our Deliverability Assurance Packages include authentication setup and monitoring as a core component, and our broader services cover the full range of deliverability and authentication challenges. If your BIMI setup is not behaving as expected, or you want to get it right from the start, contact us and we will take a look.
Related Articles
- How does DKIM setup improve email deliverability?
- How does DMARC protect your email from spoofing attacks?
- What happens if you don't have DMARC?
- What factors affect full service email marketing pricing?
- How do email advertising agencies adapt to algorithm changes?
- How often do full service agencies review and update strategies?
- How do you maintain inbox placement during an email platform migration?
- When should you use a new domain for email migration?
- What is the difference between email platform migration and IP warmup?
- What types of emails should you send first during IP warming?
- How do agencies handle email consent management?
- What lead magnet strategies do email agencies recommend?
- How do agencies develop annual email marketing plans?
- Which industries benefit most from email deliverability agencies?
- How long does blacklist removal typically take?
