A BIMI DNS record is a TXT record published in your domain’s DNS that tells email clients where to find your brand logo so it can be displayed next to your emails in the inbox. BIMI stands for Brand Indicators for Message Identification, and it works as a visual layer on top of your existing email authentication setup. This article walks through how BIMI works, what you need to implement it, and how to configure and validate it correctly.
How does BIMI actually work in the inbox?
BIMI works by linking your domain’s DNS record to a verified logo file, which participating email clients retrieve and display beside your sender name when an email passes authentication checks. When a recipient’s mail client sees your email, it looks up your BIMI record, fetches your logo from the URL specified in that record, and renders it as a visible brand indicator in the inbox.
For this to happen, the email must first pass DMARC enforcement. That means your domain needs a DMARC policy set to either quarantine or reject, and the email must pass either SPF or DKIM alignment. Only once those checks pass will the mail client attempt to display the BIMI logo.
The result is a recognizable brand avatar next to your emails, which builds visual trust with recipients before they even open the message. Gmail, Apple Mail, Yahoo Mail, and a growing number of other clients support BIMI display, making it increasingly worthwhile for brands that send at scale.
What are the requirements for a BIMI record?
To implement BIMI successfully, your domain must meet a specific set of technical prerequisites. BIMI is not a standalone tool; it is the final layer of a complete email authentication stack.
- DMARC enforcement: Your domain must have a DMARC record with a policy of p=quarantine or p=reject. A p=none policy will not qualify.
- SPF and/or DKIM alignment: Emails must pass DMARC alignment through at least one of these authentication methods.
- SVG logo in the correct format: Your logo must be a Scalable Vector Graphic (SVG) file that conforms to the SVG Tiny Portable/Secure (SVG P/S) profile. Standard SVG files typically need to be converted to meet this specification.
- Publicly accessible logo URL: The logo must be hosted at an HTTPS URL that is publicly reachable without redirects.
- Verified Mark Certificate (VMC) or Common Mark Certificate (CMC): Some email clients, particularly Gmail, require a VMC or CMC to display the logo. More on the difference between these below.
Meeting these requirements before publishing your BIMI record saves troubleshooting time and ensures consistent display across supported clients.
What does a BIMI DNS record look like?
A BIMI DNS record is a TXT record published at a specific subdomain of your sending domain. The record follows a defined syntax that points to your logo file and, optionally, your certificate authority URL.
The record is published at: default._bimi.yourdomain.com
A basic BIMI record without a certificate looks like this:
v=BIMI1; l=https://yourdomain.com/logo.svg;
A BIMI record that includes a Verified Mark Certificate looks like this:
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/bimi.pem;
The v= tag declares the BIMI version. The l= tag is the URL of your SVG logo. The a= tag is the URL of your PEM-encoded certificate file. If you are not using a certificate yet, you can omit the a= tag or set it to empty, though doing so limits which clients will display your logo.
How do you configure a BIMI record step by step?
Configuring a BIMI record involves preparing your authentication foundation, creating a compliant logo, optionally obtaining a certificate, and then publishing the DNS record. Here is the process broken into clear steps.
- Confirm DMARC is enforced. Check that your domain has a DMARC record with p=quarantine or p=reject. If you are still at p=none, move to enforcement before proceeding.
- Prepare your SVG logo. Convert your brand logo to the SVG Tiny P/S format. Tools like Vecta.io or professional design resources can help with this conversion. The file must be square, under 32KB, and free of embedded raster images or scripts.
- Host the logo at a public HTTPS URL. Upload the SVG to a web server or CDN where it is reachable without authentication, redirects, or access restrictions.
- Obtain a VMC or CMC (if required). If you want your logo to appear in Gmail or other clients that require certificate validation, purchase a Verified Mark Certificate from an authorized provider such as DigiCert or Entrust. Trademark registration is required for a VMC.
- Publish the BIMI TXT record. Log in to your DNS provider and create a new TXT record at default._bimi.yourdomain.com with the appropriate BIMI syntax. Allow up to 48 hours for DNS propagation.
How do you test and validate your BIMI record?
After publishing your BIMI record, you should validate it using dedicated testing tools before assuming it is working correctly. Several free tools are available that check both the DNS record syntax and the accessibility of your logo file.
Tools worth using include the BIMI Group’s official validator at bimigroup.org, as well as third-party checkers like MXToolbox and mail-tester.com. These tools will flag issues such as an unreachable logo URL, incorrect SVG format, missing DMARC enforcement, or malformed record syntax.
Beyond automated tools, send a test email from your configured domain to a Gmail or Yahoo Mail account and check whether the logo appears. Keep in mind that logo display in Gmail specifically requires a valid VMC or CMC, so if you have not yet obtained a certificate, you may see the logo in Yahoo Mail but not Gmail.
If the logo does not appear after 48 hours and your record validates cleanly, check that your DMARC policy is genuinely enforced and that your sending domain matches the domain where BIMI is published.
What’s the difference between a VMC and a CMC for BIMI?
A VMC (Verified Mark Certificate) and a CMC (Common Mark Certificate) are both digital certificates that authenticate your logo for BIMI display, but they differ in the type of trademark verification required to obtain them.
Verified Mark Certificate (VMC)
A VMC requires that your logo is a registered trademark with an official trademark office, such as the USPTO in the United States or the EUIPO in Europe. The certificate is issued by an authorized Certification Authority after verifying your trademark registration. VMCs have been the standard since BIMI launched and are required by Gmail for logo display.
Common Mark Certificate (CMC)
A CMC was introduced to lower the barrier to entry for brands that use logos that are recognized in commerce but not formally registered as trademarks. CMCs verify that the logo is genuinely associated with your brand through common law usage rather than requiring formal trademark registration. They are accepted by a growing number of mail clients and offer a practical path for organizations that cannot or have not pursued trademark registration.
In practical terms, if your logo is trademarked, a VMC is the stronger and more universally supported option. If trademark registration is not in place, a CMC lets you still benefit from BIMI display in supported clients without going through the trademark process first.
How Email Industries helps with BIMI implementation
Getting BIMI right requires a solid authentication foundation, and that is exactly where we come in. At Email Industries, we help brands build and maintain the complete email authentication stack that BIMI depends on, from DMARC enforcement through to logo validation and certificate guidance. Here is what we bring to the table:
- DMARC policy review and enforcement roadmap to get your domain BIMI-ready
- SPF and DKIM alignment audits to ensure your authentication is solid before you publish a BIMI record
- Guidance on SVG logo preparation and hosting requirements
- Support in understanding VMC and CMC options for your specific situation
- Ongoing deliverability monitoring so your BIMI setup stays healthy over time
Whether you are starting from scratch or troubleshooting a BIMI record that is not displaying correctly, our Deliverability Assurance Packages are designed to cover every layer of your email authentication setup. Take a look at our full range of Services to find the right fit for your team, and feel free to get in contact if you want to talk through where your domain stands today.
Related Articles
- What are the benefits of BIMI for email senders?
- Should you use DMARC quarantine or reject policy first?
- When should you escalate your DMARC policy to full enforcement?
- Is DMARC mandatory now?
- How does SPF protect your email sender reputation?
- What services are included in full service email marketing?
- Can a poorly warmed domain damage your sender reputation?
- How does domain warmup work for email senders?
- Can you run IP warming on a shared IP address?
- What are the signs that your IP warming strategy is working?
- How long does a domain warmup take?
- How do ecommerce email agencies increase online sales?
- How do ecommerce email agencies handle cart abandonment campaigns?
- What A/B testing methods do email agencies use?
- What KPIs do email marketing agencies monitor?
