BIMI explained

BIMI (Brand Indicators for Message Identification) is how some inboxes show your logo next to the From name. It is not a fourth authentication protocol. It is a display layer that sits on top of SPF, DKIM, and DMARC.

If DMARC is not enforced, receivers will not look up your logo. If the logo file is the wrong kind of SVG, they will ignore the record. Check the published declaration with the free BIMI checker before you buy a certificate.

What BIMI actually does

A supporting mailbox provider, after DMARC passes at enforcement, fetches a TXT record at default._bimi.yourdomain.com. That record points at a square SVG logo, and optionally at a mark certificate. If those check out, the inbox may show the mark instead of a generic avatar.

It does not improve delivery on its own. It does not replace SPF or DKIM. It only advertises a brand on mail that already authenticated.

The hard prerequisite: DMARC enforcement

BIMI needs DMARC at p=quarantine or p=reject. p=none is monitoring only; providers will not use your logo. Alignment still matters: the visible From domain has to pass SPF or DKIM the DMARC way.

Do not jump to reject just to get a logo. Inventory senders, publish SPF and DKIM, watch reports, then tighten. Confirm the policy with the DMARC checker first.

The DNS record

Publish one TXT record on the default selector:

default._bimi.yourdomain.com TXT "v=BIMI1; l=https://yourdomain.com/bimi.svg; a=https://yourdomain.com/bimi.pem"

• v=BIMI1 is the version.
• l= is an HTTPS URL to the SVG logo. No redirects if you can avoid them.
• a= is the evidence document, usually a PEM for a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). Leave it off only if you are testing self-asserted BIMI, which most Gmail users will not display.

Use the organizational domain you send From, not a random tracking host. Subdomains inherit a default selector only if you publish one there, or if the parent policy allows it. Prefer an explicit record on the sending domain.

The logo file

Receivers expect SVG Tiny Portable/Secure, not a marketing export from Figma. Square canvas, brand mark centered, no scripts, no external images, no text that has to render in a special font. Host it on HTTPS you control. Keep the file small; a bloated SVG is a common reason the check fails.

The checker inspects the default BIMI declaration, then the logo URL and optional certificate URL. That is the same order a mailbox provider uses.

Certificates, briefly

• A VMC is for a registered trademark. Gmail may show a verified check next to the logo.
• A CMC is for a logo that is not a registered mark. Some providers, including Gmail, will still show it.
• Yahoo may display a self-asserted logo on bulk mail without a certificate. Apple Mail and Gmail generally will not.

Buy the certificate after the DNS and SVG already pass. A valid VMC on a p=none domain still shows nothing.

How to use the BIMI checker

Open the ArawaMail BIMI checker and enter the domain that appears after the @ in your visible From address. Use the sending domain, not the website URL and not the hostname serving the SVG.

1. Confirm the checker finds a DMARC policy of p=quarantine or p=reject.
2. Review the discovered default._bimi TXT record and correct any syntax errors.
3. Open the reported l= URL and confirm the SVG is reachable over HTTPS without authentication.
4. If the record includes a=, confirm the VMC or CMC certificate URL is reachable and matches the logo.
5. Run the check again after DNS changes. Cached DNS may take time to expire, so compare the result with your record’s TTL.

A passing checker result confirms that the public records and files can be retrieved. It does not guarantee that every mailbox provider will display the logo; providers also apply reputation, volume, and certificate requirements.

A practical order of work

1. Finish authentication. SPF, DKIM, DMARC at quarantine or reject. See SPF, DKIM, and DMARC explained.
2. Export a square SVG Tiny PS logo and host it on HTTPS.
3. Publish default._bimi with the l= URL.
4. Run the BIMI checker on the sending domain.
5. If you need Gmail or Apple display, add a= with a VMC or CMC and check again.

BIMI is optional. A clean From address and enforced DMARC do more for trust than a logo that never renders. When you are ready to put the mark next to the name, start with the checker, then decide whether a certificate is worth it.