BIMI without a certificate.

Brand Indicators for Message Identification (BIMI) has a reputation for being expensive. That reputation is partially deserved — a Verified Mark Certificate (VMC) from a Certificate Authority costs hundreds of dollars per year. However, a VMC is not required to display your logo in supported email clients.

Self-asserted BIMI works today, for free, in Yahoo Mail and AOL Mail — two platforms that together account for hundreds of millions of active inboxes. If your organisation is not yet ready to invest in a VMC, self-asserted BIMI is the correct starting point.

This article explains exactly what self-asserted BIMI is, which clients support it, and how to deploy it end-to-end at no cost.

What is self-asserted BIMI?

BIMI operates in two modes:

| Mode | Certificate Required | Supported Clients | |---|---|---| | Self-asserted | No | Yahoo Mail, AOL Mail | | VMC-backed | Yes (VMC from DigiCert or Entrust) | Gmail, Apple Mail (iOS 16+), Yahoo Mail, AOL Mail, Fastmail |

In self-asserted mode, you publish a BIMI DNS record pointing to your SVG logo file. No certificate authority validates your brand ownership. The receiving mail server checks that your domain passes DMARC at enforcement level, then retrieves and displays your logo.

The trade-off is reach, not functionality. Your logo renders correctly in Yahoo Mail and AOL Mail without any certificate. Gmail and Apple Mail require a VMC before they will display the logo. If your audience is primarily on Yahoo or AOL, or if you want to establish your BIMI infrastructure before purchasing a VMC, self-asserted deployment is the right approach.

Prerequisites

Before you create a BIMI record, your domain must satisfy the following requirements. These are enforced by receiving mail servers, not by any BIMI tool.

1. DMARC at enforcement

Your domain must have a DMARC policy of p=quarantine or p=reject. A policy of p=none will cause BIMI to be ignored entirely.

Minimum acceptable DMARC record:

v=DMARC1; p=quarantine; adkim=s; aspf=s;

Recommended DMARC record for BIMI:

v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:[email protected];

Important: p=reject is the strongest signal to receiving servers that your domain is fully authenticated. Yahoo Mail's BIMI implementation accepts p=quarantine, but p=reject is the industry-standard recommendation and is required by Gmail when you later add a VMC.

To verify your current DMARC record, query DNS directly:

dig TXT _dmarc.yourdomain.com

2. SPF and DKIM alignment

DMARC enforcement depends on SPF and DKIM passing in aligned mode. Confirm that:

• Your sending infrastructure is covered by your SPF record.
• DKIM signatures are applied to outbound mail and the d= domain aligns with your From: header domain.
• Your DMARC reports show a pass rate close to 100% before proceeding.

Deploying BIMI on a domain with significant DMARC failures will not produce consistent logo display.

3. An SVG Tiny P/S logo file

BIMI requires a specific SVG profile called SVG Tiny Portable/Secure (SVG Tiny P/S). A standard SVG exported from Adobe Illustrator, Figma, or Inkscape will not work without modification. The SVG Tiny P/S specification prohibits:

• External references and linked resources
• Scripts and interactive elements
• Raster image embeds ( elements)
• Certain filter effects and animations

The logo must also be:

• Square aspect ratio (1:1)
• Hosted at a publicly accessible HTTPS URL
• Served with the correct MIME type (image/svg+xml)

Step-by-step deployment

Step 1 — Prepare your DMARC record

If your domain does not already have p=quarantine or p=reject, update your DMARC record now. Allow 24–48 hours for DNS propagation before proceeding.

Do not rush this step. Publishing a BIMI record before DMARC is at enforcement will produce no logo display and no error — the record will simply be ignored.

Step 2 — Generate a compliant SVG Tiny P/S file

This is the step where most deployments fail. Converting a logo to SVG Tiny P/S manually requires editing raw XML and validating against the W3C specification. Errors are not always obvious.

Use makeBIMI.com to generate a compliant SVG Tiny P/S file for free. Upload your existing logo (PNG, SVG, or other format), and makeBIMI converts it to a specification-compliant SVG Tiny P/S file ready for BIMI deployment. No account required.

Step 3 — Host the SVG file

Upload your SVG Tiny P/S file to a web server or CDN. The file must be:

1. Accessible over HTTPS (not HTTP).
2. Served from a stable, permanent URL. Changing the URL later requires a DNS record update.
3. Publicly accessible without authentication or redirects.

Example hosted URL:

https://bimi.yourdomain.com/logo.svg

Verify the file is accessible and returns the correct content type:

curl -I https://bimi.yourdomain.com/logo.svg

The response should include:

Content-Type: image/svg+xml

Step 4 — Create the BIMI DNS TXT record

BIMI records are published as DNS TXT records at a specific subdomain. The format is:

default._bimi.yourdomain.com

Record format:

v=BIMI1; l=https://bimi.yourdomain.com/logo.svg;

For self-asserted BIMI (no certificate), the a= authority evidence tag is omitted entirely or left empty. Do not include a placeholder value.

DNS record summary:

| Field | Value | |---|---| | Type | TXT | | Name / Host | default._bimi | | Value | v=BIMI1; l=https://bimi.yourdomain.com/logo.svg; | | TTL | 3600 (or your registrar's default) |

Note: makeBIMI.com generates the correctly formatted DNS TXT record value alongside the SVG file. Copy it directly into your DNS provider's control panel.

Step 5 — Verify the deployment

After DNS propagates (typically 1–24 hours), verify your BIMI record resolves correctly:

dig TXT default._bimi.yourdomain.com

Expected output includes your record value:

default._bimi.yourdomain.com. 3600 IN TXT "v=BIMI1; l=https://bimi.yourdomain.com/logo.svg;"

Send a test email from your domain to a Yahoo Mail address and confirm the logo appears in the sender avatar position.

Common deployment errors

| Symptom | Likely cause | |---|---| | Logo does not appear in Yahoo Mail | DMARC is p=none, or SVG file is not SVG Tiny P/S compliant | | DNS record resolves but logo is blank | SVG hosted over HTTP, not HTTPS; or incorrect MIME type | | Logo appears distorted or cropped | SVG viewBox is not square