---

title: "The BIMI Record: DNS TXT Format and Setup Guide"
description: "How to create and publish a valid BIMI DNS record. Includes the correct syntax, required tags, and common configuration errors."
date: "2026-07-01"

The BIMI Record: DNS TXT Format and Setup Guide

Brand Indicators for Message Identification (BIMI) delivers your logo directly to email client inboxes. The mechanism is a DNS TXT record that points to two assets: an SVG logo and, for most major clients, a Verified Mark Certificate (VMC). Getting the record syntax exactly right is the first requirement. Everything else depends on it.

What a BIMI Record Is

A BIMI record is a DNS TXT record published in a specific subdomain under your domain. Email clients query it after a message passes DMARC authentication. If the record is valid and the referenced assets are accessible, the client renders your logo beside the sender name.

The record does not deliver the logo itself. It is a pointer. The logo lives at a publicly reachable HTTPS URL. The certificate, if present, lives at a separate HTTPS URL.

DNS Location and Naming Convention

BIMI records follow a strict naming pattern:

default._bimi.example.com

The default selector is the standard selector name. Custom selectors are possible but rarely necessary. The _bimi label is mandatory. Publishing the record at any other location will cause lookup failures.

For subdomains, the record must be published under each subdomain independently, or you must fall back to the organizational domain. Most senders publish a single default._bimi record at the root domain and rely on the organizational domain fallback defined in the BIMI specification.

Record Syntax

A minimal BIMI record looks like this:

"v=BIMI1; l=https://example.com/logo.svg;"

A complete record with a Verified Mark Certificate:

"v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/logo.pem;"

Required and Optional Tags

| Tag | Required | Description | |-----|----------|-------------| | v | Yes | Version. Must be BIMI1. | | l | Yes* | HTTPS URL pointing to the SVG logo. | | a | No† | HTTPS URL pointing to the VMC .pem file. |

*l is technically required in the record string. However, some clients accept an empty l tag when a is present. †a is optional per the specification but required by Gmail and Apple Mail to display the logo.

Tag order is not enforced by the specification, but v must appear first by convention and is expected first by most parsers.

DMARC Prerequisite

No BIMI record will function without a valid DMARC policy. The DMARC record must meet two conditions:

1. The policy must be p=quarantine or p=reject. A p=none policy is insufficient.
2. The pct tag, if present, must be set to 100.

Subdomain policy (sp=) must also be quarantine or reject if you are attempting to display logos on mail from subdomains.

A conforming DMARC record example:

"v=DMARC1; p=reject; rua=mailto:[email protected];"

Publish this at _dmarc.example.com.

The SVG Logo Requirements

The logo referenced by the l tag must be a Scalable Vector Graphic that conforms to the BIMI SVG Tiny PS profile. This is not standard SVG. It is a constrained subset with specific structural requirements:

• The file must be a square aspect ratio (viewBox with equal width and height values).
• The root element must include specific namespace declarations.
• Raster images embedded inside the SVG are not permitted.
• The file must be served over HTTPS with a Content-Type of image/svg+xml.
• External references inside the SVG are not allowed.

Converting an existing SVG or PNG into a BIMI-compliant SVG Tiny PS file is the most common point of failure. makeBIMI.com converts your logo into the correct format for free. Upload a PNG, JPG, or standard SVG and receive a BIMI-ready file that passes validator checks.

The VMC and the .pem File

A Verified Mark Certificate is issued by a certification authority that has been approved under the BIMI specification. The certificate binds your trademarked logo to your domain. The .pem file referenced in the a tag contains the certificate chain.

The a tag URL must:

• Use HTTPS
• Return a valid PEM-formatted certificate chain
• Remain accessible at all times (email clients fetch it during delivery)

veriBIMI.com handles VMC procurement and issuance. It works with approved certificate authorities and manages the trademark verification process, which is a prerequisite for certificate issuance.

Client-Specific Requirements

Gmail

Gmail requires both l and a tags. A record with only l will not display a logo in Gmail. The VMC must be valid and unexpired. DMARC must be at p=reject or p=quarantine. SPF and DKIM must both pass alignment.

Apple Mail

Apple Mail on iOS 16+ and macOS Ventura+ supports BIMI with VMC. The requirements mirror Gmail: valid a tag, DMARC at enforcement, and a BIMI-compliant SVG. Apple caches the logo aggressively; changes to the SVG may take several days to propagate visually.

Yahoo Mail

Yahoo Mail was an early BIMI adopter. It currently supports logo display without a VMC in some configurations, making it more permissive. However, Yahoo has indicated alignment with the full VMC requirement going forward. Publishing both tags is the correct approach.

Common Configuration Errors

Wrong subdomain. Publishing at bimi.example.com instead of default._bimi.example.com causes a complete lookup failure.

HTTP instead of HTTPS. The l and a URLs must use HTTPS. HTTP URLs are rejected.

Non-compliant SVG. An SVG that is not in the Tiny PS profile will fail validation silently in some clients and display nothing. Use makeBIMI.com to verify compliance before publishing.

Expired VMC. Certificates have a validity period. An expired certificate in the a tag causes logo display to stop. Monitor expiry dates and renew through veriBIMI.com before expiration.

DMARC at p=none. The most common prerequisite failure. Move to p=quarantine with pct=100 first, then to p=reject.

Quoted versus unquoted record strings. DNS TXT records are returned as quoted strings. Most DNS management interfaces handle quoting automatically. If you are entering the record manually, confirm the published value is a single quoted string, not split across multiple strings.

Testing and Validation

After publishing, use a DNS lookup tool to confirm the record is live:

dig TXT default._bimi.example.com +short

The output should return the full BIMI record string. If nothing is returned, the record has not propagated or was published at the wrong location.

Several online validators check both the DNS record and the referenced assets. They will flag SVG compliance issues, unreachable URLs, and DMARC prerequisite failures. Run a full validation before sending production mail.

Summary

A BIMI record is a small DNS TXT entry with significant dependencies. The record itself requires exact syntax. The assets it references must be continuously available and technically compliant. DMARC must be at enforcement. For Gmail and Apple Mail, a VMC is mandatory.

Get the SVG right first. Use makeBIMI.com to produce a spec-compliant file. Then obtain the VMC through veriBIMI.com. Publish the DNS record. Test. Only then will your logo appear consistently across major email clients.

Frequently Asked Questions

What is a BIMI record?

A BIMI record is a DNS TXT record that tells email clients where to find your brand logo SVG file. The record is published at default._bimi.yourdomain.com.

What does a BIMI record look like?

A basic BIMI record looks like: v=BIMI1; l=https://yourdomain.com/logo.svg; The l= tag points to your SVG Tiny P/S compliant logo file.

Do I need a certificate in my BIMI record?

For Yahoo Mail, no certificate is required. For Gmail and Apple Mail, you need to add an a= tag pointing to your VMC or CMC certificate PEM file.