How to set up BIMI

A BIMI record is a small TXT entry that tells supporting mailbox providers where to find your brand logo, so it can be displayed next to your messages in the inbox. It is the one piece of email authentication that customers actually see. But BIMI is also the most demanding record to get right, because it does almost nothing on its own. It rests on a hard prerequisite: your domain must already be enforcing DMARC at p=quarantine or p=reject before any logo will appear. This guide shows you the exact record to publish, where to add it at every major DNS provider, and the gotchas that stop logos showing even when the record looks perfect.

What BIMI is, and why the record alone is not enough

BIMI stands for Brand Indicators for Message Identification. The record points to a logo file, and for the providers that require it, to a Verified Mark Certificate (VMC) that proves you are entitled to use that logo. When a supporting receiver delivers an authenticated message from your domain, it looks up your BIMI record, fetches the logo, and renders it as the sender avatar.

The thing to understand before you write a single line of DNS is that BIMI is a reward for enforcement, not a substitute for it. A receiver will only show your logo if the message passes DMARC and your domain's DMARC policy is at enforcement. If you are still at p=none, you can publish a flawless BIMI record and nothing will ever display. So the honest order of work is: reach DMARC enforcement first, following our path to enforcement, then publish BIMI. If your domain is not there yet, treat that as step zero, not an afterthought.

The record to publish

A BIMI record is a TXT record on the host default._bimi. The default part is the selector, the BIMI equivalent of a DKIM selector, and default is the one nearly everyone uses. The value names the logo file with l= and, where a certificate is required, the VMC with a=. A complete record looks like this:

v=BIMI1; l=https://yourcompany.com/bimi/logo.svg; a=https://yourcompany.com/bimi/vmc.pem

If you do not yet hold a VMC, you may publish the record with only the logo, which lets logos appear at providers that do not insist on a certificate:

v=BIMI1; l=https://yourcompany.com/bimi/logo.svg;

The DNS fields, plainly:

• Type: TXT
• Host / Name: default._bimi (this becomes default._bimi.yourcompany.com)
• Value: v=BIMI1; l=https://yourcompany.com/bimi/logo.svg; a=https://yourcompany.com/bimi/vmc.pem
• TTL: 3600 (one hour) is fine; use the provider's default if unsure.

Both l= and a= must be HTTPS URLs that resolve publicly, with a valid certificate, and serve the right content type. The logo is an SVG, the VMC is a PEM file. The order of the tags does not matter, but v=BIMI1 must come first. You can build and validate the record with our BIMI record generator before publishing, which saves a round of trial and error.

The logo file: SVG Tiny PS, not just any SVG

This is where most BIMI attempts come unstuck. The logo must be in a specific, restricted profile of SVG called SVG Tiny Portable/Secure (SVG Tiny PS). An ordinary SVG exported from a design tool will almost never pass. The profile forbids scripts, external references, animation, raster images embedded inside the SVG, and many features a normal export includes. It also requires specific attributes, such as a baseProfile="tiny-ps" declaration, a square viewBox, a title element, and a solid background rather than transparency.

Practical points that catch people out: the artwork should be centred and square, because it is displayed in a circle or rounded square and anything off-centre looks wrong; transparency is not allowed, so give it a defined background fill; and the file should be small and clean, with no editor metadata. If you are converting an existing logo, expect to do real work here, not a one-click export. Validate the file against the profile with our generator before you reference it, because a logo that fails the profile will simply not render, usually with no error you can see in the inbox.

The VMC: required for Gmail and Apple

A Verified Mark Certificate is a certificate from an approved authority that confirms your organisation is entitled to display the logo, typically because the logo is a registered trademark. It is referenced by the a= tag and served as a PEM file over HTTPS.

Whether you need one depends on the receiver. Gmail and Apple Mail require a VMC before they will show a logo at all, so for the two mailbox ecosystems most people care about, the certificate is not optional. Some other providers will display a logo from the l= file without a certificate. Because Gmail and Apple are where the visible payoff is, most organisations pursuing BIMI obtain a VMC. It is the slowest and most expensive part of the process: it involves a trademark and an identity validation, takes time, and renews annually. You can confirm a certificate is correctly formatted, in date, and matches your logo and domain with our VMC checker.

Where to add the record

The steps below add the default._bimi TXT record at each major provider. The single most common mistake across all of them is the host field, so read the note under each one carefully. Publishing the logo file and VMC at the HTTPS URLs you reference is a separate task on your web host; this section covers only the DNS record.

Cloudflare

1. Sign in and select your domain, then open DNS → Records.
2. Click Add record and set Type to TXT.
3. In Name, enter default._bimi. Cloudflare appends your domain automatically, so do not type the full default._bimi.yourcompany.com.
4. In Content, paste the full value, for example v=BIMI1; l=https://yourcompany.com/bimi/logo.svg; a=https://yourcompany.com/bimi/vmc.pem.
5. Leave TTL on Auto and save. Cloudflare does not proxy TXT records, so there is no orange-cloud toggle to worry about.

GoDaddy

1. Go to My Products, find your domain, and open DNS (or Manage DNS).
2. Under Records, click Add and choose type TXT.
3. In Name, enter default._bimi only. GoDaddy adds the domain for you, so entering the full hostname produces the wrong record.
4. In Value, paste the BIMI value.
5. Set TTL to one hour and click Save.

Namecheap

1. From the dashboard, select Manage next to your domain, then open Advanced DNS.
2. Under Host Records, click Add New Record and choose TXT Record.
3. In Host, enter default._bimi. Namecheap appends the domain, so do not include it. (Namecheap uses @ for the root, but BIMI is never at the root.)
4. In Value, paste the BIMI value.
5. Leave TTL on Automatic and click the tick to save.

Amazon Route 53

1. Open the Route 53 console, go to Hosted zones, and select your domain's zone.
2. Click Create record.
3. In Record name, enter default._bimi. Route 53 shows your domain suffix beside the field, so type only the prefix; the console fills in the rest.
4. Set Record type to TXT.
5. In Value, paste the BIMI value wrapped in double quotes, for example "v=BIMI1; l=https://yourcompany.com/bimi/logo.svg; a=https://yourcompany.com/bimi/vmc.pem".
6. Set TTL to 3600 and click Create records.

Google Domains / Squarespace

Google Domains has migrated to Squarespace, so domains registered there are now managed in the Squarespace dashboard.

1. Open Domains, select your domain, and go to DNS (or DNS settings).
2. Find Custom records and add a new record of type TXT.
3. In Host (or Name), enter default._bimi without the domain. Use @ only for root records, which BIMI is not.
4. In Value (or Data), paste the BIMI value.
5. Set TTL to one hour and save.

Microsoft 365 / Outlook DNS

For Microsoft 365, your DNS is usually hosted at your registrar rather than at Microsoft, so add the record wherever your domain's nameservers point (often one of the providers above). If your domain is delegated to Azure DNS, do this:

1. In the Azure portal, open the DNS zone for your domain.
2. Click + Record set.
3. In Name, enter default._bimi. Azure appends the zone name, so do not include the domain.
4. Set Type to TXT.
5. Paste the BIMI value and set TTL to 3600, then click OK.

A note on Microsoft specifically: support for displaying BIMI logos across Outlook and Microsoft 365 mailboxes has lagged behind Gmail, Yahoo and Apple. Publishing a correct record does no harm and positions you for support as it rolls out, but do not be surprised if logos appear in Gmail and Apple Mail long before they appear in Outlook.

Common mistakes and gotchas

BIMI has a long list of ways to fail silently, where the record exists but no logo shows and nothing tells you why. The ones that catch almost everyone:

• DMARC is not at enforcement. This is the number one cause. A domain at p=none, or one using pct to enforce on less than 100% of mail, will never show a logo. Confirm you are at p=quarantine or p=reject first.
• The host has the domain appended twice. Entering default._bimi.yourcompany.com in a field that auto-appends the domain creates default._bimi.yourcompany.com.yourcompany.com. Enter only default._bimi at every provider listed above.
• The SVG is not Tiny PS. A standard SVG export will not render. The file must conform to the SVG Tiny PS profile, with a square viewBox, a title, a solid background, and none of the forbidden features. Validate it before publishing.
• No VMC where one is required. Gmail and Apple Mail need the a= certificate. A logo-only record shows nothing in those clients.
• The URLs are not reachable over clean HTTPS. Both l= and a= must resolve publicly with a valid TLS certificate. A logo behind a login, on plain HTTP, or returning the wrong content type will be ignored. Test the exact URLs in a private browser window.
• The logo, VMC and domain do not match. The certificate must be issued for the same logo and the same organisation and domain you are publishing. A mismatch fails validation. The VMC checker catches this.
• Expecting an instant result. Even with everything correct, logos can take time to appear as receivers re-evaluate your domain and your sending reputation. BIMI rewards consistent, authenticated sending, so a brand-new or low-volume domain may wait longer than an established one.

BIMI is the visible end of a long chain, and the record itself is the simplest link. The work is in the three things behind it: a domain that genuinely enforces DMARC, a logo built to the SVG Tiny PS profile, and a certificate that proves the logo is yours. Get those right and the TXT record is a five-minute job. If you would rather not assemble the trademark, certificate, SVG conversion and enforcement work yourself, our done-for-you BIMI setup handles the whole chain, from reaching enforcement to publishing a validated record. Either way, you can sanity-check each piece as you go with our free tools, the BIMI generator and VMC checker, and you can see how the prerequisite fits the wider picture in our guide to reaching enforcement and the requirements overview.