BIMI Generator
Create a BIMI record for your logo and VMC.
Build a BIMI record that points inboxes at your logo and, where you have one, your verified mark certificate. Everything runs in your browser, so nothing is sent anywhere or stored.
This generator builds the DNS TXT record that publishes a BIMI (Brand Indicators for Message Identification) policy for your domain. BIMI lets supporting mailbox providers show your brand logo beside authenticated messages, which both reinforces recognition and rewards a properly configured authentication stack. The record itself is small: a version tag, a link to your logo, and optionally a link to a certificate.
What the record contains
A BIMI record is published at default._bimi.<domain> and starts with v=BIMI1;. The l= tag holds an HTTPS URL to your logo, which must be an SVG Tiny PS file (the SVG Portable/Secure profile). The optional a= tag holds an HTTPS URL to a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) in PEM format. You can publish a logo-only record with an empty a=, but Gmail and Apple Mail require a valid certificate before they will display the logo.
Before BIMI will work
BIMI is not an authentication method in its own right; it sits on top of DMARC. Your domain must already be at enforcement, meaning a DMARC policy of p=quarantine or p=reject applied to the full message flow (no pct below 100). A message must also pass DMARC for the logo to appear. Common reasons a logo never shows include:
- DMARC still at
p=none: fix this by completing enforcement first. - The logo is not valid SVG Tiny PS: re-export it and check the result with the SVG converter.
- No VMC, so Gmail and Apple show nothing despite a valid record.
If you would rather not manage certificates and DNS by hand, our done-for-you service can host the lot.
Frequently asked questions
Where do I publish the BIMI record?
Publish it as a TXT record at the selector host default._bimi.<yourdomain>. The selector default is what most providers query unless a message's BIMI-Selector header points elsewhere.
Do I need a VMC to use BIMI?
Not to publish a record, but in practice yes for the big inboxes. Gmail and Apple Mail only display the logo when the a= tag links to a valid Verified Mark Certificate (or, for some, a Common Mark Certificate). Without one, only a few providers will show the image.
Why must my DMARC policy be at enforcement first?
BIMI deliberately only rewards domains that have committed to blocking spoofing. Providers require a DMARC record with p=quarantine or p=reject covering all mail before they will trust and display your logo. A policy of p=none will not qualify.
What format does the logo have to be?
It must be an SVG in the Tiny Portable/Secure (Tiny PS) profile, served over HTTPS. Square aspect ratio, a solid background and a defined title are expected. PNG or JPEG logos are not accepted.
Can I use a selector other than default?
Yes. You can publish additional records such as brand._bimi.<domain> and have a message reference it via the BIMI-Selector header, which is useful for running different logos per brand or mail stream. Receivers fall back to default when no selector is specified.
How long until my logo appears after publishing?
The DNS record propagates within minutes to a few hours, but inbox display depends on each provider re-evaluating your authentication and certificate, which can take longer. Sending authenticated mail that passes DMARC is what triggers the logo to be shown.