Write the default._bimi record for your brand logo and find out first whether your DMARC policy allows a logo at all. Free, no sign-up.
BIMI (Brand Indicators for Message Identification) is a TXT record at default._bimi.example.com that points to your logo. Mailbox providers that support it show that logo next to your messages in the inbox. It is not a security control of its own: a provider only shows the logo for mail that passed DMARC, from a domain whose DMARC policy is quarantine or reject.
That is why the generator checks DMARC before anything else. A BIMI record behind p=none parses perfectly and does nothing.
1. DMARC at quarantine or reject. For the domain and, if subdomains send, for them as well. p=none and a test mode are not enough.
2. A logo in SVG Tiny PS. A restricted SVG profile: square, solid background, no scripts, no external references, no animation. Most design tools do not export it directly; convert the SVG with a dedicated tool and check the result.
3. For Gmail and Apple Mail, a certificate. A Verified Mark Certificate (VMC) requires a registered trademark, a Common Mark Certificate (CMC) proves that the logo has been in use for at least a year. Both are issued by a few certificate authorities and cost money every year. Yahoo and some smaller providers show the logo without a certificate.
4. The BIMI record. v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem. The a= part is left out when you have no certificate.
| Field | Value |
|---|---|
| Type | TXT |
| Name / Host | default._bimi; the panel appends the domain |
| Value | v=BIMI1; l=https://...; a=https://... |
Both addresses must use HTTPS and be reachable without login or redirect to another host. The selector stays at default unless you want different logos for different senders; a sender can then point to another selector with a BIMI-Selector header, but providers always look up default first.
Of the 1,000 highest-ranked .de domains in the Tranco list (list 467YX, read on 19 October 2026), 83 publish a BIMI record. 452 have DMARC at quarantine or reject and would qualify, so most of the domains that meet the precondition do not use it.
Nine of the 83 BIMI records sit behind a DMARC policy of none. Their logo will not appear anywhere, and nothing tells the owners: the record is valid, the logo loads, only the precondition is missing. This is exactly the case the generator reports first.
Mailbox providers accept only one format: SVG in the Tiny Portable/Secure profile. It is a deliberately small subset of SVG, so that a logo can be displayed safely in every inbox.
version="1.2" and baseProfile="tiny-ps".<title> element with the name of the brand is required.Export a regular SVG from your design tool first, then convert it with a Tiny PS converter and validate the result. Host it under a stable HTTPS address on your own domain; the address goes into the l= tag of the record.
| Verified Mark Certificate (VMC) | Common Mark Certificate (CMC) | |
|---|---|---|
| Requires | a registered trademark for the logo | proof that the logo has been in public use for at least a year |
| Shown by Gmail | yes, with a blue checkmark | yes, without checkmark |
| Shown by Apple Mail | yes | no |
| Issued by | a small number of certificate authorities, for a yearly fee | |
The certificate contains the logo itself, so the SVG in the record and the one in the certificate must be identical. The certificate is published as a PEM file, and its HTTPS address goes into the a= tag. Without a certificate, leave a= out; Yahoo and several smaller providers still show the logo.
Receivers look up BIMI for the domain in From. Mail from news.example.com is checked at default._bimi.news.example.com first and falls back to the organisational domain example.com when nothing is found there. One record on the main domain therefore covers subdomains, as long as their DMARC policy is enforced too. A subdomain with sp=none in the parent record shows no logo even when the main domain does.
Not by itself. It shows a logo, and only for mail that already passed DMARC. The security comes from DMARC at quarantine or reject, which BIMI requires; BIMI is the visible reward for getting there.
For Gmail and Apple Mail, yes: they show logos only with a VMC or a CMC. A VMC requires a registered trademark, a CMC a logo that has been in public use for a year. Yahoo and several smaller providers show the logo without any certificate.
The most common reasons are a DMARC policy of none, a logo that is not SVG Tiny PS, a missing certificate at Gmail, or a sender without enough reputation. Providers also decide for themselves; a valid setup is a precondition, not a guarantee.
SVG in the Tiny Portable/Secure profile: square aspect ratio, solid background, a title element, no scripts, no external links, no animation. PNG and JPEG are not accepted.
No. The record is built in the browser. “Load published record” reads the DMARC and BIMI records of the domain and checks whether the logo and certificate addresses respond. Nothing of it is stored.
“Load published record” reads _dmarc and default._bimi of the domain through our resolver. The DMARC result decides the first message: enforced, too weak, or missing. The BIMI validator of the Email Security Check then checks the published record and whether the logo and certificate URLs answer over HTTPS.
The generator writes the record from the URLs you enter and checks their form: HTTPS, .svg for the logo, .pem for the certificate. It does not parse the SVG against the Tiny PS profile and does not validate the certificate chain; for a VMC, the issuing authority does that before it hands the certificate out.