BIMI Generator

⚙ DNS & authentication

Build a valid BIMI record to display your brand logo next to authenticated mail.

No sign-up required Runs on our own infrastructure Also available via API
Your BIMI record
Host/name: default._bimi.yourdomain.com
Type: TXT
Value: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg

BIMI only displays once your DMARC policy is at enforcement (p=quarantine or p=reject). The logo must be SVG Tiny Portable/Secure over HTTPS; some providers (e.g. Gmail, Apple Mail) also require an accepted VMC or CMC referenced by a=. Validate it afterwards with the BIMI Checker.

Building the BIMI record itself is the easy part — it’s two or three tags in a DNS TXT record. The work is everything that has to be true before that record does anything: DMARC at enforcement, a logo in exactly the right format, and, for most people, a certificate that proves you own the logo. This generator assembles the record for you; the sections below explain what each tag points to and what has to be in place before your logo will show in the inbox.

What the record contains

A BIMI record is published as a TXT record at default._bimi.yourdomain.com and is built from a handful of tags:

  • v=BIMI1 — the version, always first.
  • l= — the HTTPS URL of your logo, as an SVG file. This is the image providers will render.
  • a= — the HTTPS URL of your Verified Mark Certificate (VMC) or Common Mark Certificate. Optional in the spec, but required in practice by Gmail and Apple Mail.

That’s it. Both URLs must be HTTPS, and both files must actually be reachable — a URL that 404s or redirects will quietly break the logo. The default selector covers your whole domain; you can use other selectors for specific streams, but almost everyone wants default.

The prerequisites, in order

  1. Get DMARC to enforcement. Your DMARC policy must be p=quarantine or p=reject, applied to 100% of mail. If you’re still at p=none, publishing BIMI does nothing — spend the time getting to enforcement safely first, watching aggregate reports as you go.
  2. Prepare the logo as SVG Tiny P/S. BIMI requires the SVG Tiny Portable/Secure profile — a restricted SVG with no scripts, no external references, a square viewBox, and a solid background. Design tools rarely export this by default, so validate the file with the BIMI SVG Validator before you host it.
  3. Get a VMC (usually). To show in Gmail and Apple Mail you need a certificate from DigiCert or Entrust. A VMC requires a registered trademark on the logo; a CMC has looser requirements but narrower support. Expect verification to take days to weeks.
  4. Host both files over HTTPS and note the URLs — those go into l= and a=.

Publishing and verifying

Generate the record below, then add it in your DNS as a TXT record with the host/name default._bimi (your DNS provider appends the domain automatically). DNS changes can take up to a day to propagate. Once it’s live, confirm the record parses and the certificate is accepted with the BIMI Checker. Keep in mind that even a perfect record won’t show a logo on messages that fail authentication — BIMI only appears on mail that passes DMARC with alignment, so a broken DKIM signature on a given send means no logo on that message. Our guide to adding a BIMI logo walks through the whole sequence, and the Email Health Check confirms the authentication layer underneath.

Frequently asked questions

Can I set up BIMI without a VMC?
You can publish a record with only l=, and some providers will show the logo. But Gmail and Apple Mail require a VMC in the a= tag, so without one it won’t show in the inboxes that matter most.
What has to be true before BIMI works?
DMARC at enforcement, a logo in SVG Tiny P/S over HTTPS, and (for Gmail/Apple) an accepted VMC. Miss any one and no logo shows.
What name do I use for the DNS record?
Publish a TXT record with the name default._bimi — your provider appends the domain to make default._bimi.yourdomain.com. The value is the string starting with v=BIMI1.
How long until my logo appears after I publish?
DNS can take up to a day, and providers cache on their own schedules, so allow extra time on real mail. Confirm the record with the BIMI Checker, then send a test to Gmail.