Domain
Logo and certificate
Validate the SVG paste the file source or choose the file — nothing is uploaded
Your record
How it works
DMARC precheck
Reads _dmarc over DNS-over-HTTPS and confirms p is quarantine or reject, pct is 100 and sp is not none. Anything else and receivers never look at the BIMI record.
Validate the SVG
Paste the source or pick the file. The XML is parsed in your browser and checked against the Tiny PS profile — version, baseProfile, title, no scripts or external references, square viewBox, under 32 KB.
Write the record
The l tag points at the HTTPS logo, the optional a tag at the certificate PEM. A declined record (l=;) is also supported for domains that want no logo shown.
Publish and verify
Add the TXT at default._bimi, then run the BIMI checker to confirm the record, the logo fetch and the certificate chain from the outside.
What BIMI is, and what it is not
BIMI puts your logo next to your messages in the inbox, on the condition that the message passed DMARC at an enforcing policy. It is not an authentication mechanism and it does not improve filtering — Gmail's own guidance says so. What it does is make authenticated mail look authenticated, which matters for a brand and matters very little for a cold email sending domain nobody has heard of. I built this because the DMARC prerequisite is the part worth having anyway, and because half the BIMI records I see in the wild point at a PNG, a non-square SVG, or a domain with p=none.
The SVG profile is the real work
Receivers only accept SVG Tiny Portable/Secure — a restricted subset with no scripts, no external references, no animation, no filters, a square viewBox, a title element, and the exact header version="1.2" baseProfile="tiny-ps". No design tool exports that by default. The usual route is: export as plain SVG, flatten text to outlines, remove any embedded raster, then edit the opening tag by hand. The validator here parses the file in your browser and reports each rule separately, so you can fix them one at a time rather than guessing why a receiver silently ignores the logo.
Certificates and who shows what
Yahoo, AOL and Fastmail display a logo from the l tag alone. Gmail and Apple Mail require the a tag to point at a Verified Mark Certificate, which in turn requires a registered trademark on the exact logo, or a Common Mark Certificate, which accepts a logo in continuous use for a year with no trademark. Both are issued by DigiCert or Entrust and cost real money each year. Outlook does not support BIMI in any form. So for most domains the honest expectation is: the record is correct, Yahoo shows the logo, Gmail shows the initial letter until you buy a certificate.
The DMARC precondition catches most domains
The record is only evaluated when the message passes DMARC and the policy is quarantine at 100% or reject, with no sp=none loosening it for subdomains. A domain at p=none with a perfect BIMI record shows nothing, and pct=50 disqualifies it outright. Run the precheck first; if it fails, the DMARC generator and the report parser get you to enforcement safely, and BIMI takes five minutes after that.
Frequently asked questions
Will BIMI help my cold email land in the inbox?
No. It is a display feature for mail that already passes DMARC, not a filtering signal. The DMARC enforcement it requires is worth having; the logo itself is branding.
Do I need a VMC?
Only for Gmail and Apple Mail. Yahoo and Fastmail show the logo from the l tag alone. A VMC needs a registered trademark; a CMC accepts a logo in use for at least a year. Both are paid, annual certificates.
Why does the validator reject a file that opens fine in a browser?
Browsers render full SVG. BIMI requires the Tiny PS subset: version 1.2, baseProfile tiny-ps, a title element, no scripts, images, animation, filters or external references, and a square viewBox. Regular SVGs fail on the header alone.
Can I use a selector other than default?
Only if your outgoing mail carries a BIMI-Selector header naming it, which most sending platforms cannot add. Use default unless you are running your own mail server.
What does a declined record do?
v=BIMI1; l=; tells receivers explicitly that this domain publishes no logo. It is useful for subdomains you send from but do not want to inherit the parent's logo, or for domains that had a logo and withdrew it.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.