# BIMI

Canonical: https://inetgeek.com/dns/bimi/

BIMI lets a domain publish a logo that participating mailbox providers may display beside authenticated mail. It requires DMARC enforcement first.

## What BIMI is

BIMI — Brand Indicators for Message Identification — is a TXT record at default._bimi.example.com pointing at a logo file, and optionally at a certificate attesting that the logo belongs to you.
Participating mailbox providers may display that logo next to messages from the domain. Whether they do, and where, is entirely their decision.

## What a BIMI record looks like

The record itself is a version tag and two URLs: default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem".
The l tag points at the logo and the a tag at the certificate asserting the right to use it. A record may publish l alone, though mailbox providers differ on what they will display without the assertion.
BIMI is specified in an IETF draft rather than a published standard, so what a given mailbox provider requires is closer to a vendor behaviour than a settled rule.

## DMARC enforcement is a prerequisite

BIMI only applies to mail that passes DMARC, and the domain must publish an enforcing DMARC policy — quarantine or reject, not none.
This ordering is the point: the logo is a reward for authenticated mail, not a decoration that can be attached to anything.

(Interactive explainer on the canonical page — nothing to check live, this is reference text.)

## The logo and the certificate

The logo must be SVG in a restricted profile: square, with no scripting or external references. Ordinary SVG exported from a design tool will usually be rejected.
Several providers additionally require a Verified Mark Certificate, issued by a certificate authority after checking that you hold a trademark on the logo. That is a commercial process with real cost and lead time.

## Related records

- [DMARC](https://inetgeek.com/dns/dmarc/): Tells receivers what to do when SPF and DKIM fail.
- [SPF](https://inetgeek.com/dns/spf/): Declares which servers may send mail using your domain.
- [DKIM](https://inetgeek.com/dns/dkim/): Signs outgoing mail with a key published in DNS.