BIMI Email Logos How to Add Them and What They Do

BIMI email logo setup means publishing a DNS TXT record that points to an SVG logo file, and once that record is valid, mailbox providers that support BIMI will display your logo next to your authenticated emails. The protocol is called Brand Indicators for Message Identification, and it works on top of DMARC, so you need DMARC passing before BIMI does anything visible. This guide walks you through the exact steps, the header you will see in your mail client, and the deliverability benefit you actually get.

How BIMI Works Under the Hood

BIMI is a DNS-based assertion. When a mailbox provider receives an email, it checks the sending domain for a _bimi TXT record. That record contains a URL to an SVG file hosted over HTTPS, and optionally a URL to a Verified Mark Certificate (VMC) file. The provider fetches the SVG, verifies it is a valid SVG with a svg root element and no scripts, and then displays it in the message list. The catch is that the provider only does this after DMARC alignment passes. If your DMARC policy is none or if SPF and DKIM do not align, the logo is ignored, even if the BIMI record is perfect.

You do not need a VMC for BIMI to work. Without a VMC, Gmail and Yahoo will not show the logo in most cases, but other providers like Fastmail and Apple Mail will. A VMC is a certificate that proves you own the trademark, and it is optional for the protocol itself. Start without it, test with a provider that does not require one, and add a VMC later if you want wider coverage.

Prerequisites: DMARC Must Pass

Before you touch BIMI, verify that DMARC is working. Run this command to check your current DMARC record:

dig TXT _dmarc.yourdomain.com +short

You should see something like "v=DMARC1; p=quarantine; rua=mailto:[email protected]". The policy can be none, quarantine, or reject, but the record must exist and your email must pass it. To test alignment, send a test email to a mailbox you control and check the raw headers. Look for dmarc=pass in the Authentication-Results header. If you see dmarc=fail, fix SPF and DKIM first. BIMI is a reward for already working authentication, not a fix for broken authentication.

Creating the SVG Logo File

BIMI requires a specific SVG format. It must be square, with a minimum size of 100 by 100 pixels, and it should contain a single <svg> element. The file must not include external references, scripts, or embedded raster images. Most vector editing tools can export this, but you can also write it by hand. Here is a minimal valid example:

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <rect width="100" height="100" fill="#333" />
  <text x="50" y="55" font-family="Arial" font-size="40" fill="#fff" text-anchor="middle">LOGO</text>
</svg>

Save that as logo.svg. The file must be served over HTTPS from a stable URL. Do not put it on a shared CDN with changing query strings. Use a dedicated path like https://yourdomain.com/bimi/logo.svg. The server must return the correct Content-Type header, which is image/svg+xml. You can check that with curl -I https://yourdomain.com/bimi/logo.svg.

Publishing the BIMI DNS Record

Now create the TXT record at the subdomain _bimi.yourdomain.com. The record format is a version tag, a location tag with the SVG URL, and an optional authority tag for the VMC. Here is the exact record:

v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/your-vmc.pem

If you do not have a VMC yet, omit the a= tag entirely. The record must be a single string, not split into multiple quoted parts. Add it through your DNS provider's control panel as a TXT record. After DNS propagates, verify it with:

dig TXT _bimi.yourdomain.com +short

The output should be exactly the record you published. If you see an empty response, wait a few minutes and try again. DNS TTLs can delay visibility, so give it up to an hour before debugging further.

What the Header Looks Like When BIMI Works

Once BIMI is live, mailbox providers that support it will add a BIMI-Selector header to incoming messages. This header tells you which selector was used, and it appears in the raw message source. For example, in Gmail's raw view you might see:

BIMI-Selector: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg;

That header is proof that the provider parsed your DNS record and fetched the logo. If you do not see it after sending a test email, check three things: your DMARC pass status, the SVG file's accessibility over HTTPS, and the DNS record's exact syntax. A common mistake is adding the record at yourdomain.com instead of _bimi.yourdomain.com. Another is using an HTTP URL instead of HTTPS. Both will silently fail.

Deliverability Benefits and Limitations

BIMI does not directly improve your spam score. It is not part of the authentication chain like SPF, DKIM, or DMARC. What it does is create a visual trust signal that can increase engagement rates. When recipients see your logo, they are more likely to open the email and less likely to mark it as spam. Over time, higher engagement can improve your sender reputation, which is an indirect deliverability benefit. But do not expect BIMI to rescue an email that is failing DMARC or that is already in a spam folder. It is a display layer, not a deliverability fix.

Another limitation is that BIMI is not universal. Some providers ignore it entirely, and others require a VMC before they will show any logo. You cannot control which provider your recipients use, so the practical approach is to publish the record, validate it with a tool like the one your DNS provider offers, and then test with a few mailboxes you control. The protocol is young, and support changes over time.

Testing and Debugging Your Setup

Do not guess whether your record works. Use a Unix command line to test every component. First, check the DNS record. Second, fetch the SVG and verify the content type. Third, send a test email to a Gmail address and inspect the raw headers. Here is a single shell command that checks both DNS and the SVG URL:

dig TXT _bimi.yourdomain.com +short | grep -o 'https://[^;]*' | xargs curl -I

That pipeline extracts the URL from the DNS record and prints the HTTP response headers. You want to see HTTP/2 200 and Content-Type: image/svg+xml. If you get a 404 or a wrong content type, fix the file hosting before touching anything else.

Next Steps After You Publish

After your BIMI record is live and your SVG is served correctly, send test emails from your primary sending domain to accounts on Gmail, Yahoo, and Apple Mail. Check the raw headers for a BIMI-Selector line and look at the message list for your logo. If you want broader coverage, apply for a VMC from a trademark verification authority, but that is a separate process. Also monitor your DMARC reports for a few weeks. If you see a rise in failed DMARC checks, fix that first, because BIMI will not compensate for it. Keep the SVG file small, under 32 kilobytes, and never change the URL once you publish it, because changing the URL breaks the cached logo for recipients who already received your mail.