Display a BIMI logo

BIMI (Brand Indicators for Message Identification) lets participating mailbox
providers display an authenticated brand logo beside eligible messages. It is a
final branding layer built on top of strong email authentication, not a shortcut
to better deliverability.

Display is always controlled by the receiving provider. A valid record does not
guarantee that every inbox will show the logo.

Understand the requirements

SPF or DKIM aligns
        +
DMARC is enforced
        +
Compliant SVG is hosted over HTTPS
        +
BIMI TXT record is published
        +
Certificate when the provider requires it
        |
        v
Provider may display the logo

BIMI can involve certificate and trademark costs. Do not describe it as a free
feature simply because publishing the DNS record itself has no fee.

Step 1: Enforce DMARC

The BIMI Group requires DMARC enforcement on the organizational domain and
subdomains. Use p=quarantine or p=reject, an intentional sp= policy, and
full application rather than a partial pct rollout.

Do not jump from an unmonitored domain to enforcement only to enable a logo.
First inventory senders, publish aligned SPF and DKIM, review DMARC reports, and
progress safely as described in Email authentication.

Illustrative policy shape:

_dmarc.example.com.  TXT  "v=DMARC1; p=quarantine; sp=quarantine; pct=100; rua=mailto:[email protected]"

Use a policy appropriate to your observed traffic. Do not copy this example
without reviewing all legitimate senders.

Step 2: Prepare the logo

Create a square logo in the SVG Tiny Portable/Secure profile (SVG Tiny PS).

The file should:

• use baseProfile="tiny-ps" and version="1.2";
• have a square viewBox and explicit pixel dimensions;
• include a descriptive <title>;
• contain vector paths and shapes rather than linked images;
• contain no scripts, animations, external fonts, or external resources;
• remain recognizable when cropped or displayed at a small size;
• use a solid background when transparency reduces recognition.

Minimal structural example:

Google currently requires a minimum width and height of 96 pixels and absolute
pixel dimensions. Your certificate authority may impose additional validation.

Step 3: Decide whether you need a certificate

Gmail requires a Verified Mark Certificate (VMC) or Common Mark
Certificate (CMC) and the associated PEM file for BIMI display.

• A VMC generally verifies a qualifying registered trademark and can produce a
  Gmail verification checkmark.
• A CMC supports eligible marks that do not meet VMC trademark requirements, but
  it does not provide the Gmail checkmark.
• Eligibility, accepted intellectual-property offices, issuers, validation time,
  and pricing can change.

Review the current Google BIMI requirements
and the BIMI Group implementation guide
before purchasing a certificate.

Some providers may accept a standalone SVG without a certificate. That does not
make the setup portable to providers that require a PEM certificate.

Step 4: Host the asset

Host the SVG or certificate PEM on a stable public HTTPS URL that:

• returns 200 OK without authentication, cookies, or redirects that break
  automated retrieval;
• serves the correct content type;
• uses a valid, publicly trusted TLS certificate;
• is not blocked by robots, hotlink, geographic, or user-agent rules;
• remains under your control for as long as the BIMI record references it.

Prefer a domain and hosting path your organization controls. Avoid temporary
file-sharing links and image services that transform SVG content.

Step 5: Save the logo in Smailor

1. Open Settings → Domains → your domain.
2. Open Deliverability.
3. Find Profile image — BIMI.
4. Paste the public HTTPS URL.
5. Save and copy the generated DNS record.

When a certificate is used, make sure the generated or final BIMI value includes
the certificate authority URL in the a= tag as required by the provider.

Step 6: Publish the BIMI record

The default selector is published at default._bimi.<domain>.

Without a certificate, the record shape is:

default._bimi.example.com.  TXT  "v=BIMI1; l=https://assets.example.com/brand/logo.svg;"

With a certificate, the record also includes a=:

default._bimi.example.com.  TXT  "v=BIMI1; l=https://assets.example.com/brand/logo.svg; a=https://assets.example.com/brand/certificate.pem;"

Copy the value generated for your domain. Confirm that your DNS provider did not
append the domain twice or truncate either URL.

Step 7: Validate the complete chain

Check each layer separately:

1. DMARC resolves at the correct organizational domain and is enforced.
2. A real Smailor message passes aligned DKIM or SPF and DMARC.
3. The BIMI TXT record resolves publicly.
4. The SVG URL loads directly over HTTPS and validates as SVG Tiny PS.
5. The certificate URL loads and validates when present.
6. The certificate covers the domain and mark expected by the provider.

Then send from the configured domain to a mailbox at the target provider. Allow
time for DNS and provider caches, and remember that the provider can withhold the
logo based on reputation or internal policy.

Troubleshooting

Maintenance

• Monitor certificate expiry and renew early.
• Keep the SVG and PEM URLs stable during renewal.
• Revalidate BIMI after changing DMARC, DKIM, DNS hosting, TLS, logo artwork, or
  certificate files.
• Remove or update the BIMI record when the hosted asset is retired.
• Test the logo at small sizes and in circular as well as square crops.

Completion checklist

• SPF or DKIM aligns for real Smailor messages.
• DMARC is enforced at full coverage.
• The logo is valid SVG Tiny PS and readable at small sizes.
• The asset is available through stable public HTTPS.
• A VMC or CMC is present when the target provider requires one.
• The BIMI TXT record resolves publicly.
• A validator passes the full chain.
• Provider display expectations are documented as non-guaranteed.

Related guides

• Email authentication
• Publish your DKIM record
• Read delivery statistics