DNS Record Explainer

v=BIMI1
Version tag. Currently the only valid value is BIMI1. Required. Tells receivers this is a BIMI record, not something else.

l=https://example.com/logo.svg
Logo URL. Points to an SVG file that email clients display next to your sender identity in the inbox. Must be HTTPS. The SVG should be square, under 32KB, and follow BIMI SVG profile restrictions (no scripts, external resources, or animations). This is the visual payoff—without it, BIMI does nothing visible.

a=https://example.com/vmc.pem
Authority/VMC (Verified Mark Certificate) URL. Points to a PEM-encoded certificate that cryptographically proves you own the brand. Optional but strongly recommended—without it, many email providers won't display your logo (Gmail requires this). VMC is issued by BIMI-authorized CAs after brand verification. Certificate must be valid and chain to a trusted root.

• BIMI adoption is uneven. Gmail displays logos with VMC. Yahoo/AOL supports it. Outlook doesn't yet (as of late 2024). Apple Mail doesn't. Many corporate filters strip it entirely.

• Missing VMC (the `a=` tag) means your logo likely won't render anywhere. If you've set this up without a VMC, verify that's intentional—most deployments need one.

• SVG validation is strict and often silent. Clients reject SVGs with embedded images, external fonts, or scripting. Test your SVG against the BIMI SVG profile specification before deploying.

• HTTPS certificate on the logo URL must be valid. If it expires or breaks, logos disappear. Monitor it like any other cert.

• BIMI record itself lives in DNS as a TXT record under `default._bimi.yourdomain.com`. Check that the record is published and queryable before troubleshooting logo display.

BIMI is authentication theater for visual branding. It requires valid DMARC, SPF, and DKIM to work—receivers won't trust your logo unless your email auth passes. Without BIMI, senders can't prove brand ownership to clients. With it, phishing becomes slightly harder (attackers can't easily spoof your visual identity), and legitimate mail gets a trust signal. It doesn't block anything; it just makes your logo visible when everything else checks out.