DNS Record Explainer

v=BIMI1
Version tag. Locks the record to BIMI version 1. Required; parsers reject records without it.

l=https://example.com/logo.svg
Logo URL. Points to an SVG file that mail clients display next to your sender name (Gmail, Yahoo, etc.). Must be HTTPS. Clients fetch this on demand, so ensure the endpoint is reliable and returns correct CORS headers if accessed cross-origin. SVG is required; raster formats don't work.

a=https://example.com/vmc.pem
Authority/VMC URL. Points to your Verified Mark Certificate (VMC), a special SSL cert that cryptographically proves you own the brand and logo. Issued by DigiCert or Entrust only. Without it, BIMI has zero enforcement value—logos display only as a courtesy, and spoofing is trivial. The PEM file should contain the full cert chain.

• VMC is missing from your deployment plans or not mentioned—BIMI without VMC is cosmetic only. Attackers can still register similar domains and display the same logo. If you're not obtaining a VMC, document that you're accepting degraded security.

• No fallback or error handling specified. If the logo URL becomes unavailable, clients silently skip display. Monitor uptime.

• SVG parsing varies by mail client. Complex or exotic SVG features may fail silently. Test your actual logo in Gmail, Yahoo, Outlook.

• The `a=` parameter is optional per spec, but omitting it defeats the purpose of BIMI. If you have one, include it.

BIMI tells mail providers where to fetch your brand logo and proof of ownership. Without it, senders are indistinguishable from lookalikes. It requires a valid DMARC policy (p=quarantine or p=reject) and SPF/DKIM alignment; BIMI doesn't work for unauthenticated domains. Clients that don't support BIMI ignore the record entirely—it's a display enhancement, not a security control.