DNS Record Explainer

v=BIMI1
Version tag. Tells receivers this is BIMI v1. Required, must be first.

l=https://example.com/logo.svg
Logo URL. Points to your SVG brand mark. Receivers fetch and display this in email clients that support BIMI (Gmail, Yahoo, etc). Must be HTTPS, SVG format strongly preferred. This is what users see next to your sender name.

a=https://example.com/vmc.pem
VMC (Verified Mark Certificate) URL. Points to your PEM-encoded certificate proving brand ownership. Required for authenticated BIMI (the "verified" checkmark). Without this, BIMI degrades to unverified logo display only. Certificate must be issued by an authorized VMC provider (DigiCert, Entrust, etc).

• VMC URL points to .pem file—confirm that endpoint actually serves PEM format with correct Content-Type (application/pkix-cert or application/x-pem-file). Many setups break here.
• Logo SVG must be under 32 KB and comply with BIMI's SVG subset restrictions (no scripts, external resources, animations). Oversized or invalid SVGs are silently rejected by clients.
• Both URLs must be on domains you control and resolve consistently. CDN/caching issues can cause logo fetch failures.
• Verify your DMARC policy is set to p=quarantine or p=reject for BIMI to work—permissive DMARC defeats the whole point.
• Test with Gmail's tooling and Yahoo's validator before considering deployment complete.

BIMI is published as a DNS TXT record on your sending domain (_bimi selector) and only activates when your DMARC authentication passes. It's purely cosmetic—doesn't affect deliverability—but VMC-backed BIMI improves brand trust and reduces phishing risk perception. Without the VMC URL, you get no checkmark, just the logo. Many senders skip VMC entirely and lose 90% of BIMI's value.