What is a BIMI record and where does it go?

It's a single TXT record published in DNS at ._bimi. — almost always default._bimi.example.com. The value is v=BIMI1; l= ; a= , and it tells supporting inboxes where to find your logo and the certificate that proves it's yours. There is one BIMI record per selector.

Do I need DMARC before BIMI will work?

Yes, and at an enforcing policy. BIMI is only honoured for domains that publish DMARC at p=quarantine or p=reject applied to all mail — not p=none. It's the non-negotiable prerequisite: a perfect BIMI record on a domain that isn't enforcing DMARC shows nothing. Reach enforcement and confirm clean aggregate reports first.

Why isn't my logo showing even though the record is published?

Usually one of three things: DMARC isn't at an enforcing policy, the SVG isn't a valid Tiny PS file (a plain export won't pass), or there's no VMC and you're checking in Gmail, which requires one. Work down the readiness checklist — it's built around exactly these failure points.

What is a VMC and do I have to have one?

A Verified Mark Certificate is a document issued by an authorised certificate authority that proves you own the registered trademark on your logo. You don't strictly need one to publish BIMI, and Yahoo and Apple Mail may show a self-asserted logo without it — but Gmail requires a VMC to display anything, and Apple Mail needs one for the verification tick. For most senders it's what makes BIMI worth doing.

What's the difference between a VMC and a CMC?

A VMC (Verified Mark Certificate) is issued against a registered trademark. A CMC (Common Mark Certificate) covers eligible marks that aren't registered trademarks — such as some government logos and long-established marks with prior use. Both go in the same a tag and are served as a .pem. If you have a registered trademark, you'll be getting a VMC.

What kind of image file does BIMI need?

An SVG using the SVG Tiny PS (Portable/Secure) profile — a restricted subset of SVG with no scripts, animation or external references. It must have a square viewBox, a solid background, and a title element, and should stay under about 32 KB. Run your logo through a BIMI SVG converter rather than exporting directly; a normal SVG almost never conforms.

What is the BIMI selector?

The selector is the label before ._bimi in the DNS name, which lets a domain publish more than one logo. Almost everyone uses default, giving default._bimi.example.com. You'd only change it if you needed different logos for different sending streams and configured a matching BIMI-Selector header on those sends.

Which inbox providers actually show BIMI logos?

As of 2026, Gmail, Apple Mail, Yahoo and Fastmail display BIMI logos; Gmail and Apple Mail require a VMC to do so. Microsoft Outlook is the notable holdout and shows no BIMI logo regardless of your setup. Support is indicative and changes over time, so treat any single provider's behaviour as something to verify rather than assume.

Does this BIMI builder send my details anywhere?

No. The record is assembled in your browser — the build, the URL validation and the readiness checklist. There is no request, no account and no storage. Close the tab and nothing remains.

← All apps

BIMI Record Builder

Name: Orbit MCP
Availability: InStock

Build the exact _bimi TXT record and check every prerequisite that decides whether your logo shows in the inbox. Runs entirely in your browser.

Your BIMI setup

My domain enforces DMARC (p=quarantine or p=reject)This is the prerequisite. No inbox shows a logo unless DMARC is at an enforcing policy. Not there yet? Build the record with the DMARC builder first.

Domain

Selector

The record is published at <selector>._bimi.<domain>. Almost everyone uses the default selector.

Logo URLl

An https link to your SVG Tiny PS file. Must be square and served as image/svg+xml.

The file is the SVG Tiny PS profile — square viewBox, solid background, a title, no scripts — and under about 32 KB. A plain export from a design tool is not this; convert it first.

Certificate URLa

Optional, but Gmail and Apple Mail need it. An https link to your VMC or CMC .pem bundle.

The record is the easy part. BIMI is mostly prerequisites — enforced DMARC, a conforming SVG, a certificate. The checklist on the right names each one so you publish only when the logo will actually appear.

What each tag means

v: Protocol version. Always `BIMI1`, and it must be the first tag or the record is ignored.
l: The Location of the logo — normally an https URL to your SVG Tiny PS file. An empty `l=` is the spec's way of explicitly declining BIMI for this selector.

What BIMI needs, in plain language

DMARC at an enforcing policy: The non-negotiable prerequisite. Your domain must already publish DMARC at p=quarantine or p=reject, applied to 100% of mail — not p=none. BIMI is a reward for authenticated mail, so no inbox will show a logo for a domain that isn't enforcing. Reach enforcement and sit on clean aggregate reports before you start.
An SVG Tiny PS logo, square: The logo has to be the SVG Tiny Portable/Secure profile — a deliberately restricted subset of SVG. It needs a square (1:1) viewBox, a solid background rather than transparency, a title element naming the brand, and no scripts, animation or external references. A plain export from a design tool will not pass; use a BIMI SVG converter. Keep it small — under roughly 32 KB is the indicative ceiling.
Hosted over HTTPS at a stable URL: Both the logo and the certificate are fetched by inbox providers over HTTPS, so both URLs must be https and resolve reliably. Host them on a domain or CDN you control, and don't move them — the URLs are baked into your DNS record.
A VMC or CMC certificate: A Verified Mark Certificate proves you own the trademark on the logo; a Common Mark Certificate covers eligible non-trademark marks such as some government and long-established logos. Gmail requires one to display the logo at all, and Apple Mail requires one for the verification tick. It's issued by an authorised certificate authority against a registered mark and served as a .pem.
The _bimi TXT record: The DNS record itself: a TXT record at <selector>._bimi.<domain> — usually default._bimi.<domain> — with the value v=BIMI1; l=<logo url>; a=<certificate url>. That's what this tool assembles. Publish it once the four requirements above are genuinely in place.

TXT record

Host / name: <selector>._bimi.<domain>

v=BIMI1; l=<empty>

1 blocker before you publish

Readiness checklist

Blocker: Confirm DMARC is at p=quarantine or reject first
This is the prerequisite, not a nice-to-have. No inbox will show your logo unless the domain publishes DMARC at an enforcing policy — p=quarantine or p=reject, applied to 100% of mail. Get there and read a run of clean aggregate reports before you publish BIMI. Tick the box once it's live.
To do: Enter the domain
The record is published at <selector>._bimi.<domain>. Enter the domain your mail is sent from — the same one your DMARC record is on.
To do: Add the logo URL
The l tag is an https URL to your logo. Host the SVG somewhere stable — your own domain or a CDN you control — and paste the full link.
To do: Logo must be SVG Tiny PS and square
Once you have a logo, it has to be the SVG Tiny PS profile — square, solid background, no scripts — not a plain SVG export. This is the single most common reason a BIMI setup silently shows nothing.
Warning: No VMC — Gmail and Apple won't show the logo
You can publish without a certificate, and Yahoo and Apple Mail may show a self-asserted logo. But Gmail — usually the largest slice of a consumer audience — requires a Verified Mark Certificate before it renders anything, and Apple Mail requires one to show the verification tick. A VMC (registered trademark) or CMC (other eligible marks) is what unlocks the full reach.

Order to do this in

Enforce DMARCp=quarantine → p=reject
Get the domain to an enforcing DMARC policy and let the aggregate reports come back clean. Everything else is wasted effort until this is done.
Make an SVG Tiny PS logoimage/svg+xml, square
Host the logo over HTTPShttps://…/logo.svg
Publish the _bimi recordv=BIMI1; l=…
Add a VMC for Gmail & Applea=https://…/vmc.pem

Indicative sequence from the BIMI Group specification — publish only once DMARC is enforcing and the SVG conforms. BIMI and VMC explained has the full walkthrough.

How to get your logo into the inbox with BIMI — and why the record is the last step, not the first

BIMI puts your brand's logo next to your mail in Gmail, Apple Mail, Yahoo and Fastmail. The TXT record that switches it on takes two minutes to write. The reason most BIMI projects stall is everything that has to be true before that record does anything: enforced DMARC, a very specific flavour of SVG, and a certificate that proves the logo is yours.

BIMI is a reward for authenticated mail, so DMARC comes first

BIMI does not authenticate anything itself. It is the display layer that sits on top of DMARC, and inbox providers only honour it for domains that already enforce DMARC — a policy of p=quarantine or p=reject, applied to all of your mail. Publish a perfect BIMI record on a domain still at p=none and nothing happens, because there is no verified sender identity to attach a logo to.

That is why the order matters. Get DMARC to enforcement, sit on a run of clean aggregate reports so you know your legitimate senders are aligned, and only then start on BIMI. Doing it the other way round is the most common way to spend a week on a logo that never appears.

The logo has to be SVG Tiny PS, and a normal export is not that

BIMI logos are not any SVG. They must use the SVG Tiny Portable/Secure profile — a deliberately restricted subset that strips out scripts, animation, external references and raster embeds, because inbox providers will not render an image format that can carry active content. The file also needs a square (1:1) viewBox, a solid background rather than transparency, and a title element naming the brand.

An export straight from a design tool almost never satisfies all of that. The reliable path is to run your logo through a BIMI SVG converter, then confirm the result opens correctly and stays small — under roughly 32 KB is the indicative ceiling implementers work to. A logo that fails the profile check is the single most common reason a fully published BIMI record silently shows nothing.

The VMC is what Gmail and Apple Mail actually require

You can publish a BIMI record with just the logo and skip the certificate. Yahoo and Apple Mail may show that self-asserted logo, which makes it a useful checkpoint. But Gmail — usually the largest single slice of a consumer list — will not render anything without a Verified Mark Certificate, and Apple Mail needs one to show the verification tick beside your name.

A VMC proves you hold the registered trademark on the logo; a Common Mark Certificate (CMC) covers some eligible non-trademark marks. Either is issued by an authorised certificate authority after they verify the mark, and served as a .pem bundle at an https URL that becomes the a tag in your record. It is the most expensive and slowest part of the project, which is exactly why you confirm the cheaper prerequisites before you start it.

The record itself is three tags at one DNS name

Everything above resolves into a single TXT record published at <selector>._bimi.<domain> — conventionally default._bimi.example.com. Its value is v=BIMI1; l=<logo url>; a=<certificate url>: the version, the https location of the SVG, and the https location of the certificate. That is the whole record, and it is what this builder assembles for you.

The l tag can even be left empty on purpose — l= with no value — as the spec's way of explicitly declining BIMI for a selector, which is occasionally useful for a subdomain you never want to carry a logo. For everyone else, the record is the last thing you publish, once the checklist on this page is clear.

Frequently asked questions

What is a BIMI record and where does it go?: It's a single TXT record published in DNS at <selector>._bimi.<yourdomain> — almost always default._bimi.example.com. The value is v=BIMI1; l=<logo url>; a=<certificate url>, and it tells supporting inboxes where to find your logo and the certificate that proves it's yours. There is one BIMI record per selector.
Do I need DMARC before BIMI will work?: Yes, and at an enforcing policy. BIMI is only honoured for domains that publish DMARC at p=quarantine or p=reject applied to all mail — not p=none. It's the non-negotiable prerequisite: a perfect BIMI record on a domain that isn't enforcing DMARC shows nothing. Reach enforcement and confirm clean aggregate reports first.
Why isn't my logo showing even though the record is published?: Usually one of three things: DMARC isn't at an enforcing policy, the SVG isn't a valid Tiny PS file (a plain export won't pass), or there's no VMC and you're checking in Gmail, which requires one. Work down the readiness checklist — it's built around exactly these failure points.
What is a VMC and do I have to have one?: A Verified Mark Certificate is a document issued by an authorised certificate authority that proves you own the registered trademark on your logo. You don't strictly need one to publish BIMI, and Yahoo and Apple Mail may show a self-asserted logo without it — but Gmail requires a VMC to display anything, and Apple Mail needs one for the verification tick. For most senders it's what makes BIMI worth doing.
What's the difference between a VMC and a CMC?: A VMC (Verified Mark Certificate) is issued against a registered trademark. A CMC (Common Mark Certificate) covers eligible marks that aren't registered trademarks — such as some government logos and long-established marks with prior use. Both go in the same a tag and are served as a .pem. If you have a registered trademark, you'll be getting a VMC.
What kind of image file does BIMI need?: An SVG using the SVG Tiny PS (Portable/Secure) profile — a restricted subset of SVG with no scripts, animation or external references. It must have a square viewBox, a solid background, and a title element, and should stay under about 32 KB. Run your logo through a BIMI SVG converter rather than exporting directly; a normal SVG almost never conforms.
What is the BIMI selector?: The selector is the label before ._bimi in the DNS name, which lets a domain publish more than one logo. Almost everyone uses default, giving default._bimi.example.com. You'd only change it if you needed different logos for different sending streams and configured a matching BIMI-Selector header on those sends.
Which inbox providers actually show BIMI logos?: As of 2026, Gmail, Apple Mail, Yahoo and Fastmail display BIMI logos; Gmail and Apple Mail require a VMC to do so. Microsoft Outlook is the notable holdout and shows no BIMI logo regardless of your setup. Support is indicative and changes over time, so treat any single provider's behaviour as something to verify rather than assume.
Does this BIMI builder send my details anywhere?: No. The record is assembled in your browser — the build, the URL validation and the readiness checklist. There is no request, no account and no storage. Close the tab and nothing remains.

Built into Orbit

Email authentication checks in Orbit

Orbit's deliverability tooling reads a domain's live SPF, DKIM, DMARC and BIMI and flags the gaps before a send — a domain not yet at DMARC enforcement, a missing VMC, an SVG that won't render. Claude can sequence the whole logo-in-the-inbox project and tell you when the record is finally safe to publish.

Orbit web apps