DNS Security
BIMI Explained
BIMI (Brand Indicators for Message Identification) helps compatible inboxes display your brand logo next to authenticated messages. It is a trust signal for recipients, not an email encryption feature.
What BIMI does
BIMI publishes a DNS TXT record at default._bimi.yourdomain.tld. The record points to your logo file URL, and optionally a certificate URL when required by mailbox providers. Each mailbox provider sets its own rules: which certificate types it accepts (a Verified Mark Certificate or a Common Mark Certificate), the logo format it requires (SVG Tiny Portable/Secure), and whether it shows logos at all. Those rules change, so check each provider's current requirements.
Required foundation
- Mail passes DMARC with an aligned SPF or DKIM result. Deploy both where you can, since some mailbox providers ask for more, and meet each provider’s own certificate requirements. Publishing a BIMI record does not guarantee the logo is shown.
- DMARC is enforced (commonly p=quarantine or p=reject).
- Logo is valid SVG Tiny P/S and hosted on HTTPS.
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"FAQ
Does BIMI improve message delivery?
Indirectly. Better authentication hygiene helps reputation, but BIMI itself is primarily a display/brand signal.
Does BIMI require VMC?
It depends on the receiver. Some mailbox providers require VMC for logo display.