# BIMI: brand identity in emails > How BIMI works, its five constituent parts, every DNS record required, Gmail SVG and PEM rules, and how to configure and troubleshoot your inbox logo. [BIMI](https://verifiedinbox.ai/docs/glossary.md#bimi) (Brand Indicators for Message Identification) is the open industry standard that lets Gmail, Apple Mail, Yahoo Mail, Fastmail, and other supporting inboxes display your official company logo next to the emails you send. BIMI is a display signal layered on top of strong email authentication: your logo only appears when a message is cryptographically authenticated and passes [DMARC](https://verifiedinbox.ai/docs/dmarc.md) at enforcement. In Gmail: - With a **[VMC](https://verifiedinbox.ai/docs/glossary.md#vmc)** (Verified Mark Certificate, backed by a registered trademark), Gmail displays your **logo and the [blue verified checkmark](https://verifiedinbox.ai/docs/glossary.md#blue-checkmark)**. - With a **[CMC](https://verifiedinbox.ai/docs/glossary.md#cmc)** (Common Mark Certificate, backed by 12+ months of prior use), Gmail displays your **logo** next to your sender name without the checkmark. ## How BIMI works Inboxes do not take your logo from an email attachment. Instead, every time an email arrives from your [domain](https://verifiedinbox.ai/docs/glossary.md#domain): 1. **Authenticate and align:** The receiving inbox checks that the message passes [SPF](https://verifiedinbox.ai/docs/spf.md) or [DKIM](https://verifiedinbox.ai/docs/dkim.md) aligned with the visible `From:` domain, and that your domain's [DMARC](https://verifiedinbox.ai/docs/dmarc.md) policy is at enforcement (`p=quarantine` at `100%` or `p=reject`). 2. **Look up your BIMI DNS record:** The inbox queries a public [TXT record](https://verifiedinbox.ai/docs/glossary.md#txt-record) at `default._bimi.` (or falls back to your main [organizational domain](https://verifiedinbox.ai/docs/glossary.md#organizational-domain)). 3. **Fetch the logo and certificate:** That record points to two HTTPS URLs: your [SVG Tiny P/S](https://verifiedinbox.ai/docs/glossary.md#svg-tiny-ps) logo file (`l=`) and your mark certificate [PEM](https://verifiedinbox.ai/docs/glossary.md#pem) chain (`a=`). 4. **Verify and display:** The inbox validates the certificate chain, confirms the SVG embedded inside the certificate matches your logo, and renders your logo beside the message. ## The five constituent parts of BIMI Every live BIMI setup relies on five parts working together: 1. **Aligned [SPF](https://verifiedinbox.ai/docs/spf.md) or [DKIM](https://verifiedinbox.ai/docs/dkim.md) authentication:** At least one must pass and [align](https://verifiedinbox.ai/docs/glossary.md#alignment) with the visible `From:` header domain. Aligned DKIM is strongly recommended because it survives forwarding and works even when an email service cannot customize the `Return-Path` domain. 2. **[DMARC](https://verifiedinbox.ai/docs/dmarc.md) at 100% enforcement:** Your organizational domain (and any sending subdomain) must publish `p=quarantine` (with `pct=100` or no `pct` tag) or `p=reject`, and must **not** set `sp=none`. 3. **A compliant [SVG Tiny P/S](https://verifiedinbox.ai/docs/glossary.md#svg-tiny-ps) logo:** A square, self-contained vector file meeting both the BIMI specification and Gmail's strict rendering rules (VerifiedInbox converts and checks your logo automatically; see [Logo requirements](https://verifiedinbox.ai/docs/logo-requirements.md)): - `version="1.2"` and `baseProfile="tiny-ps"` on the `` root element. - Square `viewBox` with **absolute pixel dimensions** of at least `width="96" height="96"` (never relative percentages like `width="100%"`), designed to remain recognizable at 20 to 40 px in both light and dark modes. - A **solid background color** baked into the SVG (inboxes crop the image into a circle or squircle; transparent backgrounds often render poorly in dark mode). - A `` element containing your organization's name (and an optional `` element for accessibility). - File size of **32 KB or smaller**. - **Forbidden elements:** no scripts, no animations or interactive elements, no external links or references, no embedded raster images (PNG/JPG), and no `x=` or `y=` attributes on the root `` element. 4. **A mark certificate ([VMC](https://verifiedinbox.ai/docs/glossary.md#vmc) or [CMC](https://verifiedinbox.ai/docs/glossary.md#cmc)) PEM chain:** Issued by an accredited Mark Verifying Authority (such as DigiCert). The hosted `.pem` file must include the **complete certificate chain** in order: your entity certificate (which cryptographically embeds a copy of your SVG logo), followed by the intermediate CA certificate(s) and root CA certificate. See [VMC vs CMC](https://verifiedinbox.ai/docs/vmc-vs-cmc.md) and [Certificates & renewals](https://verifiedinbox.ai/docs/certificates-and-renewals.md). 5. **The `default._bimi` DNS TXT record and HTTPS hosting:** The public DNS record linking your hosted `.svg` and `.pem` files over HTTPS (TLS 1.2+). ## DNS records required for BIMI In the VerifiedInbox setup wizard, the **DNS** step shows every record your domain needs on one page, with copy buttons and live status checks against your domain's [authoritative nameservers](https://verifiedinbox.ai/docs/glossary.md#authoritative-dns) (so changes appear within seconds rather than hours). Some DNS providers ask for the full host name (`default._bimi.yourdomain.com`), while others only want the prefix (`default._bimi`). The wizard shows both formats for your DNS provider. ### 1. Domain ownership | Field | Value | |---|---| | **Purpose** | Proves you control the domain ([ownership check](https://verifiedinbox.ai/docs/glossary.md#domain-ownership)) | | **Type** | `TXT` | | **Host (name)** | `_verifiedinbox` | | **Example value** | `verifiedinbox-verification=…` (your unique code) | ### 2. Allowed senders (SPF) | Field | Value | |---|---| | **Purpose** | Lists the servers allowed to send email for your domain ([SPF](https://verifiedinbox.ai/docs/spf.md)) | | **Type** | `TXT` | | **Host (name)** | `@` (root domain) | | **Example value** | `v=spf1 include:_spf.google.com ~all` | ### 3. Email signatures (DKIM) | Field | Value | |---|---| | **Purpose** | Publishes the public key used to verify your outgoing email signatures ([DKIM](https://verifiedinbox.ai/docs/dkim.md)) | | **Type** | `TXT` or `CNAME` | | **Host (name)** | `._domainkey` | | **Example value** | Provided by each email service you use | ### 4. Fake email protection (DMARC) | Field | Value | |---|---| | **Purpose** | Instructs inboxes to quarantine or block unauthenticated mail ([DMARC](https://verifiedinbox.ai/docs/dmarc.md)) | | **Type** | `TXT` | | **Host (name)** | `_dmarc` | | **Example value** | `v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com` | ### 5. Inbox logo & certificate (BIMI) | Field | Value | |---|---| | **Purpose** | Points supporting inboxes to your hosted logo and mark certificate ([BIMI](https://verifiedinbox.ai/docs/glossary.md#bimi)) | | **Type** | `TXT` | | **Host (name)** | `default._bimi` | | **Example value** | `v=BIMI1; l=https://bimi.verifiedinbox.ai/yourdomain.com/logo.svg; a=https://bimi.verifiedinbox.ai/yourdomain.com/certificate.pem` | ## How to configure BIMI 1. **Complete your email security and certificate steps.** Once your certificate is issued, VerifiedInbox automatically hosts your approved [SVG Tiny P/S](https://verifiedinbox.ai/docs/glossary.md#svg-tiny-ps) logo and full [PEM](https://verifiedinbox.ai/docs/glossary.md#pem) certificate chain (entity + intermediate + root certificates) at `https://bimi.verifiedinbox.ai` with the required HTTPS headers and MIME types. See [Going live](https://verifiedinbox.ai/docs/hosting.md). 2. **Add the `default._bimi` TXT record** where you manage your domain's DNS (for example Cloudflare, Route 53, GoDaddy, Namecheap, or Squarespace): - **Type:** `TXT` - **Host / Name:** `default._bimi` - **Value:** ```text v=BIMI1; l=https://bimi.verifiedinbox.ai/yourdomain.com/logo.svg; a=https://bimi.verifiedinbox.ai/yourdomain.com/certificate.pem ``` - **TTL:** Default (or 3600 seconds). 3. **Click Check now** in the wizard. We query your authoritative nameservers directly to confirm the record is live and that the hosted files match. ## Technical reference: BIMI tags, selectors & declination ### BIMI DNS record tags A BIMI record is a semicolon-separated list of `tag=value` attributes published as a DNS `TXT` record at `._bimi.` (almost always `default._bimi.`): | Tag | Required? | Meaning | |---|---|---| | `v=BIMI1` | Required (first) | Identifies the TXT record as a BIMI version 1 assertion. | | `l=` | Required | HTTPS URL of your SVG Tiny P/S logo (`Content-Type: image/svg+xml`). Always include `l=` so every BIMI provider (Gmail, Apple Mail, Yahoo, Fastmail) can fetch the SVG. | | `a=` | Required by Gmail & Apple | HTTPS URL of your VMC or CMC certificate PEM chain (authority evidence). | | `avp=brand` \| `personal` | Optional | Avatar Preference hint telling supporting clients whether to prefer the BIMI `brand` logo or a user's `personal` profile photo when both exist. | ### Using BIMI selectors for multiple logos or mail streams By default, every inbox looks up `default._bimi.`. If your company wants to show a different logo for a specific brand or newsletter stream on the same domain: 1. Publish a second BIMI TXT record under a custom selector name, such as `newsletter._bimi.yourcompany.com`. 2. Add the `BIMI-Selector` header to outgoing emails on that stream: ```text BIMI-Selector: v=BIMI1; s=newsletter; ``` ### Excluding a subdomain (BIMI declination) Because subdomains automatically inherit the `default._bimi` record of your main [organizational domain](https://verifiedinbox.ai/docs/glossary.md#organizational-domain), you can explicitly opt a specific subdomain out of showing a BIMI logo by publishing a **declination record** (with empty `l=` and `a=` tags) at `default._bimi.`: ```text v=BIMI1; l=; a=; ``` ## How to troubleshoot BIMI issues If your BIMI record is published but you do not see your logo in the inbox yet: 1. **Send a real test email** using the **Go live** (or **Email security**) step in VerifiedInbox. We inspect the actual `Authentication-Results` header to verify that SPF, DKIM, and DMARC all pass with [alignment](https://verifiedinbox.ai/docs/glossary.md#alignment). 2. **Verify DMARC is at 100% enforcement on both the domain and organizational domain.** Make sure `_dmarc` has `p=quarantine` (without `pct` below `100`) or `p=reject`, and that your organizational domain does not set `sp=none`. 3. **Check the hosted files.** Both the `l=` logo URL and the `a=` certificate URL must be publicly reachable over HTTPS (TLS 1.2+), return status `200`, serve the full certificate chain (entity + intermediate CA certificates), and match the exact SVG embedded in your mark certificate. VerifiedInbox handles and monitors all of this automatically when you use our hosting. 4. **Allow 24 to 48 hours for inbox caching.** After all technical checks pass, Gmail and other mailbox providers cache DNS and certificate lookups for up to 48 hours before showing the logo on new messages. ## Common issues & edge cases - **DMARC policy is still `p=none` or `pct=25`.** Inboxes ignore BIMI unless DMARC is at `p=quarantine` (`pct=100`) or `p=reject`. - **Sending from a subdomain while the main domain has `sp=none`.** Even if `news.yourdomain.com` has its own `p=reject` DMARC record, BIMI evaluators also inspect the [organizational domain](https://verifiedinbox.ai/docs/glossary.md#organizational-domain) (`yourdomain.com`) and reject BIMI if `sp=none` is set there. - **Incomplete PEM certificate chain (missing intermediate CA certificates).** When you receive a VMC or CMC from an issuer, the `.pem` file hosted at `a=` must contain the entity certificate *plus* the intermediate CA certificate(s) in order. Hosting only the leaf certificate causes Gmail and Apple Mail validation to fail. (VerifiedInbox builds and serves the complete chain automatically.) - **Editing the SVG file after the certificate was issued.** A mark certificate embeds a cryptographic copy of your exact SVG Tiny P/S file. If the file at `l=` changes by even one character or whitespace byte, validation fails. To update your logo, request a [reissue](https://verifiedinbox.ai/docs/glossary.md#reissue) so a matching certificate is issued. - **Relative SVG dimensions (`width="100%"`) or `x=`/`y=` attributes on ``.** Gmail requires explicit pixel dimensions of at least `width="96" height="96"` on the `` root element and rejects files that use `100%` or include `x=`/`y=` attributes on ``. - **Self-encoding or hosting blockers (WAF, bot protection, geo-fencing, or wrong MIME type).** If you self-host your SVG or PEM behind a CDN firewall, Cloudflare bot challenge, IP allowlist, geo-block, or `Content-Disposition: attachment` header, mailbox provider crawlers cannot fetch the files. Using VerifiedInbox hosting (`https://bimi.verifiedinbox.ai`) avoids these issues. - **Self-asserted BIMI (`l=` without `a=`) not showing in Gmail or Apple Mail.** Some providers (such as Yahoo Mail) may display a "self-asserted" SVG logo without a certificate on bulk mail from reputable senders, but **Gmail and Apple Mail strictly require a VMC or CMC certificate (`a=`)** before displaying any BIMI logo. - **Testing with a one-off personal email on Yahoo or low-reputation domain.** Each mailbox provider applies its own sender reputation and volume rules. For example, Yahoo only displays BIMI logos on bulk/commercial mail streams, not on personal 1-to-1 messages. - **Smart quotes or line breaks in the TXT value.** Copy and paste the `v=BIMI1; ...` string as a single line of plain text without typographic quotes. ## Frequently asked questions ### Which inboxes support BIMI? Gmail, Apple Mail (iOS 16+, macOS Ventura+, and iCloud Mail), Yahoo Mail, Fastmail, La Poste, Onet Poczta, Zoho Mail, and Zone support BIMI. Gmail and Apple Mail require a mark certificate ([VMC](https://verifiedinbox.ai/docs/glossary.md#vmc) or [CMC](https://verifiedinbox.ai/docs/glossary.md#cmc)); Gmail adds the blue verified checkmark when your certificate is a VMC. ### Do I need both `l=` and `a=` in my BIMI record? Yes. Always include both `l=` (your SVG Tiny P/S logo URL) and `a=` (your VMC or CMC certificate PEM URL). While Gmail can also read the SVG embedded inside the `a=` PEM file, other providers (such as Yahoo and Fastmail) read the SVG directly from `l=`. ### How long is a BIMI mark certificate valid, and does the 47-day TLS rule affect it? BIMI mark certificates (VMC and CMC) are valid for up to **398 days** (about 13 months). The CA/Browser Forum's move toward 47-day lifetimes applies only to browser Web PKI TLS server certificates; BIMI mark certificates are governed separately by the AuthIndicators Working Group and are **not** affected by the 47-day TLS schedule. ### Can my BIMI record be on my domain while the SVG and PEM files are hosted on another domain? Yes. Cross-domain HTTPS hosting (such as hosting your files on `https://bimi.verifiedinbox.ai` while your DNS record lives at `default._bimi.yourdomain.com`) is completely standard and supported by every BIMI mailbox provider. ### Do I need to change my BIMI DNS record when my certificate renews? No. When VerifiedInbox hosts your logo and certificate, your `default._bimi` record points to stable URLs at `https://bimi.verifiedinbox.ai`. When we renew your certificate each year, we update the hosted certificate file in place with zero DNS changes required from you. ### What if my email provider cannot set a custom `Return-Path` for SPF? That is fine for BIMI. BIMI requires [DMARC](https://verifiedinbox.ai/docs/dmarc.md) alignment with the visible `From:` domain, which is satisfied as long as your email provider signs messages with a [DKIM](https://verifiedinbox.ai/docs/dkim.md) key whose `d=` domain aligns with your `From:` domain. ### Does BIMI replace a user's personal profile photo? Mailbox providers decide whether to show a personal contact photo or the BIMI brand logo in a given view, though you can include the optional `avp=brand` or `avp=personal` tag in your BIMI record as a preference hint.