How to set up BIMI: logo, record and mark certificate

BIMI lets supporting mailbox providers show your logo next to authenticated mail. It builds on DMARC: without DMARC at enforcement it does nothing.

1. Get DMARC to enforcement

Your DMARC policy must be p=quarantine or p=reject (see the DMARC guide).

2. Prepare the logo

A square SVG in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, served over HTTPS. Ordinary SVG exports usually need converting; the BIMI Group publishes the requirements and tools.

3. Get a mark certificate (where required)

Which providers show the logo, and whether they need a certificate, differs by provider. Gmail requires one:

VMC (Verified Mark Certificate): for a registered trademark.
CMC (Common Mark Certificate): for a logo you can show you have used publicly, without a trademark.

They are issued by Mark Verifying Authorities; the BIMI Group lists the current ones (at the time of writing DigiCert, GlobalSign and SSL.com). Serve the certificate as a PEM file over HTTPS on port 443, containing the full chain: your certificate first, then the intermediate.

4. Publish the record

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Leave a= out if you have no certificate. Check it with dig +short TXT default._bimi.example.com.

Check your domain. The DomainRef check grades BIMI (the record, DMARC enforcement, and the mark certificate's type, issuer, expiry, domain and chain to a known Mark Verifying Authority root) with the other mail and domain records in one call, and returns the exact record or step that fixes each problem: GET /v1/domain/check?domain=example.com, $0.01 per domain over x402.