1. Enforce DMARC
Your organisational domain and sending domains need a DMARC policy at enforcement. For broad mailbox compatibility, use p=quarantine or p=reject and apply it to 100% of mail.
- Authenticate every legitimate sending source with aligned SPF or DKIM.
- Move gradually from p=none only after reviewing DMARC reports.
- Protect subdomains with sp=quarantine or sp=reject if they send mail.
2. Prepare the logo
BIMI uses the SVG Tiny Portable/Secure profile. The root SVG element needs version="1.2" and baseProfile="tiny-ps", along with a brand title. Scripts, animation, external resources, and embedded raster images are not allowed.
- Use a square canvas and centre the artwork.
- Prefer a solid background and keep the file below 32 KB.
- Add a useful <desc> element for accessibility.
3. Decide on a mark certificate
A Verified Mark Certificate (VMC) validates a qualifying registered trademark. A Common Mark Certificate (CMC) supports marks that meet the issuer’s requirements without the same trademark path.
- The core BIMI record can be published without a certificate.
- Gmail and several other major providers require a VMC or CMC for display.
- Certificate issuers determine eligibility and supply the PEM evidence document.
4. Publish and test
Publish one TXT record at default._bimi.yourdomain.com. Its value starts with v=BIMI1, includes the HTTPS logo URL in l=, and can include the certificate URL in a=.
- Keep the SVG and certificate available over trusted HTTPS.
- Wait for DNS propagation, then run the OpenBIMI domain checker.
- Test real authenticated mail and remember that each provider applies its own display policy.