Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

BIMI

Brand Indicators for Message Identification: a DNS record pointing at a logo and, for most providers, a verified mark certificate, so that participating mailbox providers display the logo beside authenticated mail. Currently an Internet-Draft, not an RFC.

Sumit Raj · reviewed

Brand Indicators for Message Identification. The record that puts your logo beside your mail in an inbox.

BIMI is still an Internet-Draft rather than an RFC, which is worth knowing when a tool cites an RFC number for it.

It requires DMARC at quarantine or reject first. Below enforcement the record is ignored entirely, whatever else is correct.

The record itself is a TXT entry at default._bimi.<domain> carrying up to two URLs: l= for the logo and a= for a Verified Mark Certificate. The logo must be SVG in the Tiny 1.2 Portable/Secure profile, square, and titled. Most providers require the certificate.

The certificate is the part that catches people, because it expires. A BIMI setup that worked last year can be silently dead today, and a checker that only reads the DNS record will still report it as valid.

Related

  • DMARCDomain-based Message Authentication, Reporting and Conformance: a DNS record that requires SPF or DKIM to pass for the visible From domain, and instructs receivers what to do when neither does. Defined in RFC 9989.
  • p=rejectThe DMARC policy instructing receivers to refuse messages that fail authentication for the From domain, rather than delivering or quarantining them. Defined in RFC 9989 section 4.7.
  • BIMI TestLogo, certificate, and the DMARC enforcement BIMI depends on.

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.