BIMI Record Generator

BIMI (Brand Indicators for Message Identification) lets mailbox providers show your logo next to your mail. The BIMI record is a TXT record that tells them where the logo is and, optionally, where the certificate is that proves the logo is yours. It lives at default._bimi. plus your domain:

v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/certificate.pem

• l= is the https:// address of the logo, an SVG file in the SVG Tiny Portable/Secure (SVG Tiny PS) profile.
• a= is the https:// address of a mark certificate in PEM format: a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC), issued by a certificate authority.

The record alone shows no logo. Receivers display it only for mail that passes DMARC from a domain whose DMARC policy is quarantine or reject, and each provider adds its own conditions, such as a certificate.

This BIMI record generator writes the record in the right tag order, encodes characters that would break it, and checks it by the rules of the BIMI draft (draft 14, May 2026; BIMI is not yet a finished standard): the logo address must be https and point to an SVG file, the certificate address should end in .pem, and the selector must be a valid DNS name. It does not download your logo or certificate; check those after you upload them. With JavaScript off, the button sends the form to our server once to build the record; we do not store what you typed (privacy policy).

The panel above the record is the verdict of the generated BIMI record: a colored icon and a short label. Pass: the record follows the draft; the notes list what else a logo needs. Warning: the record works for some receivers but not all, usually because there is no certificate. Fail: no working record can be built from this input, so none is shown.

The logo address

• The logo address is required. Without it the BIMI draft says no logo may be shown (§7.3), so the generator refuses to write a record without one, unless you opt out below.
• It must be a full https:// address with a domain name, not an IP address and not http://. A user name or password in the address (as in https://user:[email protected]/…) is refused.
• Only SVG is accepted. An address ending in .png, .jpg or another image format makes the whole record invalid, so it is refused. An address that ends in neither .svg nor .svgz gets a warning: make sure the server returns an SVG file.
• The logo must follow the SVG Tiny Portable/Secure profile. That is a note, because the generator does not download the file. Gmail also asks for at least 96 by 96 pixels, given in absolute pixels.
• A comma in an address is written as %2C, because the BIMI draft requires it, and a semicolon as %3B, because it would end the value. An address so long that the record would not fit in a DNS answer is refused.

The mark certificate

Without a certificate address the record gets a warning: Gmail shows BIMI logos only when the record points to a certificate in PEM format, while Yahoo says it does not require one but sets other conditions (see Yahoo). With a VMC, Gmail also shows a checkmark next to the sender. The address must be https:// with a domain name, and it should end in .pem; if it does not, you get a warning.

Google Workspace help (“Set up BIMI”) shows a record with an empty l= and only a certificate, whose PEM file carries the logo. The BIMI draft says a record without a logo address shows no logo, so this generator always writes l=. How Gmail treats the empty form on live mail we have not verified.

DMARC must be enforced

The result always reminds you: receivers show the logo only when your DMARC policy is quarantine or reject, for your domain and its subdomains. Gmail adds that the policy must apply to all mail (no pct below 100). Test mode (t=y) is not enough either: under RFC 9989 it turns quarantine into none, and the pct=0 that goes with it breaks Gmail's rule. Build the policy with the DMARC record generator.

Opting out of BIMI

With Opt out selected the record is v=BIMI1; l=; a=: both addresses empty, which tells receivers not to show a logo for mail using this selector. A logo or certificate address you also typed is left out, with a warning.

The selector

Most domains use the default selector, which is what an empty field gives. A different selector is used only for mail that names it in a BIMI-Selector header, for example to show another logo for one brand. A selector may contain letters, digits, hyphens and dots. A selector and domain that together are longer than a DNS name can be are refused.

Avatar preference

avp=brand asks mail clients to show the brand logo; avp=personal says a personal avatar of the sender may be shown instead. Without the tag, receivers assume brand. The value is case-sensitive; any other value is refused.

The domain name

Enter the domain from the From address of your mail, such as example.com, without https://. International domain names are converted to the ASCII form DNS uses.

1. Enforce DMARC. Your DMARC policy must be quarantine or reject, not in test mode.
2. Prepare the logo as an SVG in the SVG Tiny Portable/Secure profile and put it on an https:// address.
3. Get a mark certificate (VMC or CMC) if you want the logo in Gmail, and put the PEM file on an https:// address.
4. Generate the record above and publish it as a TXT record with the host default._bimi. Replace any record starting with v=BIMI1 that already exists there.
5. Wait. Google says it can take up to 48 hours for the logo to appear in Gmail.

Gmail and Google Workspace

Gmail requires: a DMARC policy of quarantine or reject applied to all mail; a TXT record at default._bimi. plus your domain that points to a PEM certificate (VMC or CMC); and a logo in SVG Tiny PS format of at least 96 by 96 pixels on an https server. Google suggests a TTL of 1 hour for the record. Senders with a VMC get a checkmark next to their name.

Yahoo

Yahoo says it currently does not require a certificate for BIMI logos in Yahoo applications, so a record with only l= meets its record requirement (Gmail needs a certificate in a=). Yahoo still shows the logo only for bulk mail (not personal email), from a domain whose DMARC policy is quarantine or reject, and when it sees enough reputation and engagement for the sending address. If the record includes a VMC, Yahoo uses it when deciding eligibility.

Cloudflare

On the DNS Records page select Add record, type TXT, Name default._bimi, paste the record into Content and select Save.

GoDaddy

In the domain's DNS settings select Add New Record, type TXT, Name default._bimi, paste the record into Value and select Save.

Namecheap

On the Advanced DNS tab select Add New Record, choose TXT Record, Host default._bimi, paste the record into Value and select Save all changes.