BIMI Requirements

Start with the domain people see in the From address. List every service that sends for it, including employee email, marketing, billing and product notifications. Identify who can change its DNS.

• SPF lists permitted senders for the envelope-sender domain. Check the correct domain, record syntax and DNS lookup limit.
• DKIM signs messages with a domain identity. Publish the correct key and selector, and confirm the sending service actually signs its messages.
• Alignment connects a passing SPF or DKIM identity to the visible From domain. A DMARC pass needs at least one passing, aligned mechanism. Configure both SPF and DKIM where possible and follow your mailbox providers’ sender rules.

A monitoring-only policy (p=none) is not enough for BIMI. The relevant organisational domain and sending subdomains need enforcement.

• Use p=quarantine or p=reject.
• Apply the policy fully. Published BIMI guidance does not accept pct values below 100; Google specifies pct=100.
• Review subdomain inheritance and explicit policies. An sp=none exception or a subdomain’s own monitoring policy can leave a gap.

Before tightening policy, fix legitimate senders and review DMARC reports. Changing the policy does not repair broken authentication.

A normal SVG, PNG or JPEG is not automatically BIMI-compatible. Use artwork you have the right to use and validate the final SVG Tiny Portable/Secure file.

• The SVG uses version="1.2", baseProfile="tiny-ps" and a <title> element.
• Remove scripts, animation, external image references and root-level x/y attributes.
• For compatibility, use a centred square design, a solid background and a file no larger than 32 KB. Include a description for accessibility.

For Gmail: specify absolute pixel dimensions of at least 96 × 96. Check the receiver’s additional requirements and inspect circular as well as square crops.

Gmail requires an accepted VMC or CMC. Its verification checkmark is associated with a VMC. Yahoo does not require a VMC, but applies its own reputation, engagement and bulk-mail criteria.

• A VMC generally uses an eligible registered trademark or qualifying government mark.
• A CMC can use eligible prior-use or modified registered marks. The CA decides whether your evidence meets its criteria.
• Prepare organisation details, domain-control evidence and logo-rights evidence. Confirm domain coverage, issuer acceptance and renewal terms before applying.

Where a certificate is required, it must be issued, valid and appropriate for the domain and logo. A submitted application or a successful logo conversion is not a certificate.

Host the required SVG and/or issuer-provided PEM file at stable public HTTPS URLs, following your issuer and target provider’s instructions. A PEM-based flow can contain the logo inside the certificate package.

• Use a valid TLS certificate and a complete, trusted server certificate chain.
• Serve the actual file without a login, expiring link, access restriction or bot challenge.
• For mark certificates, publish the public PEM chain in the order your issuer requires. Keep the hosted artwork consistent with the issued certificate.

Open each exact URL without signing in. Then use a checker against the published BIMI record to inspect the linked assets.

For the default selector, publish at default._bimi.yourdomain.example. Use your actual sending domain and check how your DNS provider handles the hostname.

• v=BIMI1 identifies the record version.
• l= points to the SVG when using a standalone logo URL.
• a= points to the certificate PEM where required. Some certificate-based flows use an empty l=; follow the receiver and issuer instructions.

Use one record at the selected hostname, avoid duplicated domain suffixes, and query public DNS after saving. A certificate-free assertion only works with receivers that accept it.

Technical readiness makes BIMI possible; the receiving provider still decides whether to show a logo. Test the providers and apps your audience uses with mail from each sending service.

• Check the message’s authentication results alongside its visible logo.
• Account for provider-specific eligibility. Yahoo, for example, considers bulk sending, reputation and engagement.
• Allow for DNS and asset caching, then recheck. Set owners for certificate renewals, hosting, DNS and logo changes.

A domain checker sees published configuration. It cannot guarantee logo display, inbox placement or the authentication result of every message.