A BIMI TXT record is a short set of instructions in DNS. It identifies the BIMI version and points receivers to your logo and, when used, your certificate evidence.
- The default record is at default._bimi.your-domain.
- l= points to the logo; a= points to certificate evidence.
- The examples here use reserved example.com addresses.
An example, piece by piece
For an illustrative sending domain of example.com:
Host: default._bimi.example.com
Type: TXT
Value: v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/mark.pem;v identifies the record version. l is the logo location (a lowercase letter L). a is the authority evidence location. The files themselves live on an HTTPS server.
Check how your DNS editor handles names
Some DNS consoles want only default._bimi because they add the zone automatically. Others accept the complete name. Preview the final record name before saving to avoid accidentally creating default._bimi.example.com.example.com.
Publish one BIMI TXT record for a given selector and domain. Multiple separate records at the same name can make the assertion ambiguous. DNS editors may split one long TXT value into quoted chunks; that differs from creating duplicate records.
What is a selector?
A selector names a BIMI record. Most deployments begin with default. Advanced deployments can use an explicitly selected record through BIMI-specific message configuration.
A DKIM key selector does not select a BIMI logo. Start with the default approach unless your email platform and target receivers support the advanced behaviour you need.
Records without a certificate
Self-asserted records can omit the a tag or leave its value empty. This only serves receivers that accept self-asserted BIMI. It does not satisfy Gmail’s certificate requirement.
Use the record builder to create a draft. It checks input structure, but it does not query DNS, validate files, or prove that a certificate is trusted.
Verify what is actually published
After saving, query the precise record name with a DNS tool. Check the returned value, open each referenced asset, and verify the domain in a real message’s From field. A screenshot of a DNS editor is not proof that receivers can resolve the new record.
Cached answers can remain until their time-to-live expires. Asset and logo caches are separate, so a DNS update and visible inbox update may happen at different times.
Go to the source
Provider policies and specifications can change. These primary sources informed this guide, reviewed on 1 November 2026.