# BIMI

BIMI (Brand Indicators for Message Identification) displays your verified brand logo next to your messages in supporting inboxes: Gmail, Yahoo Mail, Apple Mail, and others. It is a visual reward for getting email authentication right. A recipient scanning their inbox sees your logo instead of generic initials, which builds trust, reinforces your brand on every send, and makes spoofed mail easier to spot because the imitation arrives without it.

BIMI is a DNS standard, not a Bird capability: it never appears on the domain resource, and it plays no part in [domain verification](/docs/guides/email/sending-domains). You publish the record yourself at your DNS provider, on a domain you have already verified with Bird, and Bird gives you tools to write and check it. This page covers the prerequisites, the record, the logo format, and the certificate some providers require.

## Prerequisites

BIMI builds on top of email authentication, so everything in [DKIM, SPF & DMARC](/docs/guides/email/dkim-spf-dmarc) comes first:

- **A verified sending domain on Bird.** Your domain's DKIM, return-path, and DMARC records must be published and verified; see [Sending domains](/docs/guides/email/sending-domains) if you have not set one up yet.
- **DMARC at enforcement.** This is the key gotcha: BIMI requires a DMARC policy of `p=quarantine` or `p=reject`, which is **stricter than what Bird's send gate accepts**. Bird only requires that a valid DMARC record exists, and its recommended starting value uses `p=none`, so a domain can be fully verified and sending on Bird while still not qualifying for BIMI. Mailbox providers also evaluate the policy at your organizational domain (the registrable apex, e.g. `example.com`): a `p=quarantine` on a subdomain does not count if the apex policy is `p=none`, and an apex record with `sp=none` weakening subdomain enforcement disqualifies you too.

### Moving DMARC to enforcement

Do not jump from `p=none` to `p=reject` in one step. At enforcement, mail that fails DKIM and SPF alignment gets quarantined or rejected, and that includes any legitimate mail flowing through senders you forgot about (a CRM, a ticketing system, an old newsletter tool). The safe path:

1. Stay on `p=none` and read your aggregate reports (`rua`) for a few weeks to inventory every source sending as your domain. Mail sent through your verified Bird domain passes DKIM with alignment, so it is safe at any policy.
2. Fix or retire unauthenticated sources, then move to `p=quarantine`, optionally ramping with `pct=` (e.g. `pct=25`) to enforce on a fraction of failing mail first.
3. Once the reports are clean at full quarantine, move to `p=reject` if you want the strongest policy. Both `quarantine` and `reject` satisfy BIMI. The [DMARC policy generator](/tools/dmarc-policy) can help you write the record for each stage.

## The BIMI DNS record

BIMI is a single TXT record at the `default._bimi` selector under your domain:

| Type | Host                        | Value                                                                                |
| ---- | --------------------------- | ------------------------------------------------------------------------------------ |
| TXT  | `default._bimi.example.com` | `v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem` |

- `v=BIMI1`: the version tag, always first.
- `l=`: an HTTPS URL to your logo in SVG Tiny PS format (see [Logo requirements](#logo-requirements)).
- `a=`: an HTTPS URL to your Verified Mark Certificate (see [Verified Mark Certificates](#verified-mark-certificates-vmc)). Omit the tag or leave it empty (`a=;`) if you are publishing without a certificate; providers that require one will not show the logo.

Publish it like any other TXT record at your DNS provider, the same place you published your Bird verification records. Like DMARC, the record is looked up at your sending domain first, falling back to the organizational domain, so a single record at the apex covers subdomains that do not declare their own.

Before you publish, check the record: the [BIMI record generator](/tools/bimi) builds and validates it in the browser, and `bird email tools validate-bimi` does the same from the [CLI](/docs/cli), reporting parse errors and warnings such as a non-HTTPS URL.

## Logo requirements

The `l=` URL must point to an SVG in the **SVG Tiny Portable/Secure (SVG Tiny PS)** profile, a locked-down SVG subset that forbids scripts, external references, and animation. A regular SVG export from a design tool is usually rejected until converted; free SVG Tiny PS converters and validators are available from the BIMI Group and certificate authorities. Beyond the profile:

- **Square aspect ratio**, with the logo centered. Clients render it in a circle or rounded square, so keep meaningful content away from the corners.
- **Solid background color**, not transparent; transparency renders unpredictably across clients.
- **Served over HTTPS** from a publicly reachable URL, ideally small (under 32 KB is a common guideline).
- The SVG's `<title>` element should contain your brand name.

## Verified Mark Certificates (VMC)

A VMC is a certificate from a certification authority authorized by the BIMI Group (DigiCert and Entrust are the established issuers) that attests you own the logo, typically by tying it to a registered trademark, though some CAs also offer marks based on prior use. The CA validates your organization and the mark, then issues a `.pem` certificate that embeds the logo itself; you host it at the `a=` URL.

Whether you need one depends on the mailbox provider:

- **Gmail requires a VMC** (or its sibling, the Common Mark Certificate). Without one, Gmail will not display your logo even if your record and DMARC policy are perfect.
- **Yahoo Mail does not require a certificate**, but it does require DMARC enforcement at the organizational domain and applies its own sender-reputation bar; new or low-volume senders may not get the logo immediately even with a valid record.
- Other BIMI-aware clients fall somewhere in between; requiring a VMC is the trend.

If your audience is mostly Gmail, budget for the certificate. It is the larger cost and lead time in a BIMI rollout, since trademark validation takes time. You can publish the record with only `l=` first and add `a=` when the certificate is issued.

## Verifying it works

BIMI never gates anything on Bird, so check it with the audit tooling and a real inbox:

- Run `bird email tools audit example.com` from the [CLI](/docs/cli). It resolves your live DMARC, SPF, DKIM, BIMI, and MX records and returns severity-tagged findings, including whether your DMARC policy qualifies for BIMI.
- Run your domain through a **BIMI inspector** (the BIMI Group and several email-tooling vendors offer free ones). These fetch and validate the SVG and verify the VMC, and tell you exactly which requirement is unmet.
- Send a real message through your Bird domain to a Gmail and a Yahoo mailbox and look for the logo. Allow for propagation and provider-side evaluation: the logo often appears within hours of a correct setup but can take longer, especially on Yahoo where reputation factors in.

If the logo does not appear, the cause is almost always one of: DMARC not at enforcement on the organizational domain, an SVG that fails the Tiny PS profile, a missing VMC on Gmail, or insufficient sending reputation.

## Next steps

- Set up or check your domain's verification records: [Sending domains](/docs/guides/email/sending-domains)
- Understand the authentication records BIMI builds on, including the DMARC policy upgrade: [DKIM, SPF & DMARC](/docs/guides/email/dkim-spf-dmarc)