BIMI logo check

From a DNS record to the avatar slot

BIMI stands for Brand Indicators for Message Identification. When a message arrives, the mailbox provider first makes sure it passes DMARC. Only then does it look up a TXT record at default._bimi under the domain of the From address:

default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

l= is the address of the logo and a= the address of a certificate proving the logo is yours. The provider downloads both, validates them and stores the image. Nothing gets embedded in your messages. The image always comes from the address in the record.

The four things this check verifies

The record

We look for it at the domain you enter, then at the registered domain above it. A record with empty l= and a= is a deliberate opt-out, and we report it as one.

DMARC

The policy has to be p=quarantine or p=reject, with no pct below 100. For a subdomain, the parent domain can’t be at p=none either.

The logo

We download the file over HTTPS and inspect its markup against the list below. You get a preview in a circle and in a rounded square, the two shapes mail apps crop to.

The certificate

If a= is filled in, we read the PEM file: type (VMC or CMC), holder, issuer, dates and the domains it names. Less than 30 days of validity left is a warning.

A missing certificate doesn’t lower the verdict, because the standard makes the certificate optional. A certificate that’s published but expired, of the wrong kind or issued for another domain does.

Why your normal SVG gets rejected

BIMI accepts one restricted flavor of SVG, called Tiny PS (Portable/Secure), because providers refuse to run or load anything a logo file asks for. The check fails a file when any of these is true:

• the <svg> tag lacks baseProfile="tiny-ps" or version="1.2";
• the <svg> tag carries an x or y attribute;
• there is no <title> element with text (use the brand name);
• it contains a script, an event attribute such as onclick, an <image> or a <foreignObject>;
• a link points outside the file, which includes web fonts and linked bitmaps;
• the viewBox is absent or not square;
• the file is larger than 32 KB.

A valid file opens like this:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 400 400">
  <title>Example Inc.</title>
  …
</svg>

Design tools don’t export this profile, so there’s some handwork. Convert all text to outlines, remove embedded bitmaps, save as plain SVG, then edit the opening tag by hand or with the free converter published by the BIMI Group. Use a solid background and leave a margin, since the corners get cut off.

When you need the certificate

For a Verified Mark Certificate, the logo has to be registered as a trademark with a recognized office such as the USPTO, EUIPO or UKIPO. For a Common Mark Certificate, you need proof that the logo has been in public use for at least a year. Certificate authorities such as DigiCert, GlobalSign and SSL.com sell both, and both are renewed every year.