BIMI Record: Step by Step, With the Failure Modes

A BIMI record is two lines of DNS and about four weeks of prerequisites. The record itself takes ten minutes. Getting to the point where publishing it does anything requires DMARC at enforcement, a logo redrawn to a restricted graphics profile, and for most mailbox providers a certificate that costs real money and requires a registered trademark.

That order matters, because a BIMI record published before the prerequisites are met is valid, resolvable and completely inert. Nothing tells you. The logo simply does not appear.

What the record contains

BIMI publishes a TXT record at a selector in front of _bimi on your domain. Google's setup documentation uses default._bimi.solarmora.com as its worked example, so for acme.com with the default selector the hostname is default._bimi.acme.com.

The record itself carries two tags. l= points at the logo, and a= points at the certificate that vouches for it. Google's documentation gives both shapes: with a certificate, v=BIMI1;l=;a=https://images.solarmora.com/brand/certificate.pem, and with a self-asserted logo alone, v=BIMI1;l=https://images.solarmora.com/brand/bimi-logo.svg.

Both URLs have to be served over HTTPS from somewhere that will still be there in a year. A logo hosted on a marketing site that gets rebuilt is a BIMI record that silently stops working.

Google's own page flags a detail that sounds trivial and is not: in BIMI record syntax, "the number 1, the uppercase letter i (I), and the lowercase letter L (l) appear similar". The l= tag is a lowercase L. Records get typed with a 1 and fail with no useful error.

The two shapes are not interchangeable, and which one you publish decides who can see the result.

Self-assertedv=BIMI1;l=<svg url>

• Points at a logo you host and vouch for yourself
• No certificate, so no trademark requirement and no annual cost
• Honoured by a narrower set of receivers
• A reasonable first publish while a certificate is in progress

Certificate-backedv=BIMI1;l=;a=<pem url>

• The a= tag points at a Verified Mark Certificate
• Issued against a trademark the organisation holds
• Required by the receivers that check for one
• Note the l= tag can be present and empty in this shape

That empty l= in the certificate form catches people, because a blank tag reads like an omission. The certificate references the mark, so the logo travels with it rather than needing its own URL, and Google's example record publishes exactly that.

The prerequisites, in the order they block you

What BIMI is for, and why the gate exists at all, is covered in the BIMI definition. What follows is only the part that blocks a record from doing anything, in the order you will hit it.

DMARC at enforcement. The BIMI Group's own implementation checklist requires that "The message passes DMARC validation checks" and that "The policies for the RFC5322.From domain and the Organizational Domain (if different) are set to either quarantine with a pct of 100 or reject". Sitting at p=none disqualifies you no matter what else is in place, and the DMARC policy not enabled page covers what moving off it involves.

One wrinkle worth knowing before you read that requirement literally. It is written in terms of the pct tag, and RFC 9989, which obsoleted RFC 7489 in May 2026, lists pct as historic. A modern record at p=quarantine with no pct tag at all is the current expression of the same intent, since the tag's default was always 100. Guidance across this ecosystem still assumes the older tag, and the DMARC record tag by tag covers what replaced it.

A logo in the right format. The BIMI Group states that the logo "must be square, must be saved as a version of the Scaled Vector Graphic (SVG) format" and specifically "must follow the restrictions defined by the SVG Tiny Portable/Secure profile". It "cannot include any script tags, should not include any external links, and requires a few manual tweaks to meet size and security requirements". An SVG exported from a design tool will not satisfy this without work.

A certificate, for most providers. The record's a= tag points at a Verified Mark Certificate, which the BIMI Group describes as required "for those receivers that require it". A VMC is issued against a trademark you own, which puts it out of reach for a brand that has not registered one, and it is the step with a recurring cost attached.

BIMI readiness, before the DNS edit

• ✓Yes: DMARC is at quarantine or reject on the From domain and the organizational domain
• ✓Yes: Real mail is passing DMARC, confirmed from aggregate reports rather than assumed
• ✓Yes: The logo is square and conforms to the SVG Tiny Portable/Secure profile
• ✓Yes: Logo and certificate are served over HTTPS from a durable location
• ✓Yes: You own a registered trademark, if you need a certificate
• ✕No: The record is published and you are waiting to see what happens

A note on the selector, since it is the one piece of the hostname you can change. default is the conventional value and the one receivers assume when a message carries no BIMI selector header. Alternative selectors exist so a company can show different marks on different mail streams, which is a real need for a large brand and an unnecessary complication for anyone else. Use default unless you have a specific reason not to.

Publishing it, and what to expect afterwards

Google's documentation gives the DNS values directly: type TXT, host default._bimi. followed by your domain, value the BIMI assertion record, and a TTL of "1 hour (3600 seconds)".

Two operational notes come from the same page. Field names differ between providers, and "Some domain providers populate your domain name automatically. If not, manually enter your domain", which is the trap that turns default._bimi.acme.com into default._bimi.acme.com.acme.com. And the wait is long: "It can take up to 48 hours for BIMI to start working, and for logos to show in recipients' mailboxes."

After that, verification is empirical. Send to accounts you hold at the providers you care about and look at what renders. Support varies by provider and by client, and a logo appearing in one inbox and not another is normal rather than a fault.

The failure modes, in the order they occur

The record is published and DMARC is not at enforcement. The most common one by a distance, because the DNS edit is the visible task and the policy work is not. There is no error state to observe. Check the policy first.

The logo URL resolves and the SVG does not conform. An SVG that opens correctly in a browser can still fail validation, since the profile forbids constructs that browsers render happily. Script tags and external links are named explicitly in the BIMI Group's guidance, and a logo exported without those restrictions in mind will contain other things too. Validate the file rather than viewing it.

The certificate is missing where a receiver requires one. Support differs by provider. A logo appearing at one mailbox provider and not another is usually this, rather than a DNS problem, and no amount of re-checking the record will move it.

The host field is doubled. Provider-dependent and universal across DNS work. Read the saved record back.

A parked or unauthenticated domain is used as the sending domain. BIMI is evaluated on the domain in the From address. Publishing the record on the brand domain while sending from a different one does nothing for the mail that is actually going out.

The logo moved. A record pointing at a URL on a marketing site survives exactly until the next site rebuild. Host the asset somewhere with a stable path and treat that URL as infrastructure.

Whether BIMI is worth it for B2B outbound

Here is the honest answer for cold email specifically: BIMI is a brand-domain investment, and it does very little for a dedicated outbound sending domain.

The reason is structural rather than a matter of effort. BIMI shows a logo that recipients recognise, which is worth something when they already know the brand and are scanning a crowded inbox. A cold outbound message goes to someone who has not heard of you, from a sending domain that is not your main brand domain, so the logo is carrying no recognition. Meanwhile the requirements are per-domain: enforcement, a conforming logo and a certificate on every sending domain you run, and none of it inherits from the parent.

Where BIMI does earn its place is the primary domain: the one your invoices, contracts and post-meeting correspondence come from, where the recipient does know you and where impersonation actually costs you something.

There is a second-order benefit worth naming, and it is the real argument. The prerequisite authentication work is valuable on its own. Getting to DMARC enforcement means inventorying every system that sends as you and fixing the ones that fail alignment, which is exactly the work that protects inbox placement whether or not a logo ever appears. Our page on the six causes of DMARC failure is the practical version of that inventory, and the DKIM record in practice covers the alignment half.

The per-domain arithmetic is the part that settles it. Enforcement, a conforming logo, a hosted asset with a stable URL and, for most receivers, a certificate carrying an annual lifecycle, all repeated on every sending domain in the inventory. A brand running one primary domain pays that once. An outbound programme running thirty pays it thirty times, for logos that appear beside messages to people who have never seen the brand before. Nothing about the standard makes that cheaper at volume, because there is no inheritance from a parent domain to lean on.

BIMI also does nothing for placement, which the BIMI definition covers in full; a logo renders on messages that already reached an inbox, and mail landing in spam is a separate problem with separate causes in our deliverability guide.

We run outbound as one message per campaign from authenticated sending domains, and we do not put BIMI on those domains, because the requirement list is real and the return on a first-contact message is not. If you want the sending infrastructure built and authenticated properly, that is part of how we run campaigns.

The short version

The record is a TXT at default._bimi.yourdomain.com carrying v=BIMI1 with an l= logo URL and usually an a= certificate URL, on a one hour TTL, taking up to 48 hours to show. It does nothing until DMARC is at quarantine or reject with real mail passing, the logo conforms to the SVG Tiny Portable/Secure profile, and, for most receivers, a Verified Mark Certificate backs it. Put it on the brand domain your customers already recognise, not on outbound sending domains, and treat the enforcement work it forces as the actual return.

Vendor and standards-body guidance verified as of August 2026 against Google Workspace's published BIMI setup documentation, the BIMI Group's implementation guidance, and RFC 9989. Verify current certificate and provider requirements before relying on them.