How do I set up BIMI for my domain?

Setting up BIMI is the visible end of a properly enforced email-authentication setup. The logo only appears once the underlying authentication is in place, so the order of operations matters more than the BIMI record itself.

The three prerequisites

BIMI logo display depends on three conditions:

1. DMARC at enforcement. Your domain must publish a DMARC policy of p=quarantine or p=reject. A monitor-only policy (p=none) is the single most common reason a perfect-looking BIMI record is ignored. Mailbox providers will not show a logo for a domain that is not protecting itself against spoofing.
2. A BIMI-compatible logo. The image must be SVG Tiny 1.2 Portable/Secure (SVG Tiny PS): square aspect ratio, no scripts, no external references, hosted over HTTPS. The IntoDNS.ai generator previews the logo so you can confirm the URL resolves before you publish.
3. An optional mark certificate. A VMC or CMC (a HTTPS-hosted PEM file referenced with the a= tag) is not required to publish a valid BIMI record, but some mailbox providers — notably Gmail — require a certificate-backed path before they display the logo. A VMC additionally enables Gmail's blue verified checkmark.

Step by step

1. Fix authentication first. Publish valid SPF and DKIM, then move DMARC from p=none to p=quarantine or p=reject. Use the DMARC generator if you need a record.
2. Prepare the logo. Export your brand mark as square SVG Tiny PS and host it at a public HTTPS URL, e.g. https://yourdomain.com/bimi/logo.svg.
3. Generate the record. Use the free BIMI checker and generator to build the default._bimi TXT value. Fill in the logo URL; add the certificate PEM URL only if you have a VMC or CMC.
4. Publish the TXT record at default._bimi.yourdomain.com (use the default selector unless you run multiple sending streams).
5. Verify. Re-scan the domain with IntoDNS.ai or query the public BIMI endpoint at https://intodns.ai/api/email/bimi?domain=yourdomain.com to confirm the record, logo URL, certificate URL, and DMARC enforcement are all readable.

Example record

With a certificate: v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=https://yourdomain.com/bimi/vmc.pem

Without a certificate (valid, and enough for providers that don't require one): v=BIMI1; l=https://yourdomain.com/bimi/logo.svg; a=

For the full standard and how each tag works, see the BIMI guide. The key takeaway: start with DMARC enforcement, not the logo. Once authentication is enforced and the SVG is hosted correctly, the BIMI record is the easy part.