Fix Invalid BIMI Record (Brand Logo Not Showing)

What's happening

Brand Indicators for Message Identification (BIMI) is published as a TXT record at default._bimi. and tells supporting mail clients (Gmail, Apple Mail, Yahoo, Fastmail) where to find your brand logo. Receivers display the logo next to messages that pass DMARC, providing visual brand authentication.

BIMI requires three pieces. A DMARC policy at p=quarantine or p=reject (p=none does not qualify). A correctly-formatted SVG Tiny PS logo hosted at HTTPS with a valid certificate. And for Gmail and most major receivers, a Verified Mark Certificate (VMC) issued by Entrust or DigiCert that proves you own the trademarked logo.

Common failures include SVG not in Tiny PS profile, l= URL returning anything other than 200 OK, a= URL missing or pointing to an expired VMC, DMARC at p=none disqualifying the record, or the VMC not chained to a recognized trust root. Each produces no logo display rather than an error message — diagnosis requires a BIMI inspector.

Why it matters

Brand logo absent in Gmail, Apple Mail, Yahoo, Fastmail. Receiver displays the default sender icon (initial letter or generic avatar) instead of your brand mark. Phishing protection benefit is lost — users have no visual cue that a message is authentic.

Investment in VMC ($1,000-$1,500/year for Entrust or DigiCert) wasted while the record is invalid. Marketing teams that designed the logo and procured the VMC see no return until the record is fixed.

Competitive disadvantage. Major B2C senders (Bank of America, Verizon, CVS, etc.) have BIMI live; their mail visually stands out. Without BIMI, your mail blends in with phishing, reducing open rates and brand recognition.

Common causes

• DMARC policy at p=none — disqualifies BIMI immediately.
• SVG not in Tiny PS profile (extra elements like CSS, animations, or text).
• SVG file served over HTTP, not HTTPS, or with an invalid certificate.
• VMC certificate (a= URL) missing, expired, or not from a recognized BIMI issuer.
• Logo not centered or not square aspect ratio (BIMI requires square SVG).
• DMARC pct< 100 — BIMI requires full enforcement, not partial.

Detect this on your site

Run a quick scan with the Email Checker. The tool surfaces this exact issue with the records and context needed to apply the fix below.

How to fix it

1. 1

   Confirm DMARC qualifies

   Run dig +short TXT _dmarc.example.com. The policy must be p=quarantine or p=reject AND pct=100 (or pct missing, which defaults to 100). p=none disqualifies BIMI; pct=10 disqualifies BIMI. Fix DMARC first if needed.

2. 2

   Prepare the SVG Tiny PS logo

   Export your logo as SVG using Adobe Illustrator or Inkscape. Use the BIMI SVG Converter (bimigroup.org/svg-converter) to convert to SVG Tiny PS. The output must be square aspect ratio, 32x32 to 768x768 viewBox, no scripts, no animations, no external resources, no CSS.

3. 3

   Host the SVG over HTTPS

   Upload the file to a public HTTPS endpoint with a valid certificate. CDN like Cloudflare or static hosting like Netlify works well. URL example: https://example.com/brand/bimi-logo.svg. Test with curl -I — must return 200 OK and Content-Type: image/svg+xml.

4. 4

   Procure a VMC if targeting Gmail

   Apply for a VMC from Entrust or DigiCert. Requires a registered trademark on the logo (12-18 months of trademark application processing if you do not already have one). The VMC is published as a PEM file at HTTPS, like https://example.com/brand/bimi.pem. Cost is roughly $1,000-$1,500/year.

5. 5

   Publish the BIMI TXT record

   Add a TXT record at default._bimi.example.com with value v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/bimi.pem. The l= field is required; a= is required for Gmail. Verify with dig +short TXT default._bimi.example.com.

6. 6

   Test in real Gmail and validators

   Use bimigroup.org's BIMI Inspector or EasyDMARC's BIMI checker to validate the full chain (DMARC, SVG, VMC). Send a test from your authenticated infrastructure to a Gmail account and confirm the logo appears within 24-48 hours. Logo display propagation is slower than DNS changes.

Example

; BIMI TXT with VMC for Gmail support
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/bimi.pem"

; BIMI TXT without VMC (limited receiver support)
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/bimi-logo.svg"

BIMI record with and without a VMC. Gmail requires VMC; Yahoo and Fastmail are more permissive.

Related fixes