Hosting the BIMI logo with DomainWarn

BIMI shows a brand logo next to its mails – in Gmail, Apple Mail, Yahoo and other mailboxes. A TXT record default._bimi.client.example points to the logo with l=. Setups usually fail at two points: the logo has to be an SVG in the strict "SVG Tiny Portable/Secure" (Tiny PS) profile, and it has to live somewhere over HTTPS.

DomainWarn takes care of both. In the "E-Mail" tab of a domain you upload the SVG under "BIMI logo" – just as it comes out of Illustrator, Inkscape, Figma or Sketch. DomainWarn converts it to Tiny PS itself: version="1.2" and baseProfile="tiny-ps" on the svg element, a title element with the brand name (if missing, the client name or the domain), a square viewBox (the shorter side is padded, the content stays centered and undistorted), no x/y/width/height on the svg element, no scripts, animations, editor data, comments or references to external files, CSS as presentation attributes, at most 32 KB. The logo then lives at a fixed, unguessable URL on the DomainWarn website. With a CNAME bimi.client.example pointing to DomainWarn it also lives directly under the client's domain (https://bimi.client.example/<token>/<version>.svg); DomainWarn obtains the certificate for it itself, just like for MTA-STS.

If DomainWarn changed anything, the card shows "We adjusted your logo:" with every change before uploading, plus your original and the result side by side; only "Accept and upload" makes the logo public. Changes marked yellow may alter the look – elements that do not exist in Tiny PS (clip paths, masks, filters, patterns), CSS rules with descendant selectors or @media, references to external files. A logo that already is Tiny PS stays unchanged byte for byte; that matters when it is part of a mark certificate (VMC/CMC). Raster images cannot be converted: a PNG or JPEG, also embedded in an SVG. BIMI needs a vector logo, and pixels cannot be turned into one without tracing – that takes the vector original (SVG, AI, EPS or PDF), exported as SVG. Uploads may be up to 512 KB; editor data, indentation and, if necessary, decimals are dropped until the logo stays below 32 KB.

In the client's DNS

bimi.client.example.            CNAME  domainwarn.com.
default._bimi.client.example.   TXT    "v=BIMI1; l=https://bimi.client.example/k7x2…/3f9a0c1b2d4e.svg; a=;"

The switch happens without an outage: as long as the logo has not demonstrably arrived under bimi.client.example, the recommended TXT record names the URL at DomainWarn (https://domainwarn.com/bimi/k7x2…/3f9a0c1b2d4e.svg) – it always works, even without any CNAME. After every BIMI check DomainWarn fetches the logo under bimi.client.example; if exactly this logo comes back, the card shows "The logo is served under bimi.client.example" and the record names the own URL from then on. If it does not arrive there for more than a day (CNAME removed), it names the URL at DomainWarn again. Both URLs serve the same logo; a record pointing to either counts as active. Under bimi.client.example only the logo the domain's BIMI record points to is served – another account adding the same domain cannot serve anything there.

a= stays empty. It would hold the URL of a mark certificate (VMC or CMC). Gmail only shows the logo with such a certificate, Apple Mail requires one as well; Yahoo, Fastmail and others do without. If the client has one, they enter its URL themselves – the certificate has to match the uploaded logo. And BIMI only works with an enforced DMARC policy (p=quarantine or p=reject).

To change the logo, simply upload a new one. The URL keeps its token, only the version in the file name changes; the old URL serves the new logo right away, so the record never points to nothing. Mailbox providers often cache logos for weeks, though – switch the record to the new URL and they fetch the new logo. If you remove the logo, the URL stops serving immediately; a later upload gets a new one.

If the zone is connected through an integration, this works with a click as well: "Set up with Cloudflare" (or the respective provider) creates the CNAME and the TXT record (the CNAME without the Cloudflare proxy, otherwise DomainWarn could not get a certificate). As soon as the logo arrives under bimi.client.example, the card marks the TXT record as outdated and switches l= to the own URL with a click. After a new logo the card marks the record as outdated and switches l= to the new URL with a click; an a= you entered yourself is kept. A BIMI record pointing to a different logo is only replaced after explicit confirmation. With "Update the DNS record automatically on changes" DomainWarn updates the record itself after every logo change.

The BIMI check then verifies from the outside that record, logo and DMARC line up.