How it works
The BIMI record is a TXT record under default._bimi in front of the domain, for example default._bimi.example.com with v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem. l= points to the logo, a= optionally to a mark certificate (Verified Mark Certificate, VMC).
The logo has to be a square SVG in the SVG Tiny PS profile, served over https, with a title element and without scripts, animation, embedded raster images or external references. Keeping it under 32 KB is recommended.
BIMI only works on top of DMARC: the domain needs p=quarantine or p=reject applied to all mail, meaning no pct below 100. Each mailbox provider decides for itself whether to show the logo; Gmail and Apple Mail only do so with a mark certificate.
BIMI is being developed by the BIMI Group as an IETF draft and is not a finished RFC yet.
Why it matters
A missing BIMI record is not a security problem. A half-working one is the annoying case: a logo that disappeared in a site relaunch, an SVG in the wrong profile, or a DMARC policy rolled back to p=none makes the logo vanish without any error, which hurts most after paying for a mark certificate.
Because BIMI requires enforced DMARC, a visible logo also signals that forgeries of the exact domain get rejected. It does nothing against look-alike domains, though.
How to prevent it
- Get DMARC to p=quarantine or p=reject first, applied to all mail and without a weaker subdomain policy.
- Export the logo as a square SVG Tiny PS file with a title element, no scripts and no raster images, and host it at a stable https URL.
- For Gmail and Apple Mail, obtain a mark certificate (VMC), which requires a registered trademark, and link it in a=.
- Keep only one BIMI record under default._bimi.
- Recheck the logo URL and certificate after every relaunch or hosting move.
How DomainWarn detects it
The BIMI check reads the record under default._bimi, validates its syntax, fetches the logo and the mark certificate and checks the DMARC policy. A missing record is only a hint. If the logo URL is missing, the logo or VMC URL is not https, there are multiple BIMI records, the logo cannot be fetched or is not an SVG, the certificate is unreachable, or DMARC is not quarantine or reject for all mail, DomainWarn opens a “BIMI invalid” incident after two runs. An SVG not marked as Tiny PS and a missing mark certificate are hints.
If a subdomain has no record of its own, the check uses the parent domain’s record. With the “Hosting the BIMI logo” integration, DomainWarn converts an uploaded logo to SVG Tiny PS, serves it from a bimi subdomain of your domain and keeps the TXT record up to date at the connected DNS provider.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.