Free BIMI Generator
Enter the URLs of your logo and certificate to build the record that asks inboxes to show your brand beside your messages, and see what has to be in place first.
Building your record...
Could not build the record
Some DNS panels add your domain automatically. If yours does, enter only default._bimi.
Nothing to flag.
What a BIMI Generator Does
BIMI, Brand Indicators for Message Identification, lets a domain publish a logo for participating inboxes to show beside its messages. A BIMI generator writes the TXT record that points to that logo, and to the certificate that proves your right to use it, at default._bimi.yourdomain.com.
The record is the easy part. The logo only appears if your mail passes an enforced DMARC policy, and the largest inboxes also expect a certificate. This generator builds the record and tells you what is still missing. It does not fetch or validate your files. Check your policy first with the DMARC checker.
- Confirm your DMARC policy is at quarantine or reject.
- Host your logo as an SVG Tiny PS file at a public https:// URL.
- If you have a certificate, host its PEM file at an https:// URL too.
- Generate, then publish the value as a TXT record at the host shown.
What the generator settles
- The location: BIMI sits at a selector under _bimi, not on the apex and not beside DMARC.
- The format: version first, then the logo, then the authority tag, with https:// URLs only.
- The prerequisites: the DMARC requirement and any missing certificate are named, because neither shows up in the record itself.
BIMI Record Tags
A BIMI record is short. Each tag does one job.
| Tag | Holds | What it needs | Status |
|---|---|---|---|
| v=BIMI1 | The version | Identifies the record as BIMI. It must come first and is always the same. | Required |
| l= | The logo URL | An https:// URL to your logo in the SVG Tiny PS profile, a restricted form of SVG. An ordinary SVG export usually needs converting. | Required |
| a= | The certificate URL | An https:// URL to a PEM file holding your mark certificate. Left empty, the record simply offers the logo with no proof. | Often needed |
How to Use the Output
Two values to copy, and the requirements the record cannot meet for you.
Before you publish
The warningsThe DMARC reminder always appears, because this tool does not read your DNS. The certificate warning appears when you leave that field empty.
The TXT record
The valuePaste it as shown. An empty a= is valid and means you have no certificate to point to.
The host
The nameAlmost everyone uses the default selector. A custom selector is only for sending different logos from one domain, and needs a matching header on your mail.
Publishing it
The last stepCreate the TXT record, let it propagate, and send a test message to an inbox that supports BIMI. Logos can take time to appear, as inboxes cache them.
What BIMI Requires
BIMI is a reward for authentication, not a substitute for it. Inboxes only show a logo on mail that passes DMARC from a domain with an enforced policy. If you are not there yet, the DMARC generator is the place to start.
BIMI is still an IETF draft rather than a finished standard, and each inbox provider sets its own rules on top of it. Publishing a correct record asks for your logo to be shown; it does not guarantee that it will be.
Do You Need a Certificate?
Gmail and Apple Mail expect a mark certificate, issued by an authorised certificate authority after checking your right to the logo.
There are two kinds:
- A Verified Mark Certificate (VMC) needs a registered trademark for the logo.
- A Common Mark Certificate (CMC) is for logos without a trademark that you can show you have used, though not every inbox accepts it.
- Either one is a paid certificate with a yearly renewal.
- Some inboxes may show a logo with no certificate, usually for established senders.
Why a BIMI Logo Does Not Appear
The record is rarely the problem. Check these first:
- A DMARC policy of p=none, or a pct below 100. Your subdomains count too, so an sp=none can also disqualify the domain.
- A logo in ordinary SVG. Files must follow the SVG Tiny PS profile, which rules out scripts, animation and external references. Most design tools need a conversion step.
- A logo that is not square, or has a transparent background. Inboxes usually crop to a circle, so centre the mark on a solid colour.
- Publishing at the wrong name. A DNS lookup on default._bimi under your domain shows whether the record is really there.
Why Brands Publish BIMI
A forgery shows no logo
Spoofed mail fails DMARC, so it arrives without your logo. Readers get a visible difference between you and an impostor.
It rewards work already done
If you have reached an enforced DMARC policy, the record is a small addition on top of that effort.
Your brand before the open
The logo sits beside your name in the message list, so people recognise you before they read a word.
You choose the image
Without BIMI an inbox shows initials or a generic avatar. With it, the image comes from a record you control.
Who Generates BIMI Records
Usually the last step of an email authentication project.
IT & Email Admins
Publish the record once the domain has reached an enforced DMARC policy.
For DNS monitoringSecurity Teams
Give staff and customers a visible sign that a message really came from you.
For IT & MSPsWhat to Do Around BIMI
The record depends on the authentication underneath it.
Check your DMARC policy
Confirm you are at quarantine or reject at 100%, which BIMI needs.
DMARC checkerBuild an enforced record
Not there yet? Generate the DMARC record for your next stage.
DMARC generatorTest SPF and DKIM
Your mail has to pass DMARC for the logo to appear.
Email deliverability checkerKeep the policy enforced
Get alerted if a change to DMARC would take your logo away.
Email auth monitoringFrequently Asked Questions
Common questions about BIMI records, logos and certificates.
What is a BIMI record?
A TXT record, usually at default._bimi under your domain, that points to your logo and optionally to a certificate. Inboxes that support BIMI can then show that logo beside messages that pass DMARC.
How do I generate a BIMI record?
Enter the https:// URL of your SVG logo, and of your certificate if you have one, then generate. Copy the host and value into a new TXT record at your DNS provider.
What does a BIMI record look like?
For example v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/bimi.pem. The l tag is the logo, and the a tag is the certificate.
Does BIMI require DMARC?
Yes. Your domain needs a policy of quarantine or reject applied to all mail, and your messages must pass DMARC. A policy of p=none does not qualify.
Do I need a VMC for BIMI?
For Gmail and Apple Mail you need a mark certificate. A VMC needs a registered trademark, and a CMC covers some logos without one, though not every inbox accepts it. Some other inboxes may show a logo without any certificate.
What format does the BIMI logo need?
SVG in the Tiny PS profile, served over https. It should be square, with a solid background, and small enough to load quickly. Ordinary SVG exports usually need converting.
Does this generator check my logo?
No. It builds the record and checks that the URLs have the right form, but it does not fetch them. Validate the logo against the SVG Tiny PS profile before you publish.
Why is my BIMI logo not showing?
The usual causes are a DMARC policy below enforcement, a missing certificate on inboxes that need one, or a logo that is not SVG Tiny PS. Inboxes also cache logos and apply their own rules, so a correct record may take time to show.
Does BIMI improve deliverability?
Not directly. The logo is a display feature. The real benefit comes from the DMARC enforcement BIMI requires, which protects your domain from spoofing.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.