# BIMI (Brand Indicators for Message Identification): Definition and How It Works Source: https://wraps.dev/glossary/bimi AuthenticationBrand Indicators for Message IdentificationBIMI record BIMI is a DNS record that points a supporting mailbox provider at a domain's SVG logo, displayed next to authenticated mail — but only once DMARC is already enforcing. ## The record and its two tags The record lives at \`default.\_bimi.\`, starts with \`v=BIMI1\`, and carries \`l=\`, the HTTPS URL of the SVG logo, as the one required field. An optional \`a=\` tag points to a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) — a certificate that some mailbox providers require before they will display the logo at all, and that others treat as an enhancement to trust rather than a hard requirement. ## DMARC has to be enforcing first BIMI is specified to require an enforcing DMARC policy — quarantine or reject — because the logo is a trust signal, and a domain that has not committed to rejecting unauthenticated mail claiming to be it has not earned that signal. A BIMI record published against a \`p=none\` DMARC policy is syntactically valid and functionally inert: no mailbox provider will render the logo. ## The SVG has to be a specific, restricted profile The logo file is not an ordinary SVG. It has to declare \`baseProfile="tiny-ps"\` and \`version="1.2"\`, include a \`\` element, and must not contain scripts, animation, embedded raster images, \`<foreignObject>\` elements, or external references — no fonts loaded from elsewhere, no linked images. The root \`<svg>\` element cannot carry \`x=\` or \`y=\` attributes, the viewBox has to be square, and the file has to stay under roughly 32KB. Every one of those is an automatic rejection reason, not a soft warning, for the mailbox providers that validate strictly. ## VMC verification is a real gap worth knowing about Full X.509 certificate-chain verification of a VMC is genuinely hard to implement correctly and is not something every BIMI-checking tool does, including Wraps' own — it probes the VMC URL for HTTPS reachability, not full certificate validity. Treat a green VMC-reachability check as "the URL answers," not as "the certificate is valid and trusted," and expect real gaps between tools here for a while yet. ## Why it matters A logo next to a message in the inbox list is a visible, differentiating trust signal at the exact moment a recipient decides whether to open a message — and it is unavailable to any domain that has not first done the harder, less visible work of getting DMARC to an enforcing policy. BIMI is a reward for authentication maturity, not a shortcut around it. ## How to check it ``` dig +short TXT default._bimi.example.com ``` ## Common questions ### Can I set up BIMI before DMARC is enforcing? You can publish the record, but no mailbox provider will render the logo until your DMARC policy is quarantine or reject. BIMI is specified to depend on enforcement, not just presence. ### Do I need a Verified Mark Certificate for BIMI to work? It depends on the mailbox provider. Some require a VMC or CMC before displaying the logo at all, others treat it as optional trust enhancement. Check the requirement for each provider you care about rather than assuming one answer covers all of them. ### Why was my BIMI logo rejected even though it opens fine in a browser? BIMI requires the restricted SVG Tiny P/S profile, not an ordinary SVG. A browser will happily render scripts, embedded images, or a missing baseProfile attribute that a strict BIMI validator rejects outright.