DMARCGuardian Practical help for DMARC, SPF, DKIM, and BIMI.

Blog · Bimi

Why BIMI Records Fail and How to Get Them Working

By DMARCGuardian Editorial Team ·

Your BIMI record is set up, your logo is uploaded, and your logo still does not appear in Gmail or Apple Mail. BIMI gives you almost no feedback when it breaks. The good news is that every BIMI failure traces back to one of three places. Here is how to find which one is broken.

What BIMI Validation Checks

A receiving server with BIMI support evaluates three things in sequence:

  • A DNS TXT record at default._bimi. that points to your logo URL
  • The SVG logo file at that URL
  • A CA certificate proving you own the logo

All three must be correct. A problem in any one breaks the whole chain.

Why the BIMI TXT Record Fails First

The TXT record is where most BIMI setups break down first. The syntax is strict and easy to get wrong.

A correctly formatted BIMI TXT record looks like this:


default._bimi IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/certificate.pem;"

The v=BIMI1 version tag is mandatory. Without it, most validators ignore the record entirely.

The l tag points to your HTTPS logo URL. The URL must use HTTPS -- HTTP is rejected.

The a tag points to your certificate URL. Some older guides omit this, but it is required for full BIMI.

Common mistakes:

  • Using a colon instead of equals sign after the tag (v:BIMI1 instead of v=BIMI1)
  • Double quotes if your DNS provider already adds them automatically
  • Spaces after semicolons, which the syntax does not allow
  • Pointing l to an HTTP URL instead of HTTPS

How to Test Your BIMI TXT Record


dig TXT default._bimi.yourdomain.com

Compare the output against the syntax above. If the record looks correct but BIMI still fails, move on to the SVG.

Why the SVG Logo Fails Even When the Record Is Correct

The SVG is where setups break after getting the TXT record right. BIMI requires a specific kind of SVG that is stricter than what most design tools export by default.

SVG Format Requirements for BIMI

The SVG must be SVG 1.1 or 2.0 and must not contain external references. That means no , no linked images, no fonts loaded from outside the file. Everything the logo needs must be self-contained.

The file must include a viewBox attribute. This defines the coordinate system and is required by the BIMI spec:

BIMI scales the logo to a small square in the inbox. Simple, high-contrast brand marks work. Photographs, fine text, and complex illustrations often fail or render poorly.

Keep the file under 32KB. Some inbox providers apply stricter limits.

Testing the SVG in Your Browser

Paste the logo URL directly into a browser address bar. If the browser cannot render it, the file will not pass BIMI validation either.

Why the CA Certificate Is the Hardest Part

The certificate requirement is what makes BIMI harder than SPF or DKIM. You need a verifiable chain linking your domain to the logo.

Two certificate types can work:

VMC (Verified Mark Certificate) is issued by CAs approved by the BIMI working group. It is the original option and the most widely supported. Gmail and Apple Mail both accept VMC-based BIMI. Getting one requires proving domain control and that the logo is a registered trademark.

CMC (Certified Mail Certificate) is a newer, lighter alternative being developed through the DMARCbis process. It does not require trademark proof, making it easier to obtain, but inbox provider support is still limited.

For now, VMC is the safer choice if you need your logo to appear in major inboxes.

Getting a Certificate

Only DigiCert and Entrust currently issue BIMI certificates. The process typically involves:

  • Verifying domain control through the CA
  • Submitting trademark documentation
  • CA validation (one to two weeks is typical)
  • Downloading the certificate chain and publishing it at the URL in your TXT record

Certificate Chain Validation

The URL in your a= tag must deliver the full certificate chain, not just the leaf certificate. If the chain is incomplete, validation fails. Most CAs provide a combined .pem file with the full chain.

BIMI Validation Checklist

Go through each component in order.

TXT record:

  • Record exists at default._bimi.yourdomain.com
  • Version tag reads exactly v=BIMI1
  • l= tag points to an HTTPS URL
  • a= tag points to an HTTPS URL
  • No extra quotes or spaces after semicolons

SVG logo:

  • Valid SVG 1.1 or 2.0 with correct namespace
  • No external references
  • Has a viewBox attribute
  • File size under 32KB
  • Renders in a browser
  • Simple, high-contrast mark (not a photograph)

Certificate:

  • VMC or CMC from DigiCert or Entrust
  • Full certificate chain available at the a= URL
  • Certificate covers the domain in your BIMI record
  • Certificate has not expired

How to Monitor BIMI Status After Setup

Once your BIMI is working, it can stop working without notice. The certificate expires. The logo URL changes. Someone edits the SVG and introduces an error.

DMARCFlow tracks BIMI publication changes alongside your DMARC reports. If your logo URL changes or the certificate approaches expiration, you get an alert before the logo disappears from inboxes. This is more reliable than checking manually every time you send a campaign.

The other reason to monitor BIMI alongside DMARC: both are tied to your domain's email authentication posture. A change to your DMARC policy can affect how inbox providers handle your BIMI logo. Seeing both in one place makes it easier to connect the dots when something changes.

FAQ

Why does my BIMI record fail validation?

Three common causes: syntax errors in the TXT record, an SVG file that does not meet BIMI requirements, or a missing or invalid CA certificate. Work through the checklist above to isolate the problem.

What does "BIMI validation error" mean?

It means the inbox provider completed the BIMI chain but could not validate one of the three components. Without a specific error message from the provider, check each part manually.

How do I fix a BIMI SVG logo that does not load?

Verify the SVG has no external references, includes a viewBox, uses the correct namespace, and is under 32KB. Open the logo URL in a browser -- if it will not render there, it will not pass BIMI.

Do I need a VMC or CMC for BIMI?

Use a VMC from DigiCert or Entrust if you need your logo to appear in Gmail or Apple Mail. A CMC is easier to get but has narrower support. Check your target inbox providers before choosing.

How do I test my BIMI record before sending?

Use DMARCFlow's BIMI Inspector to check the full chain automatically, or verify each component manually using the checklist. Sending a test message to a Gmail address and checking for the logo is the most reliable real-world test.