BIMI Record Generator
Generate a BIMI DNS record, validate the logo and certificate requirements, and check the DMARC enforcement prerequisite that most failed deployments miss.
Last reviewed by the Radiatus Cloud team
Need this handled by experts?
Radiatus runs VAPT, managed SOC & security engineering for regulated teams.
Your logo in the inbox, conditional on authentication
Brand Indicators for Message Identification publishes a logo in DNS that participating mailbox providers display beside authenticated messages. Gmail, Yahoo, Apple Mail and Fastmail all support it. The commercial appeal is obvious, but the mechanism is the interesting part: the logo only appears when the message passes DMARC at an enforcing policy, so BIMI is a visible reward for having completed email authentication properly rather than a feature you can simply switch on.
DMARC enforcement is the real prerequisite
A BIMI record on a domain whose DMARC policy is p=none does nothing at all. The policy must be quarantine or reject, and the specification requires the percentage to be 100 with no subdomain override weakening it. This is where the majority of failed deployments sit: the DNS record is published correctly, the logo is valid, and nothing appears because the DMARC record was never moved past monitoring mode. Getting to enforcement is months of work on SPF and DKIM alignment, and BIMI is the last step rather than the first.
The logo and certificate requirements are strict
The image must be SVG Tiny Portable/Secure, a deliberately restricted profile with no scripts, no external references and no animation, square, with a solid background, served over HTTPS. Gmail additionally requires a Verified Mark Certificate proving trademark ownership, issued by one of a small number of authorities at significant annual cost. Other providers display the logo without one. The record is valid either way and this generator flags which providers will honour it.
Related tools
- Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
- Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
- Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
- Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.
Frequently Asked Questions
Why is my logo not showing in Gmail?
Most likely one of three things: DMARC is not at quarantine or reject, there is no Verified Mark Certificate, or the SVG does not meet the Tiny P/S profile. Gmail requires all three; several other providers require only the first and third.
What is a VMC and do I need one?
A Verified Mark Certificate proves you hold a registered trademark on the logo. Gmail requires one. Apple Mail, Yahoo and Fastmail display BIMI logos without it. They are issued by a small number of authorities and cost roughly a thousand dollars a year.
What are the SVG requirements?
SVG Tiny Portable/Secure: no scripts, no external references, no animation, a title element, a square viewBox and a solid background. Most design tool exports fail without conversion. The file should be under 32 kB and served over HTTPS.
Does BIMI improve deliverability?
Not directly. It has no effect on filtering decisions. Its indirect benefit is that qualifying requires DMARC enforcement, which does improve deliverability and does prevent spoofing of your domain.
Can I use BIMI on a subdomain?
Yes, and each subdomain needs its own record at default._bimi under it. The DMARC policy governing that subdomain must also be at enforcement, which the sp tag on the organisational domain can affect.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Enter your logo URL and optional VMC certificate URL to generate the BIMI DNS record.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.
Related Tools
Password Strength Checker
SecurityMeasure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
Password Generator
SecurityGenerate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
Hash Generator
SecurityGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.