BIMI (Brand Indicators for Message Identification)

BIMI (Brand Indicators for Message Identification) is an email specification that allows domain owners who have implemented strong email authentication (SPF, DKIM, and DMARC) to display their official brand logo next to incoming emails in supported inbox clients (such as Gmail, Yahoo, Apple Mail, and Fastmail).

Beyond visual recognition, BIMI serves as a powerful security incentive: it encourages organizations to enforce strict DMARC policies to prevent domain spoofing and phishing.

When an email is delivered to a recipient's mail server, the receiving system executes the following validation steps:

# **Authentication Verification:** Validates that the message passes [[email:dns-configuration:spf|SPF]] and/or [[email:dns-configuration:dkim|DKIM]] checks, and that domain alignment is satisfied.
# **DMARC Policy Enforcement:** Checks the domain's [[email:dns-configuration:dmarc|DMARC]] record to ensure a quarantine or reject policy (e.g., ''p=quarantine'' or ''p=reject'') is actively enforced.
# **BIMI DNS Lookup:** Queries DNS for a TXT record located at ''default._bimi.yourdomain.com''.
# **Logo & Certificate Fetching:** Retrieves the SVG image specified in the BIMI record and checks for an optional **VMC** (Verified Mark Certificate).
# **Inbox Rendering:** If all checks pass, the inbox provider renders the brand logo in the user's inbox list and message header.

A BIMI TXT record must be created at the host location default._bimi.yourdomain.com.

v=BIMI1; l=https://telenegar.ir/assets/logo.svg;

v=BIMI1; l=https://telenegar.ir/assets/logo.svg; a=https://telenegar.ir/assets/bimi-cert.pem;

To successfully enable BIMI, your domain must meet all four of the following technical requirements:

Your domain must have a published DMARC policy with enforcement enabled. The policy percentage tag must be 100% (pct=100 or omitted):

• Allowed: p=quarantine or p=reject
• Not Allowed: p=none (BIMI will be ignored by mailbox providers if DMARC is set to none).

The logo specified in the l= tag must comply with strict SVG formatting guidelines:

• Must be an SVG Tiny Portable P/S (SVG Tiny PS) formatted file.
• Must be square (1:1 aspect ratio) with a centered design.
• Must be hosted over secure HTTPS.
• Must not contain embedded scripts, external links, or relative paths.

While some inbox providers display logos without a certificate, major providers (such as Gmail and Apple Mail) require a Verified Mark Certificate (VMC) issued by a recognized Certificate Authority (e.g., DigiCert, Entrust). A VMC verifies legal ownership of your registered trademark logo.

Even with valid records, mailbox providers evaluate sender reputation before displaying logos to users.

If your DMARC record contains p=none, mailbox providers will reject the BIMI record completely. Change your policy to quarantine or reject.

Standard SVG files (SVG 1.1 or SVG 2.0) will fail validation. Use specialized converters to ensure the SVG adheres strictly to the SVG Tiny PS profile.

Ensure the logo URL and VMC URL respond with HTTP status 200 OK and are publicly accessible over HTTPS without basic auth or IP restrictions.

You can verify your BIMI DNS record and broader email authentication parameters using Telenegar Tools or terminal commands:

• BIMI & Email DNS Verification: Validate TXT records and MX resolution with the Telenegar DNS Check Tool.
• Full Authentication Diagnostics: Audit your domain's SPF, DKIM, and DMARC alignment using the Telenegar Mail Check Tool.

 bash
dig +short TXT default._bimi.example.com

 cmd
nslookup -type=TXT default._bimi.example.com

• Telenegar DNS Check Tool — Diagnostic tool for DNS record lookup and propagation.
• Telenegar Mail Check Tool — Diagnostic tool for email authentication and security alignment.
• DMARC — Essential policy requirement for BIMI support.
• SPF (Sender Policy Framework) — Core email authentication protocol.
• DKIM (DomainKeys Identified Mail) — Cryptographic signature mechanism.
• MTA-STS — Enforce TLS encryption for inbound emails.