Going live
What you need to know to make sure your BIMI TXT record is ready for you to go live
Everything up to this point, SPF, DKIM, DMARC, your logo, and your Mark Certificate, exists to support one final piece: the BIMI TXT record. This is the record that actually tells a receiving mail server "here's the logo for this domain, and here's proof we're allowed to use it." Nothing shows up in an inbox until this record is published.
Publishing the record itself is quick. What it depends on isn't. Don't attempt this step until SPF, DKIM, and DMARC are all passing at enforcement (see the SPF, DKIM, and DMARC guide) and you have a finished logo and Mark Certificate ready to reference.
What the record does
Think back to the earlier pieces: DMARC proves an email is legitimately from your domain, and your Mark Certificate proves you own the rights to your logo. The BIMI record is what connects those two proofs to an actual image. It's a single DNS TXT record containing two URLs: one pointing to your logo file, and one pointing to your certificate. A receiving mail server that sees a properly authenticated email fetches both, confirms everything checks out, and only then displays your logo.
Record format
The record is published as a TXT record at a specific, predictable location: default._bimi. followed by your sending domain.
default._bimi.northloopfinancial.com. IN TXT "v=BIMI1; l=https://assets.northloopfinancial.com/logo.svg; a=https://assets.northloopfinancial.com/vmc.pem"| Tag | Meaning |
|---|---|
v=BIMI1 | Marks this as a BIMI record. Always this exact value. |
l= | The URL to your logo's SVG file. |
a= | The URL to your Mark Certificate (the full certificate chain, not just the certificate itself, more on that below). |
default here is the selector, similar in concept to a DKIM selector. Almost everyone just uses default, but the spec allows for others if you ever need to serve a different logo for different sending sources.
DNS TXT records have a 255-character limit per string. Your BIMI record, especially the a= URL, can run long enough to hit that. Most DNS providers handle this automatically by splitting the value into multiple quoted strings that get concatenated back together, but it's worth double-checking how your provider handles it, since a silently truncated record is a common cause of BIMI just not working.
Hosting your logo and certificate
One potential challenge to going live is that you'll need to have your logo and mark certificate hosted somewhere accessible. The l= and a= tags in the BIMI TXT record are just URLs, which means your logo and certificate need to be hosted somewhere publicly reachable before you can publish the record. If your organization doesn't already have a straightforward way to serve a couple of static files over HTTPS, see the section below around common options for self hosting.
A few things that matter about where you host these:
- HTTPS is required, with a valid, non-expired TLS certificate. Plain HTTP won't work.
- It needs to be reliable and stay up. Receiving mail servers fetch these URLs as part of validating your email, potentially often. If the host is down, slow, or rate-limits requests, your logo can stop showing even though your DNS record is fine.
- The
a=URL must point to the full certificate chain, your Mark Certificate plus any intermediate certificates, bundled together in a single PEM file, not just your leaf certificate on its own. Your CA will typically give you this full-chain file when you're issued the certificate. Pointinga=at the wrong file (leaf only) is a common validation failure. - Serve the logo with the right content type (
image/svg+xml) where you can. Some clients are lenient about this, but it's easy to get right and one less thing to troubleshoot. - Keep the URLs stable. If you ever move the files to a new location, you'll need to update the DNS record to match, and until you do, validation will fail.
Common options for self hosting
Common options if you don't already have a place for this: a cloud storage bucket with a CDN in front of it (S3 + CloudFront, Cloudflare R2, etc.), a static hosting platform (Netlify, GitHub Pages, Vercel), or simply a folder on your existing marketing site if it's served over HTTPS. It doesn't need to live on your sending domain, any stable HTTPS URL works.
Some Certificate Authorities, including GlobalSign, will host the certificate file for you and give you a URL to use directly for a=. It's worth asking, since it removes one of the two hosting problems entirely.
Publishing your BIMI TXT record
- Confirm your logo and certificate chain are hosted at stable, HTTPS URLs.
- Build your TXT record value using the format above.
- Add it as a TXT record at
default._bimi.yourdomain.comthrough your DNS provider. - Wait for it to take effect.
Be patient!
Keep in mind that while your BIMI TXT record might be published and live, individual mail providers check and cache BIMI records on their own schedule, so it can take anywhere from a few hours to a few days for your logo to actually start appearing. Moreover, different providers (Gmail, Apple Mail, Yahoo) may pick it up at different times. Waiting a few days before you begin troubleshooting.