BIMI record
The TXT record at default._bimi followed by the domain, starting v=BIMI1, giving the logo URL (l=) and the mark certificate URL (a=).
What it means
A BIMI record lives at selector._bimi.domain, with default as the usual selector. Its tags: v=BIMI1 first, l= for the HTTPS address of the SVG logo, and a= for the HTTPS address of the PEM file holding the mark certificate. An empty or absent a= makes a self-asserted record, which certificate-requiring providers such as Gmail ignore. A record with both values empty declines to show any logo.
Senders can choose a different selector per message with a BIMI-Selector header, and receivers add BIMI-Location and BIMI-Indicator headers after validation.
The domain also needs DMARC at quarantine or reject, and Google asks for pct=100 or no pct. Files must be served over HTTPS, and Google recommends TLS 1.2 or later on that server.
Example
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/cert.pem"Related terms
On this site
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- IETF draft: Brand Indicators for Message Identification (BIMI)datatracker.ietf.org
- Google Workspace Admin Help: Set up BIMIknowledge.workspace.google.com
- BIMI Group: Understanding BIMI certificate typesbimigroup.org
All 432 terms in the glossaryThe wiki: blocklists and bounce codes