What goes into the record
A BIMI record is a short tag list. v=BIMI1 comes first and identifies the record. l= holds the HTTPS location of the logo, and a= holds the HTTPS location of the certificate that vouches for it, known as the authority evidence. With both boxes filled the generator outputs, for example, v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem; and rewrites it on every keystroke.
The a= tag is always written, empty if you gave no certificate URL, which is the form a self-asserted record takes. Be careful with an empty logo box: v=BIMI1; l=; a=; is a valid record with a specific meaning, namely that the domain declines to publish a logo. Do not copy the value until the logo URL is in place.
Turning a logo into SVG Tiny PS
Mailbox providers accept one format, SVG Tiny Portable/Secure, and a normal export from a drawing program does not meet it. Start from a clean vector export with text converted to outlines, then open the file in a text editor: set version="1.2" and baseProfile="tiny-ps" on the root element, add a title element containing your company name, and delete anything on the forbidden list.
The validator applies these rules to whatever you paste or upload and reports each one as a pass, a warning or a failure. A root element with x or y attributes fails, as does a file over 32 KB. To shrink one, simplify paths and strip editor metadata. Files above 1 MB are refused by the upload button before any check runs.
- Root element: version 1.2, baseProfile tiny-ps and the SVG xmlns.
- A title element with the brand name.
- No script, animation, foreignObject or image elements.
- No href that points at an http or https address.
- A square viewBox such as 0 0 100 100.
Hosting the logo and the certificate
Both files must be reachable by anyone over HTTPS, with no login, cookie wall or bot challenge in front of them. The Checks list fails a URL that does not start with https:// and warns when the logo address does not end in .svg or the certificate address does not end in .pem. Serve the logo with the Content-Type image/svg+xml. Some web servers need that mapping added.
The certificate file is the PEM your mark certificate issuer supplies. If you have none, leave the box empty. The generator states the trade-off in its own check: without a VMC or CMC, Gmail and Apple Mail will not show the logo, while Yahoo and some other providers will.
Publishing in the right order
BIMI depends on DMARC, so do that first. The policy must be p=quarantine or p=reject at pct=100 before any provider considers your logo. Confirm it with the DMARC Checker and, if you are still at p=none, plan the move with the DMARC Generator. Then upload the validated SVG, add the TXT record at default._bimi.yourdomain and wait for DNS to serve it.
DNS panels differ on the host field. Some want the full name default._bimi.example.com, others append the zone themselves and want only default._bimi. Keep the selector as default unless your sending system adds a BIMI-Selector header that names another one. With a domain entered, a link under the validator opens the BIMI Checker for it.
What the generator leaves unchecked
The generator works on what you type. It does not fetch the logo or certificate URLs, look up DNS or read the certificate, so a typo in a URL goes unnoticed and the file you validated may not be the file you later hosted. The BIMI Checker closes that gap: it downloads both files from the published record and checks DMARC as well.
Nothing you enter is sent to a server. The record is assembled and the SVG is parsed in the page, and the preview is drawn through an image element so a script inside the file cannot run. Nothing is saved either: reload the page and the form is empty, so copy the record before you leave.