BIMI record generator: how do you build a v=BIMI1 TXT record?
How does this check work, and what does the result tell you?
AdminKit's BIMI record generator assembles the exact v=BIMI1 TXT record string from the SVG logo URL and optional Verified Mark Certificate (VMC) URL you enter — entirely in your browser, with nothing sent to any server. You still need to publish the result in your DNS, and it only does anything once your domain's DMARC policy is already enforced.
Part of the Email authentication cluster — more tools, guides and terms on email authentication.
Required, must be https:// and point to an SVG Tiny Portable/Secure (PS) logo.
Optional, must be https:// if set. Some mailbox providers require a VMC to display the logo; others don't.
- A logo URL is required for the l= tag.
What the result means
This is the record text built from the logo and VMC URLs you entered — it says nothing about what your domain currently publishes, whether your DMARC policy is enforced, or whether the logo file itself is actually a valid SVG Tiny Portable/Secure (PS) image. To see what is actually live in DNS today, and whether the DMARC prerequisite is met, run AdminKit's BIMI check.
Next step
Before publishing, confirm your domain's DMARC policy is already enforced at p=quarantine or
p=reject with AdminKit's
DMARC check — BIMI will not
display anywhere without that. Then publish the record above as a TXT record at
default._bimi.<your domain> and confirm it with the live
BIMI check once DNS has
propagated.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up if something changes? That's early access, not a live feature yet — tell us and we'll set it up by hand.
How it works and limits
Fill in your logo’s SVG URL and, if you have one, a Verified Mark Certificate (VMC) URL below, and this tool
assembles the exact v=BIMI1 TXT record string as you type, entirely in your browser — nothing you enter is sent to
AdminKit or anywhere else, and it does not fetch the logo file or validate a VMC certificate chain. Once you are
happy with the result, publish it as a TXT record at default._bimi.<your domain>, then confirm it took effect with
AdminKit’s live BIMI check, which queries DNS for real.
What does a BIMI record actually need?
BIMI (Brand Indicators for Message Identification), defined in an
Internet-Draft maintained by the AuthIndicators Working Group,
is not yet a full internet standard — unlike DMARC, which is defined in
RFC 7489. A record published at default._bimi.<domain> carries two tags:
v=BIMI1— the fixed version tag, always first.l=— required, anhttps://URL to the logo, which must be SVG Tiny Portable/Secure (PS), a restricted SVG profile without scripting or external references.a=— optional, anhttps://URL to a Verified Mark Certificate (VMC) from a commercial certificate authority. See the BIMI Group for background on how VMCs fit into BIMI’s trust model.
Why won’t my logo show up just because I published a record?
BIMI’s trust model depends on the domain’s DMARC policy already being enforced at p=quarantine or p=reject
(RFC 7489 §6.3 defines these as the two policies that act on failing mail,
unlike p=none). A BIMI record sitting on top of a p=none DMARC policy is syntactically valid but inert — no
supporting mailbox provider will display the logo. Confirm enforcement first with AdminKit’s live
DMARC check, since no amount of BIMI record tuning changes that outcome.
Limits
- This tool only builds the record text. It never queries DNS, never fetches your logo file, never validates a VMC certificate chain, and never publishes anything — you still have to add the record to your own DNS and confirm it with a live check.
- It validates that the URLs you enter use
https://and warns when the logo URL doesn’t look like an SVG file or when no VMC is set, but it cannot verify the logo actually conforms to the SVG Tiny PS profile or that a VMC is currently valid — for that, consult a VMC-issuing certificate authority directly.
See SPF, DKIM and DMARC explained for the prerequisite chain BIMI sits on top of, and AdminKit’s live BIMI check to confirm both the record and the DMARC-enforcement prerequisite once published. Check your SPF record too, since it’s one of the two authentication mechanisms DMARC alignment relies on.
Frequently asked questions
Does this tool send anything to AdminKit's servers?
No — the logo and VMC URLs you type are read directly by your browser, and the record string is built there with plain JavaScript. Nothing you enter is sent to AdminKit or anywhere else. That also means it cannot check what your domain currently publishes, fetch your logo file, or validate a VMC certificate chain; for the live, DNS-querying version, use AdminKit's BIMI check.
I built a record here — will my logo show up once I publish it?
Not by itself. A BIMI record only matters once your domain's DMARC policy is already enforced at p=quarantine or p=reject (RFC 7489 §6.3 defines these as the two policies that act on failing mail, unlike p=none) — a BIMI record sitting on top of p=none is published but inert. Use AdminKit's live DMARC check to confirm enforcement first, then publish this record and confirm it with AdminKit's live BIMI check.
Why does the tool warn me if my logo URL doesn't end in .svg?
The BIMI Internet-Draft requires the logo be SVG Tiny Portable/Secure (PS), a restricted SVG profile without scripting or external references — not a regular SVG, PNG or JPG. This tool only checks the file extension as a simple honesty check; it does not fetch or validate the file's actual contents against the SVG Tiny PS profile.
Do I need a Verified Mark Certificate (VMC) to fill in the a= tag?
Not always. The a= tag is optional and references a VMC from a commercial certificate authority — several major mailbox providers only display the logo when a valid VMC is present, while others will show it from the DNS record and a plain SVG logo alone. This tool builds a valid record either way and flags which mailbox-provider behavior applies when the field is left blank.
Is BIMI an official internet standard like SPF or DMARC?
Not yet — BIMI is an Internet-Draft maintained by the AuthIndicators Working Group ("Brand Indicators for Message Identification"), not a published RFC, unlike DMARC (RFC 7489) or SPF (RFC 7208). Several major mailbox providers implement it anyway, but its tags and requirements can still change before any eventual standardization.