Hosted BIMI

Included with every Email Authentication tier, Free included, on any active domain. Your DMARC policy must be at p=quarantine or p=reject first.

1. What This Feature Does

BIMI (Brand Indicators for Message Identification) puts your logo beside your messages in mailboxes that support it. It works through a TXT record at default._bimi.<your domain> that names two things:

• l= — where your logo is, an SVG file in the SVG-Tiny PS profile, served over HTTPS.
• a= — optionally, where your Verified Mark Certificate (VMC) is.

Hosted BIMI gives you:

• The BIMI record, published and kept current. Change the logo or certificate here and the record follows.
• Logo hosting: upload your SVG and CertaDNS serves it at https://bimi.certadns.com/…. Or keep your logo on your own site and give its URL.
• A check of your logo against SVG-Tiny PS before it goes live, with the specific problems listed.
• An eligibility check against your live DMARC policy, and an alert if the logo stops being eligible to display.

2. When You Should Use It

• You send mail from your own domain and want your logo shown next to it.
• Your domain's DMARC policy is at quarantine or reject — or you are about to get it there with the DMARC Policy Wizard.
• You have a square logo you can export as SVG, and — for Gmail and Apple Mail — a Verified Mark Certificate, or can get one.

3. When You Should Not Use It

• Your DMARC policy is still p=none. CertaDNS will not save a BIMI configuration until it is at quarantine or reject, applies to all mail (no pct below 100) and does not set sp=none, because mailboxes would ignore it.
• The domain is parked. Parked domains cover DMARC and DKIM only. Activate the domain first (see Prerequisites).
• The domain does not send mail. There is nothing for a logo to appear beside.

4. Prerequisites

• The domain added under Email Authentication > Add Domains and active — it uses one of your plan's domain slots. To activate a parked domain, go to Email Authentication > Manage Domains and click the activate icon on its row. Managed DNS is not required.
• A DMARC record configured in CertaDNS (Hosted Services > Hosted DMARC) at p=quarantine or p=reject.
• Your logo as an SVG-Tiny PS file: square, with a <title> naming your brand, no scripts and no external references.
• Optionally, a Verified Mark Certificate from a certificate authority that issues them, billed by that authority. A VMC is valid for a limited period and must be renewed with the authority that issued it. CertaDNS does not currently track your VMC’s expiry date — keep a renewal reminder of your own, because an expired VMC stops the logo appearing and mailbox providers do not tell you.
• If your domain's DNS is hosted elsewhere: access to add one CNAME at your DNS host. On Managed DNS you add nothing.

5. How It Works (Brief)

When you save a configuration, CertaDNS builds the BIMI record from your logo and certificate URLs and publishes it straight away. Where it is published depends on where your DNS lives:

A mailbox that supports BIMI reads the record, fetches the logo (and certificate, if named) and decides whether to show it. CertaDNS keeps checking your live DMARC policy for eligibility, and — on a domain with DNS elsewhere — that your CNAME is still in place.

6. How to Use It

Everything below is in Email Authentication > Hosted Services > Hosted BIMI, unless it says otherwise.

Set up BIMI

1. Click Add BIMI.
2. Choose the Domain. Leave Selector as default unless you have a reason not to.
3. Under Logo source, choose one:
   • Upload to CertaDNS — pick your SVG file. It is checked the moment you pick it. CertaDNS hosts it at bimi.certadns.com/<domain>/<selector>.svg.
   • Use my own URL — enter the HTTPS URL of your logo and click Validate to have CertaDNS fetch and check it.
4. Optionally enter your VMC URL.
5. Click Create configuration. The configuration shows default._bimi.<your domain> with a Published badge once the record is out; expand Published record to see it.

Create the CNAME (DNS hosted elsewhere)

1. Go to Email Authentication > Manage Domains and click the pencil (Edit this domain's setup) on the domain's row.
2. The BIMI logo card shows the Name and the Points to value. Create that CNAME at your DNS host.
3. Click Check again. The card turns Live once the CNAME resolves to your published record. DNS changes can take up to an hour to appear.

Change the logo or certificate

Click the settings icon (Edit) on the configuration. You can switch between an uploaded logo and your own URL, pick a new file, or change the VMC URL, then click Save changes. The record is republished; for an uploaded logo the address changes with each upload, so mailboxes fetch the new one. The domain cannot be changed on edit — delete and recreate to move it.

Check whether the logo can display

Go to Email Authentication > Reporting > BIMI Reporting. Each domain shows Eligible to display or Not displaying — judged on the policy, its percentage and the subdomain policy, the same rule as the alert — with the reason, and whether a VMC is attached. A domain below enforcement has a Raise the policy link.

Remove BIMI

Click the delete icon on the configuration and confirm Delete BIMI record. The record is withdrawn from DNS and mailboxes stop showing your logo. On a domain with DNS elsewhere, you can then delete the CNAME at your DNS host.

7. Inputs and Settings

The logo check

Errors stop the logo being saved; warnings are shown but do not.

• Errors: not valid XML; a document type or entity declaration; root element not <svg>; baseProfile not tiny-ps; version not 1.2; viewBox missing, malformed or not square; <title> missing or empty; an element SVG-Tiny PS forbids; a scripting attribute; a reference to an external resource; a file over 64 KB.
• Warnings: a file over 32 KB; no xmlns declaration; an element outside the SVG-Tiny PS set; for your own URL, a Content-Type other than image/svg+xml.

8. Outputs and Results

• The BIMI record, shown under Published record on each configuration, with a Published badge once it has been published.
• The validation result: SVG-Tiny PS validation passed with the logo's title and size, or each error and warning with its code.
• DNS setup status (DNS hosted elsewhere): the BIMI logo CNAME shows Live, Propagating or Not found in the domain's setup panel.
• Eligibility in BIMI Reporting: Eligible to display or Not displaying.

Alerts

Which alerts a domain sends is set under Email Authentication > Manage Domains, in the domain's Alert monitoring panel. How they reach you — in the dashboard, by email — is in Settings > Notifications, under Email authentication.

• Your BIMI logo stopped being eligible — the DMARC record being served is no longer at quarantine or reject, applies to less than 100% of mail, or sets sp=none. You are told again when it recovers. Included in the Comprehensive preset; not in the recommended Balanced one.
• A published record stopped being served — the BIMI CNAME was working and is no longer. Included in every preset except None.

9. How to Interpret Results

Normal

• Published, the CNAME Live (if your DNS is elsewhere), and Eligible to display. Mailboxes cache BIMI, so the logo can take a while to appear after you first publish.
• Warnings on an otherwise valid logo. They are worth fixing, but the logo is accepted.

Worth investigating

• Not displaying — DMARC has dropped below quarantine. Raise it again.
• Published but the CNAME is Not found — the record exists at CertaDNS, but nothing points at it from your domain, so mailboxes cannot see it.
• No VMC — Gmail and Apple Mail will not show the logo, whatever else is right.

Common mistakes

• Reading Eligible to display as "my logo is showing". It means the DMARC policy qualifies. Each mailbox provider still applies its own requirements, including a certificate and sending reputation.
• Letting the VMC lapse. CertaDNS does not track its expiry, and the logo stops appearing without warning.

10. Common Issues and Explanations

"BIMI requires a DMARC configuration on this zone first…"

The domain has no DMARC record configured in CertaDNS. Set one up under Hosted Services > Hosted DMARC, move it to p=quarantine, then add BIMI.

"BIMI requires DMARC at p=quarantine or p=reject. Current policy: …"

Raise the policy first. The DMARC Policy Wizard is under Hosted Services > Hosted DMARC, in Moving to enforcement.

"Hosted BIMI needs … to be an active domain"

The domain is parked. Activate it in Email Authentication > Manage Domains; that uses a slot from your plan.

"logo_url must be HTTPS." or "vmc_url must be HTTPS."

Mailboxes only fetch BIMI logos and certificates over HTTPS. Use an https:// address.

"Logo is larger than 64 KB…"

The file is too large. Simplify the SVG (fewer paths, no embedded images) and aim for 32 KB or less.

"SVG failed SVG-Tiny PS validation; fix the errors below and re-upload."

Each error is listed with its code. Most logos exported from design tools need baseProfile="tiny-ps", version="1.2", a square viewBox and a <title> added, and any embedded images, scripts or external links removed.

"BIMI configuration already exists for this zone with selector '…'."

Edit the existing configuration instead of adding another.

The logo does not appear although everything is green

Mailbox providers cache BIMI and decide for themselves whether to show a logo. Check that a VMC is attached for Gmail and Apple Mail, and allow time after publishing. The free BIMI Checker shows what a mailbox sees.

11. Limits and Constraints

12. Related Features

• DMARC Policy Wizard — reach the enforcement BIMI needs.
• DMARC Reporting — confirm your legitimate mail passes before you enforce.
• Hosted DKIM — working DKIM is what lets you enforce safely.
• MTA-STS & TLS-RPT — the other records published for active domains.
• Free BIMI Checker — look up any domain's BIMI record and check its logo, no account needed.

13. Updates and Behavior Changes

• 30 September 2026. This article now reflects the product as built: on a domain whose DNS is hosted elsewhere you create one CNAME and CertaDNS publishes the record behind it; you can host the logo with CertaDNS or use your own URL; uploads are limited to 64 KB; BIMI needs an active domain. The DMARC Policy Wizard that BIMI's error messages refer to is under Hosted Services > Hosted DMARC.
• 1 October 2026. Setup, BIMI Reporting and the eligibility alert now apply one rule: DMARC at quarantine or reject, for 100% of mail, without sp=none. Reporting used to check the policy alone.
• September 2026. BIMI moved from a paid "Inbox Logo" add-on into every Email Authentication tier.