BIMI Setup Guide for MSPs: CMC and VMC Step by Step

1 Prepare the SVG logo file

The logo must be in SVG Tiny PS format — not a regular SVG. Most design tools export standard SVG by default, which will not pass certificate authority validation. The specific requirements are:

<svg
  xmlns="http://www.w3.org/2000/svg"
  xmlns:xlink="http://www.w3.org/1999/xlink"
  baseProfile="tiny-ps"
  version="1.2"
  width="96"
  height="96"
  viewBox="0 0 96 96"
>
  <title>TechCorp Ltd</title>
  <desc>TechCorp Ltd brand logo</desc>
  <!-- logo content -->
</svg>

The logo should be the primary brand mark centred in a square frame. Many logos designed for web or print need adjustments before they pass BIMI validation — embedded fonts, external font references, and filter effects are common rejection causes. The CA's submission portal will validate the file before accepting it.

2 Apply for a CMC from a certificate authority

The following certificate authorities issue CMCs. Each has its own submission portal and validation process, but all require domain control verification and logo review.

Submit the SVG file and complete domain control verification (typically via DNS or email). Review times range from hours to a few business days. Once approved, the CA delivers an entity certificate PEM file. You will also need to download any intermediate CA certificates and the root CA certificate from the same CA — these need to be appended to the PEM file in chain order before hosting.

-----BEGIN CERTIFICATE-----
[Entity certificate — issued to your domain]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[Intermediate CA certificate]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[Root CA certificate]
-----END CERTIFICATE-----

3 Host the SVG and PEM files on a public HTTPS server

Both files must be hosted at stable, publicly accessible HTTPS URLs. The server must use TLS 1.2 or later with a valid certificate from a trusted root CA. Important constraints:

• The URL must be reachable by external mail servers — no VPN, no authentication required
• Choose a stable URL that will not change — the DNS record points to it, and changing the URL later means updating DNS and waiting for propagation
• AWS S3 with public access, Cloudflare R2, or a static file server all work well
• The file does not need to be on the same domain as the sending domain — a CDN subdomain is fine

Verify both URLs load correctly in a browser before proceeding. Check that the SVG renders and the PEM returns the raw certificate text starting with -----BEGIN CERTIFICATE-----. Some S3 configurations serve PEM files with an incorrect content type — the file content itself is what matters, not the MIME type.

4 Add the BIMI assertion TXT record to DNS

Create a DNS TXT record at default._bimi.yourdomain.com with the following value:

Note that l= (lowercase L) is intentionally empty when using a PEM file — the SVG is embedded inside the PEM by the CA during issuance, so you do not need to link it separately. The a= tag points to the hosted PEM file URL.

5 Verify and wait for propagation

DNS propagation can take up to 48 hours, though most resolvers pick up TXT record changes within a few minutes to an hour. While waiting, verify the record is returning the expected value:

Once DNS has propagated, use the BIMI Group's inspector tool to validate the full chain. It checks the DNS record, fetches the PEM file, and verifies the certificate against known roots. A passing result means the logo should appear within 48 hours in Gmail, Apple Mail, and Yahoo Mail.

Note that Gmail caches BIMI lookups aggressively. If you make a correction to the SVG or PEM after initial setup, expect a delay before recipients see the updated logo.

0 Register the logo as a trademark (VMC prerequisite only)

This step has nothing to do with DNS or certificate authorities — it is a legal process with the relevant intellectual property office. In the US, that is the USPTO; in the EU, the EUIPO; in the UK, the IPO. Different CAs accept different trademark registries, so confirm the CA's accepted list before starting.

For clients already holding a registered trademark on their logo, this step is complete and the remaining process is the same as the CMC path. For clients without a trademark, the CMC path is the practical choice unless they specifically need the Gmail checkmark and are willing to wait.

1–5 Steps 1–5: Same as the CMC path

Once the trademark is in hand, follow the exact same steps as the CMC path: prepare the SVG logo file, apply to a CA (DigiCert, Entrust, or GlobalSign all issue VMCs), assemble the certificate chain, host the PEM file, and publish the BIMI TXT record. The DNS record format is identical.

VMC costs are substantially higher (~$1,400–$1,800/year) and the CA will require proof of the trademark registration as part of the application. Once issued, the Gmail blue checkmark appears next to messages from that domain — visible to recipients in both Gmail desktop and mobile.