Last updated: July 2026

In short: BIMI shows your brand logo next to your emails. After this guide you publish the default._bimi TXT record in the Route 53 console — and know the prerequisites: DMARC, SVG logo, certificate.

Prerequisites

  • A public hosted zone in Amazon Route 53
  • DMARC at enforcement (p=quarantine or p=reject)
  • Logo as SVG Tiny PS and (for Gmail & co.) a VMC
  • An HTTPS server for the logo and certificate

What is BIMI?

BIMI (Brand Indicators for Message Identification) is a TXT record that points to your brand logo. Gmail, Apple Mail, and Yahoo show it next to your authenticated emails. BIMI is not a security method of its own, but the visible reward for clean SPF, DKIM, and DMARC — the last step.

The real work isn’t in the record

As a DNS service, Route 53 is the ideal place to publish the BIMI record — but the prerequisites lie with your mail infrastructure. The BIMI Group names them clearly:

  1. DMARC at enforcement. Your policy must “be at enforcement on the organizational domain and subdomains” — a p=none or a pct under 100 “policies or ‘pct’ less than 100 percent are not accepted”. See DMARC for Route 53.
  2. SVG logo. “Produce an SVG Tiny PS version of your official logo” — square, over HTTPS.
  3. VMC or CMC. In practice needed for display at Gmail & co. (“Highly recommended, but Optional”). Self-asserted BIMI “records have limited support across the various Mailbox Providers”.

Step-by-step guide

1. Check the prerequisites

With the free MXAudit scanner you check SPF, DKIM, and DMARC — DMARC must be at quarantine/reject.

2. Provide the logo and (optionally) certificate

Place the logo as SVG Tiny PS over HTTPS, obtain a VMC/CMC, and serve the .pem file over HTTPS.

3. Create the BIMI TXT record in the Route 53 console

Open your hosted zone and choose Create record — as with the SPF and DKIM record:

FieldValue
Record namedefault._bimi
Record typeTXT
Value"v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

As with all TXT records in Route 53, the value goes in double quotes. Basic scheme per the BIMI Group: default._bimi.[domain] IN TXT with v=BIMI1; l=[SVG URL]; a=[PEM URL]. Without a certificate you leave out a= — it’s “currently optional (reservered for VMC/CMC)”. A real record (ebay.com):

v=BIMI1;l=https://vmc.digicert.com/….svg;a=https://vmc.digicert.com/….pem

Then choose Create records.

4. Wait and check

Route 53 propagates fast (“Changes generally propagate to all Route 53 name servers within 60 seconds”). After that, check the record with the MXAudit scanner or the BIMI Inspector of the BIMI Group.

Common mistakes

Forgot the quotation marks. In the Route 53 Value box the TXT value goes in double quotes.

BIMI without DMARC enforcement. p=none isn’t enough; quarantine/reject is mandatory.

Wrong SVG format. Only SVG Tiny PS, square.

No VMC, expecting Gmail display. Without a certificate the logo usually stays invisible at the large providers.

Further reading