[ BIMI & brand ]

BIMI DNS syntax, selectors and record discovery

Read BIMI tags and discovery as versioned protocol behavior, not as a record to paste blindly.

By the EmailAuth research team

[ Key points ]

  • Keep the BIMI selector separate from the DKIM selector.
  • Draft -15 contains conflicting fallback descriptions; avoid relying on an assumed universal fallback.
  • A syntax pass is not a receiver display result.
On this page

BIMI discovery connects a message's From domain and selector to a DNS assertion. The important question is which record a receiver is entitled to use, not whether any TXT value happens to contain the word BIMI. This article follows draft-brand-indicators-for-message-identification-15, an October 2026 Internet-Draft, rather than presenting it as a published RFC.

Annotate the assertion

References: Source §4.3.

In v=BIMI1; l=https://assets.example/logo.svg; a=https://assets.example/mark.pem, v identifies the protocol version, l points to the indicator and a points to authority evidence. The draft requires the version first and exact case. It allows an empty authority location; an optional tag at protocol level does not remove a receiver's certificate requirement. The example uses two URLs for clarity, while Google's current PEM-based example can use an empty l with the certificate location in a. Follow the applicable receiver path rather than assuming every syntactic variant creates the same display result.

The draft borrows DKIM tag-value syntax. Repeating a tag is not a way to define alternatives. Unknown tags are ignored by the specified extension model; they are not permission to invent new semantics. Keep unknown-tag handling distinct from an invalid required value.

Follow the discovery name

References: Source §5.1, Source §6.4, Source §7.2.

Without an explicit BIMI selector, the default selector is used. An explicit selector is carried in BIMI-Selector; it is not automatically the DKIM s value. For a message from notices.example.com and selector seasonal, the initial name is seasonal._bimi.notices.example.com. Section 7.2 step 6 preserves that selector in its organizational fallback algorithm. However, section 6.4 describes fallback to the default assertion on the Organization domain. These statements conflict within draft -15. This article describes the section 7.2 algorithm, not a universal deployed behavior: verify the intended receiver implementation before relying on either fallback. Publish the intended selected assertion directly where practical rather than designing around this unresolved inconsistency.

Draft -15 also describes local-part selector behavior through lps. That is a version-sensitive feature: document which implementation supports it before designing a campaign around it. The private review package’s parser fixture does not implement local-part normalization, header authentication, organizational-domain calculation or receiver caching.

Inspect the complete answer

References: Source §7.2.

A TXT record may consist of multiple character strings that form one logical value. That differs from two separate eligible assertion records. The draft's discovery procedure stops if the eligible record set is not unique. Query the full set and preserve quoting boundaries in the captured answer. A DNS control panel preview can hide this distinction.

The private review package’s bounded parser cases accept the ordinary example within the supported subset, reject duplicated assertions, detect repeated l tags, reject HTTP locations, reject a wrongly cased version, and accept an otherwise valid record containing an unknown future tag. These are executed decision tests, not observed responses from a mailbox provider. Their narrow parser should not be installed as a production validator.

Make a controlled correction

Correct the specific record name or value, re-query the authoritative server, and then inspect a recursive answer after the relevant cache interval. Retain both answers and the previous record. Re-test the actual receiving provider before declaring display restored. Changing DKIM selectors, DMARC policy or mail routing is not an appropriate blanket fix for a BIMI TXT syntax problem.

[ Takeaway ]

A syntax pass is not a receiver display result.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Capture record sets, not screenshots of one value

Keep the exact technical artifact and the observed result linked.

Next steps

  1. Capture record sets, not screenshots of one value.
  2. Retain commands, outputs and hashes for another operator.

CISO / SecOps

Test the exact sender and selector

A logo signal does not authorize a business request or replace independent controls.

Next steps

  1. Test the exact sender and selector.
  2. Preserve payment-verification and account-compromise controls.

Founder / Non-technical

Keep draft version attached to protocol claims

Treat the desired brand experience as a scoped project with visible release conditions.

Next steps

  1. Keep draft version attached to protocol claims.
  2. Approve the launch only with its remaining evidence gaps stated.

[ FAQs ]

Frequently asked questions

Is the BIMI selector the DKIM selector?

No. They are separate mechanisms, even if an operator chooses similar names.

BIMI Internet-Draft -15 dated 31 October 2026

What is the default selector?

default, when the applicable message does not specify another BIMI selector.

BIMI Internet-Draft -15 dated 31 October 2026

Are two TXT strings always duplicate records?

No. Character strings within one TXT resource record are joined; separate records are different.

BIMI Internet-Draft -15 dated 31 October 2026

Should unknown tags fail the entire record?

Draft -15 says unknown tags are ignored. Invalid known required fields are a different case.

Does fallback always use default?

Draft -15 is internally inconsistent: section 7.2 step 6 preserves the selected selector, while section 6.4 describes default fallback. Verify the intended implementation rather than assuming either behavior universally.

BIMI Internet-Draft -15 dated 31 October 2026

Is the fixture a full BIMI implementation?

No. It tests only the documented syntax subset and uniqueness cases.

Can an optional authority tag be omitted for every receiver?

No. Optional syntax in the draft does not override a receiver's certificate requirements. Google's documented deployment path requires a VMC or CMC even though the general assertion format permits absent or empty authority evidence.

Which domain starts the BIMI lookup?

Draft -15 begins with the RFC5322.From Author Domain and the applicable BIMI selector. The lookup does not automatically use the envelope sender domain or the DKIM signing domain.

[ Sources ]

Sources

  1. BIMI Internet-Draft -15 dated 31 October 2026

    Sections §4.3 · §5.1 · §6.4 · §7.2

  2. Google Workspace Set up BIMI

    Sections Before you begin · SVG requirements · Steps 2–4

[ Glossary ]

Glossary

Selector
A name choosing a BIMI assertion within a domain.
Tag-value syntax
Semicolon-separated named fields with specified parsing rules.
Organizational fallback
A later organizational-domain lookup. Draft -15 gives conflicting selector fallback descriptions; see the discovery caveat.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base