Show your logo in inboxes (BIMI) and mailbox photos

There are two different things here, and it helps to keep them apart.

Mailbox photos#

Open Settings → Domains & addresses, open the domain, and press the camera button on an address. Choose a PNG, JPG or WebP picture, drag and zoom it inside the circle, and press Use this photo. To go back, open the same dialog and press Remove photo.

• Only owners and admins can change a photo. A viewer or a member can see them.
• Pictures can be up to 8 MB to choose; Koltrix crops and shrinks them to a 256 pixel square and keeps nothing else from the file. Location and camera details in the photo are dropped.
• The photo is stored by Koltrix. There is no field for a link, on purpose: a link to another website would be loaded by every teammate's browser.

What shows when an address has no photo#

Koltrix uses the first of these:

1. the address's own photo;
2. your domain's logo, if you have uploaded one for BIMI (below);
3. your workspace logo, from Settings → Workspace;
4. coloured initials.

The same picture is used everywhere: the sidebar's mailbox list, the From picker when you write, the Team access grid, the address list in Settings, and beside messages you sent from that address in Sent and in a conversation.

Your logo in inboxes (BIMI)#

BIMI (Brand Indicators for Message Identification) lets a mail provider show your logo beside mail from your domain. Providers only do it for domains that prove the mail is really theirs.

What to expect, plainly. Gmail shows the logo only when your domain also has a Verified Mark Certificate (VMC), which needs a registered trademark, or a Common Mark Certificate (CMC). You buy that certificate from a provider such as DigiCert or Entrust. Koltrix does not sell or issue it. Other providers differ: some show a BIMI logo without a certificate, some do not support BIMI at all. Without a certificate the record Koltrix gives you is still correct for providers that don't ask for one, and ready for the day you add one.

Koltrix does the parts that are tedious to get right:

• checks your logo and says what to change if it isn't acceptable;
• hosts the logo, and the certificate if you have one, at a public address, so you don't need a web server;
• shows you the exact DNS record, with copy buttons;
• checks your DMARC and your record, and tells you the next step.

Koltrix never adds the DNS record for you, and never fetches an address you type.

Set it up#

Open Settings → Domains & addresses, open a verified domain and find Show your logo in inboxes. Only owners and admins see it.

1. Upload your logo (SVG). The file must be a square SVG Tiny PS: version 1.2, baseProfile="tiny-ps", a square viewBox, a <title>, 32 KB or less, with no scripts, no embedded pictures, no animation and no links to other files. If it isn't acceptable, Koltrix lists each problem and how to fix it. A file with small issues, such as a missing title, is saved with a note; a file with anything unsafe is refused and not stored.

2. We host it for you. The logo is served over HTTPS at https://api.koltrix.com/p/brand/<your domain>/logo.svg. Replace the logo and the address stays the same. If you remove it, the address stops working.

3. Add your certificate (optional). Upload the .pem file from your provider, with its chain. Koltrix checks that it hasn't expired, covers your domain, is for the BIMI purpose, was issued for exactly this logo, and chains to a recognised Mark Verifying Authority. If it passes it is hosted at .../authority.pem. Never upload a private key: Koltrix refuses a file that contains one.

4. Add the DNS record. Add this TXT record where your DNS is managed:

   Type	Name	Value
   TXT	default._bimi.yourdomain.com	v=BIMI1; l=https://api.koltrix.com/p/brand/yourdomain.com/logo.svg

   With a certificate, the value also ends ; a=https://api.koltrix.com/p/brand/yourdomain.com/authority.pem. Some DNS providers want only default._bimi as the name. Copy the record again after you add or remove a certificate.

The live check#

The page checks when it opens (and reuses a result for five minutes), and Check again looks again, at most once every ten seconds. Each line is a pass, "needs a look" or "not passing", with what to do next.

Your mail still needs to pass SPF and DKIM. Mail sent through Koltrix is signed with your domain's key once your DNS records are in place.

Common problems#

• "Different logo" — the certificate was issued for a different SVG. Upload the exact file you gave your provider, or ask for a certificate for this one.
• "Wrong domain" — the certificate names another domain. Ask for one that lists yours.
• "Not recognised" — the file doesn't chain to a Mark Verifying Authority we know. Upload the full chain your provider sent. A CMC from a newer issuer may need adding on our side; tell us.
• The check says the record is missing, but you added it — DNS can take a few minutes. Check again.
• International domain names (with characters outside a–z, 0–9 and -) can't be set up here yet.

More: the BIMI readiness checklist, VMC or CMC and making a Tiny PS logo.