BIMI Record Checker

BIMI is the reward for finishing DMARC. Once a domain rejects or quarantines mail that fails authentication, it can publish a logo record, and mailbox providers that support BIMI show the brand mark next to every authenticated message. The record itself is one line of DNS. The failures are elsewhere: a policy that is not strict enough, a logo file that is not the right kind of SVG, or a certificate that Gmail expects and does not find. This checker tests all three.

What the checker does

Enter a domain and the tool:

1. Reads default._bimi.yourdomain.com (or another selector) and parses the v=, l= and a= tags.
2. Reads _dmarc.yourdomain.com and confirms the policy meets BIMI’s requirement: p=reject, or p=quarantine at pct=100, with no sp=none.
3. Fetches the logo URL when the host allows cross-origin reads and tests it against the SVG Tiny Portable/Secure profile: the tiny-ps base profile, a title element, a square viewBox, no external references or scripts, and a size under 32 KB.
4. Shows the logo as it will render at avatar size, and links to the certificate if one is referenced.

All lookups run through public DNS over HTTPS from your browser.

The record

default._bimi.example.com   TXT   "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

The selector is almost always default. Some brands publish several logos under different selectors and choose one per message with a BIMI-Selector header; the checker’s selector field covers that case.

If the DNS name is a CNAME, the record it points to must contain the BIMI TXT. A CNAME to a hostname with no v=BIMI1 record is the same as no record, which is a common mistake when a DNS provider’s template creates the name without the value.

DMARC first

BIMI exists to reward authenticated mail, so the specification requires enforcement. The checker reads the DMARC record and applies the rules:

• p=reject: qualifies.
• p=quarantine with pct=100 (or no pct tag): qualifies.
• p=quarantine at a lower pct, or p=none: does not qualify.
• sp=none on the organisational domain: does not qualify, because subdomains would be unprotected.

If the policy is not there yet, do not jump straight to reject to get a logo. Publish p=none with reporting from the DMARC generator, read the reports in the DMARC report analyzer until the pass rate is above 98%, then step up. The logo is worth nothing if the enforcement behind it sends your own invoices to spam.

The logo file

Mailbox providers render the logo themselves, inside a circle or rounded square at small sizes, so the format is deliberately restricted. The SVG Tiny Portable/Secure profile means:

• <svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" ...>
• A <title> element with the brand name
• A square canvas: viewBox="0 0 400 400" or similar, with the mark centred and a solid background
• No <image> elements, external stylesheets, fonts, links, scripts or animation
• Under 32 KB

Most design tools cannot export this profile directly. Export a plain SVG, then convert it with the BIMI Group’s tool or a converter that writes the Tiny PS header and strips unsupported elements, and host the file on HTTPS with a stable URL. The checker reads the file when the host permits it; when it does not, the preview still shows whether the file loads as an image.

Certificates

A Verified Mark Certificate ties the logo to a registered trademark and costs on the order of $1,000 to $1,500 a year from DigiCert or Entrust. A Common Mark Certificate, introduced in 2024, accepts a logo that has been in use for a year instead of a trademark, at a lower price. Gmail and Apple Mail require one of them; Yahoo shows logos from a valid record alone. The a= tag points to the PEM file, which the checker links to but does not validate; the issuing authority’s tools do that.

Troubleshooting: the record is valid but no logo shows

Work through these in order, because each one is invisible to a DNS check:

1. The mail is not passing DMARC. Logos are attached only to authenticated messages. Send a test to a Gmail address and read the headers in the header analyzer; dmarc=pass must be there, and for Gmail the BIMI line in Authentication-Results should read pass.
2. The From domain is a subdomain. BIMI looks up default._bimi on the exact From domain first and falls back to the organisational domain. If you send from news.example.com, either publish the record there too or make sure the fallback domain has it.
3. No certificate for a provider that wants one. Gmail and Apple Mail show nothing without a VMC or CMC, however good the record and logo are. Yahoo is the place to confirm the record works before you buy one.
4. Reputation is still building. Gmail applies BIMI only to senders with an established, positive history. New domains and domains recovering from a spam problem wait longer; check the sender reputation checker for anything that would hold it back.
5. The SVG fails the profile silently. Providers do not report why a logo was rejected. If every other box is ticked, re-export the logo with a converter that writes the Tiny PS header and strips unsupported elements, and keep it under 32 KB.
6. Caching. Providers fetch the logo on a schedule, not on every message. Changes to the file or record can take a day or two to appear.

After it works

Logos appear only on mail that passes DMARC, so every source that sends as your domain has to be authenticated, not just the marketing platform. Check each one with the DKIM checker and SPF checker, and keep reading aggregate reports so that a newly connected tool does not quietly send unbranded, or unauthenticated, mail. Our rankings of email platforms note which vendors publish BIMI on their own domains; it is a fair test of whether a vendor practices what it sells.