BIMI Record Checker

Validate Brand Indicators for Message Identification (BIMI) records used to display logos in email clients.

Beta Feature

BIMI requires DMARC with p=quarantine/reject and a verified SVG logo hosted at a specific URL. Full BIMI certificate validation is planned for the next update.

Our BIMI Checker retrieves the BIMI record at default._bimi.yourdomain.com, validates the logo URL and any Verified Mark Certificate, and confirms the DMARC prerequisites are met. BIMI is what puts your brand logo beside your messages in supporting inboxes.

What is BIMI?

BIMI (Brand Indicators for Message Identification) is a standard that lets mailbox providers display your official logo next to authenticated messages from your domain. Gmail, Yahoo, Apple Mail and Fastmail all support it.

A BIMI record is a DNS TXT record published at default._bimi.yourdomain.com. It contains a link to your logo in a specific SVG profile, and optionally a link to a Verified Mark Certificate that cryptographically attests you own the trademark on that logo.

BIMI is not itself an authentication mechanism. It is a reward layered on top of one: providers only display the logo when your domain already enforces DMARC at quarantine or reject. A domain in monitoring mode gets nothing.

Displays your brand logo beside authenticated messages
Requires DMARC enforcement at p=quarantine or p=reject first
Logo must be SVG Tiny Portable/Secure format
Gmail and Apple Mail additionally require a Verified Mark Certificate
Supported by Gmail, Yahoo, Apple Mail and Fastmail

Why BIMI Matters

BIMI is the most visible return on the invisible work of email authentication. Recipients cannot see that your SPF, DKIM and DMARC are correct — but they can see your logo, and its presence is a trust signal at the exact moment they decide whether to open a message.

Its deeper value is as a forcing function. BIMI cannot be enabled without DMARC enforcement, so pursuing it commits an organisation to finishing the authentication work it may otherwise leave at p=none indefinitely.

Makes authentication visible to recipients as a trust signal
Requires and therefore drives DMARC enforcement
Reported to improve open rates and brand recall in sender studies
Helps recipients distinguish genuine mail from impersonation attempts
Increasingly expected of established consumer brands

How This BIMI Checker Works

The tool retrieves the BIMI record and checks it against the prerequisites providers enforce.

Validates the domain input against format and SSRF safety checks
Queries DNS for a TXT record at default._bimi.yourdomain.com
Parses the l= logo URL and a= certificate URL tags
Checks that the DMARC policy is at quarantine or reject
Reports whether the record meets the requirements for logo display

How to Use the BIMI Checker

Enter your domain name in the input field
Run the check to retrieve the BIMI record
Confirm the l= tag points to a reachable SVG logo over HTTPS
Check whether a VMC is present in the a= tag
Verify your DMARC policy is at quarantine or reject, since BIMI is ignored without it

Understanding Your BIMI Results

A BIMI record has only a few tags, but each has strict requirements:

Field / Value	Meaning
`v=BIMI1`	The version tag. Required, and it must be the first tag in the record.
`l=`	The HTTPS URL of your logo. It must be SVG Tiny Portable/Secure — ordinary SVG files are rejected. The file should be square and ideally under 32KB.
`a=`	The HTTPS URL of your Verified Mark Certificate in PEM format. Optional in the standard, but required in practice by Gmail and Apple Mail.
`DMARC policy`	Must be p=quarantine or p=reject, with pct=100. A record at p=none disqualifies you regardless of how correct the BIMI record itself is.
`Empty l=`	An l= tag with no value explicitly declares that no logo should be shown, which suppresses any provider-generated avatar.

Common Problems & How to Fix Them

Almost always the DMARC policy. BIMI is ignored entirely unless your domain enforces DMARC at p=quarantine or p=reject with pct=100.

Check your DMARC record first. If it is at p=none, no amount of BIMI configuration will produce a logo. Move to enforcement once your legitimate senders are aligned.

Note also that Gmail requires a Verified Mark Certificate, so a valid record with a logo but no VMC still shows nothing there.

BIMI requires SVG Tiny Portable/Secure — a restricted profile that forbids scripts, external references and animation. A normal SVG export from a design tool will not pass.

Convert your logo using a BIMI-specific conversion tool, ensure it is square, keep it under 32KB, and serve it over HTTPS with a valid certificate. The SVG must include a title element and use a fixed viewBox.

Gmail and Apple Mail require a VMC. Yahoo and Fastmail will display a logo without one.

A VMC is issued by DigiCert or Entrust and requires a registered trademark on the exact logo, which typically takes months to obtain and carries an annual cost. Plan for the trademark registration timeline before committing to a BIMI launch date.

This is the expected difference. Yahoo accepts a self-hosted logo with no certificate; Gmail requires a VMC backed by a registered trademark.

If Gmail display matters to your programme, the VMC is unavoidable. Otherwise the record still delivers value in the providers that do not require one.

Both the logo and the certificate must be served over HTTPS with a valid, trusted certificate. Mailbox providers fetch them directly and will silently skip display on any failure.

Verify both URLs load in a browser with no certificate warnings, and ensure the host is publicly reachable without authentication.

Best Practices

Reach DMARC enforcement at p=quarantine or p=reject with pct=100 before configuring BIMI
Convert the logo to SVG Tiny Portable/Secure, not ordinary SVG
Use a square logo that remains legible at very small sizes
Host both the logo and the VMC on a reliable HTTPS endpoint
Obtain a Verified Mark Certificate if Gmail display matters to you
Begin the trademark registration process early, since it gates the VMC
Monitor the logo URL for availability, as an outage removes the logo everywhere

Security Recommendations

Never publish BIMI before DMARC enforcement, since the record achieves nothing without it
Serve the logo from infrastructure you control, not a third-party CDN that could be compromised to swap your brand mark
Monitor the logo and certificate URLs for unauthorised changes
Keep the VMC renewed — an expired certificate silently removes your logo from Gmail
Treat BIMI as a visibility layer, not a security control; it proves authentication passed, it does not create it
Watch for lookalike domains publishing BIMI records with your logo, which is a brand impersonation signal worth acting on

Frequently Asked Questions

BIMI is a standard that displays your brand logo next to authenticated emails in supporting inboxes. It is published as a DNS TXT record at default._bimi.yourdomain.com and requires DMARC enforcement to take effect.

Yes, and at enforcement. Your DMARC policy must be p=quarantine or p=reject with pct=100. A domain at p=none is ignored by every BIMI implementation, no matter how correct the BIMI record is.

A VMC is a certificate issued by DigiCert or Entrust that cryptographically attests you own the trademark on your logo. Gmail and Apple Mail require one before displaying a BIMI logo. It requires a registered trademark and carries an annual cost.

Gmail, Yahoo, Apple Mail and Fastmail are the main supporters. Gmail and Apple Mail require a VMC; Yahoo and Fastmail will display a logo without one. Microsoft has announced support but rollout has been limited.

SVG Tiny Portable/Secure — a restricted SVG profile that forbids scripts, external references and animation. A standard SVG export will not be accepted. The image should be square and ideally under 32KB.

The DNS record and the logo cost nothing. The Verified Mark Certificate is the expense, typically running to several hundred dollars or more annually, and it requires a registered trademark which itself takes months and costs money to obtain.

Once DNS has propagated and the prerequisites are met, logos generally begin appearing within a few days. Providers cache aggressively, and some apply their own reputation thresholds on top of the technical requirements, so a newly enforcing domain may wait longer.