BIMI Checker

BIMI is a reward for finishing DMARC, and the DMARC part is checked first. The domain must publish a DMARC record with p=quarantine or p=reject, pct must be 100 (or absent, which means 100), and sp must not be none. If the record is on a subdomain, the organisational domain must meet the same bar. A domain at p=none can publish a perfect BIMI record and no provider will ever show the logo. Our tool runs this check and reports the reason when the policy falls short.

Beyond DMARC, each message has to pass. A message that fails alignment gets no logo even when the domain qualifies, and providers also apply a reputation threshold, so a brand new domain sees nothing for a while. Then the record itself, published at default._bimi under the domain:

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"
                                                            │                                     │
                                                    SVG Tiny PS logo over HTTPS        certificate chain in PEM

Both URLs must be HTTPS and must load without redirects for most providers. A record with an empty l tag (v=BIMI1; l=;) is valid and means the domain declines to have any logo shown, which is useful for a parent domain whose subdomains each carry their own.

The logo must follow SVG Tiny PS (Portable/Secure), a profile of SVG Tiny 1.2 defined specifically for BIMI so that mail clients can render it without executing anything. A normal SVG exported from Illustrator or Figma fails the profile and has to be converted.

• The root element declares baseProfile="tiny-ps" and version="1.2".
• A title element is required, and providers use it as the accessible name.
• The viewBox must be square, and the logo should fill it with a solid background, because it is shown in a circle or rounded square at about 32 pixels.
• No script, no external references (including fonts and images), no animation, no filters, no xlink:href to anything outside the file.
• No x or y attributes on the root element, and the file should stay under 32 KB.
• Served over HTTPS with a valid certificate.

The VMC issuers each publish a converter and a validator, and the logo embedded in a VMC must be byte-for-byte identical to the one at the l URL. If the logo is changed, the certificate has to be reissued.

A Verified Mark Certificate is an X.509 certificate, issued by DigiCert or Entrust after identity checks, that binds a logo to a domain and to a registered trademark. The issuer verifies the trademark with the relevant office (USPTO, EUIPO, UKIPO, JPO and others) and embeds the SVG inside the certificate. Gmail requires a VMC to show the logo and adds a blue verified checkmark next to the sender name. Apple Mail requires a VMC as well.

A Common Mark Certificate arrived in 2024 for brands without a registered trademark. The requirement instead is evidence the logo has been in use for at least 12 months, such as archived web pages. Gmail displays the logo with a CMC but without the checkmark. Both certificates are renewed yearly and are published as a PEM file containing the leaf certificate and the intermediates, at the URL in the a tag.

Yahoo Mail, AOL and Fastmail show the logo from the l URL alone, once DMARC is enforced and the domain has sending reputation. So a domain without any certificate still gets partial coverage, which our tool reports as usable without VMC.

BIMI records are also read by some corporate gateways and by security tools that use the logo in threat analysis, so the record is worth publishing even for a domain whose recipients are mostly on Outlook.

Query the TXT record at default._bimi under the domain. To check a different selector, replace default with the selector name from the BIMI-Selector header. The DNSX API adds the DMARC check and parses the l and a tags. To test the logo itself, fetch it with curl and confirm the response is 200 with an SVG body.

$ dig TXT default._bimi.example.com +short
"v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"

$ curl -sI https://example.com/brand/logo.svg | head -1
HTTP/2 200

$ curl -s https://api.dnsx.dev/email/bimi/example.com | jq '.usable, .dmarc_requirement.reason'