BIMI checker

The gate comes before the record

BIMI (Brand Indicators for Message Identification) is the standard that puts your logo next to your messages in Gmail, Yahoo Mail, and Apple Mail. Everything about it hinges on one precondition that has nothing to do with logos: your domain's DMARC policy must be at enforcement. That means p=reject, or p=quarantine with pct=100. A domain sitting at p=none can publish the most polished BIMI record in the world and no receiver will look at it.

This is why the checker runs a full DMARC lookup before it reports on the BIMI record itself, and shows the gate result at the top. In our experience, the gate is where most BIMI attempts stall — the record takes ten minutes, the DMARC rollout behind it takes months.

What a BIMI record looks like

default._bimi.example.com → v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

Three tags do all the work. v=BIMI1 identifies the record. l= points to the logo — an HTTPS URL serving an SVG in the Tiny PS profile. a= points to the Verified Mark Certificate. A record with an empty l= is also meaningful: it is an explicit opt-out that tells receivers not to display any logo for the domain, and the checker reports it as such rather than as an error.

What the checker verifies

• DMARC enforcement gate: policy, pct, and subdomain policy from the live DMARC record — reported prominently, pass or fail.
• Record syntax: exactly one v=BIMI1 record at the selector (two records cancel each other out, same as DMARC).
• Logo availability: the l= URL must be HTTPS and must respond. The checker requests it and reports the HTTP status and content type — a 404 logo or one served as text/html shows nowhere.
• Certificate presence: whether an a= tag exists and its URL responds. The checker does not validate the certificate chain itself — that requires parsing the PEM and checking it against Mark Verifying Authorities, which is the certificate issuer's job.

What this tool cannot tell you

Honest limits, because a green check here is not a guarantee of a logo in the inbox. The checker cannot validate the SVG against the Tiny PS profile byte-by-byte (the BIMI Group's validator does that), cannot verify the VMC certificate chain or whether the logo inside it matches the one served, and cannot see receiver-side gates like Gmail's sender-reputation requirement. Domains with new or weak sending reputation wait weeks after everything validates. What the checker does reliably catch is the failure modes that account for most missing logos: DMARC not enforced, a broken logo URL, and a missing certificate.

Is BIMI worth doing?

For most senders it is a late-stage optimization, not a deliverability lever. The logo does not change filtering decisions — authentication does, and by the time you qualify for BIMI you have already done that work. What BIMI buys is recognition in a crowded inbox and a harder target for lookalike phishing. If your DMARC is already at p=reject, the marginal effort is one TXT record, one SVG, and the certificate budget. If your DMARC is not there yet, spend the effort on that instead — our full email DNS audit shows where the domain stands on every layer at once.

Start with the check above; if the gate fails, the DMARC checker shows exactly which tag is holding the rollout back.

Frequently asked questions