BIMI Checker

🛡 Deliverability & security

Check a domain’s BIMI record — the logo URL, the Verified Mark Certificate, and the DMARC prerequisite.

No sign-up required Runs on our own infrastructure Also available via API

Runs on our diagnostic API. We don’t attach your input to an account for these free tools; short-lived rate-limit/security logs may exist, and requests are rate-limited per IP.

BIMI — Brand Indicators for Message Identification — is the standard that puts your company logo next to your messages in the inbox instead of a grey initials circle. It’s the most visible payoff of getting email authentication right, which is exactly why it trips people up: BIMI is the last brick in the wall, not the first. You can publish a flawless default._bimi record and still see nothing, because the logo only appears once everything underneath it is already in order. This checker reads your record and tells you which piece is missing.

What BIMI actually is

BIMI is a small DNS TXT record that points supporting mailbox providers at your logo. It lives at default._bimi.yourdomain.com and carries two tags that matter: l=, the HTTPS URL of your logo as an SVG file, and a=, the HTTPS URL of a certificate that vouches for that logo. When a receiver like Gmail, Apple Mail or Yahoo processes a message that passes authentication, it looks up this record, fetches the logo, and renders it beside the sender name. BIMI carries no security of its own — it’s purely a display layer that rides on top of authentication you’ve already earned. The spec is still an IETF draft; the practical reference most operators use is the BIMI Group.

DMARC enforcement comes first

This is the requirement people skip. BIMI will not display unless your domain publishes a DMARC policy at enforcement — that means p=quarantine or p=reject, not p=none. Providers also expect that policy to apply to your whole mail stream, so a record hedged with pct= below 100 can hold you back. The logic is simple: a logo is a trust signal, and providers won’t hand you one until you’ve committed to a policy that actually stops spoofers using your domain. If your DMARC is still at p=none while you monitor reports, BIMI is premature — fix the policy first.

The logo and the certificate

The l= tag points to your logo, and it can’t be any old image. BIMI requires SVG Tiny Portable/Secure — a locked-down SVG profile with no scripts and no external references — served over HTTPS. If the file at that URL isn’t valid, the logo silently fails; run it through the BIMI SVG Validator before you trust it.

The a= tag points to a Verified Mark Certificate (VMC) or its newer sibling, a Common Mark Certificate (CMC). This is a certificate a Certificate Authority issues only after verifying you have rights to the mark — for a VMC, that usually means a registered trademark. Gmail requires a VMC; without one, Google shows nothing regardless of how clean the rest of your setup is. Apple Mail also expects one. The two CAs that issue them are DigiCert and Entrust.

Why the logo isn’t showing

When the record checks out but no logo appears, it’s almost always one of these:

  • DMARC not at enforcement. Still p=none, or pct under 100 — the most common cause by far.
  • No VMC where one is required. Gmail and Apple Mail want the a= certificate; a record with only l= works for some providers but not those.
  • The SVG doesn’t conform. Wrong profile, a non-square viewBox, an embedded raster image, or the file simply isn’t reachable over HTTPS.
  • The message itself failed authentication. BIMI only shows on mail that passes DMARC with alignment on this specific message — a broken DKIM signature on that send means no logo, even with a perfect record.
  • Caching. Providers cache logos and certificates; changes can take time to appear, and each provider decides independently whether to display.

For the step-by-step version, see our guide on how to add a BIMI logo to your email. To confirm the whole authentication stack in one pass, run the Email Health Check.

Frequently asked questions

Do I need a VMC for BIMI?
For Gmail and Apple Mail, yes — a VMC is required. Some providers display a logo from just the SVG plus DMARC enforcement, but since most people want the logo in Gmail, a VMC is effectively a must.
Why isn’t my BIMI logo showing even though the record is valid?
Usually DMARC isn’t at enforcement — it must be p=quarantine or p=reject, not p=none. Also check for a missing VMC, a non-conforming SVG, or the message itself failing DMARC.
Where does the BIMI record go?
A DNS TXT record at default._bimi.yourdomain.com, holding v=BIMI1, the l= logo URL, and usually an a= certificate URL. Build one with the BIMI Record Generator.
Does BIMI improve deliverability?
Not directly — it’s a display feature, not a filtering signal. The upside is indirect: it requires DMARC enforcement (which does help), and the visible logo aids brand recognition.