Patchkit

Free tool

BIMI Checker

Check whether your domain is ready to show its logo in inboxes: the BIMI record, the logo file, the mark certificate and the DMARC policy behind them.

By Ahmet Karaca · Updated · Checked against BIMI Group implementation guide, BIMI Internet-Draft, RFC 9399 (logotypes in certificates) and RFC 9989 (DMARC, May 2026) on

What BIMI needs

BIMI (Brand Indicators for Message Identification) lets a mailbox provider show your logo next to messages that pass DMARC. It is a reward for finishing email authentication, so it builds on everything else: the logo is only considered for mail that passes DMARC under a policy that blocks or quarantines failures.

A working setup has up to three parts. First, a DMARC record at p=quarantine or p=reject with no testing mode and no partial pct=, on your domain and on its organizational domain. Second, a TXT record at default._bimi.yourdomain.com that starts with v=BIMI1 and points l= to your logo. Third, for Gmail and Apple Mail, a mark certificate at the a= URL that embeds the same logo and names your domain. Gmail accepts a VMC or a CMC; Apple's documentation names only the VMC and never mentions the CMC, so a VMC is the safe choice for Apple Mail.

How to use it

  1. Enter your domain. Leave the selector empty to check default, or enter the selector you published.
  2. Read the record and the findings under it first: a missing or malformed record stops everything else.
  3. Check the logo: a preview appears only when the file passes every rule below.
  4. Check the certificate card and the DMARC requirement. Each line passes or fails on its own.

The logo rules the checker applies

BIMI logos use SVG Tiny PS, a restricted SVG profile. The root element must declare version="1.2" and baseProfile="tiny-ps", carry exactly one non-empty <title>, use a square viewBox and have no x or y attributes. Scripts, animation, embedded images, <switch>, links to outside files and event handlers are not allowed. The draft also says the file should be no larger than 32 KB, and this checker reports a larger file as an error. Design tools rarely export this profile directly, which is why most logos fail here first.

What this tool checks

  • The BIMI record at your selector, with fallback to the organizational domain, its syntax, that it is written exactly as the spec requires (v=BIMI1 and lowercase tag names), and an explicit decline (empty l= and a=).
  • That the logo and certificate URLs use https on port 443 and resolve only to public addresses, following at most 3 redirects.
  • The SVG Tiny PS rules listed above, and the 32 KB size the draft recommends.
  • That the certificate carries the BIMI extended key usage, names your domain, is valid today and forms an internally consistent chain.
  • That the logo inside the certificate is the same as the l= logo once both are read as XML, so line endings, indentation, comments and attribute order don't count as a difference.
  • That DMARC is enforced: p=quarantine or p=reject, no testing mode, pct absent or 100, and no p=none or sp=none on the organizational domain.

What it doesn't check

  • We check the rules receivers most often reject a logo for; this isn't a full SVG Tiny PS schema validation.
  • Whether the certificate's root belongs to a Mark Verifying Authority approved by the BIMI Group.
  • Revocation (CRL and OCSP) and the trademark registration behind the certificate.
  • Whether the certificate is a VMC or a CMC; the result says "VMC or CMC".
  • Whether a mailbox provider will actually show the logo; that depends on its own reputation rules.

Not at enforcement yet? Moving from p=none to p=reject walks through each stage, and the DMARC generator writes the record.

Related tools and guides

Frequently asked questions

+What does BIMI need before a logo shows up?

A DMARC policy at p=quarantine or p=reject that applies to all mail, a square logo in the SVG Tiny PS format published at an https URL and, for Gmail and Apple Mail, a mark certificate published at the a= URL. Gmail accepts a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC). Apple's documentation names only the VMC and never mentions the CMC, so a VMC is the safe choice for Apple Mail.

+Why doesn't my logo appear even though every check passes?

Mailbox providers decide on their own whether to show a logo. They also look at your sending reputation and volume, and some show logos only with a certificate. Passing these checks means receivers can use your record; it doesn't guarantee they will.

+What is a BIMI selector?

A label that lets one domain publish more than one BIMI record, at selector._bimi.yourdomain.com. Almost everyone uses default. Leave the selector field empty unless you published a record under a different name.

+Is the certificate trusted if the chain is internally consistent?

Not necessarily. We check that the certificates in the file form a chain up to the last one, but we don't check whether that last one belongs to a Mark Verifying Authority the BIMI Group approved, or whether the certificate was revoked. Those checks need an up-to-date, signed list of authorities.

+Does my subdomain need its own BIMI record?

No. When a subdomain has no record, receivers fall back to the record on the organizational domain, and the checker shows when that happens. The DMARC requirement still applies to the organizational domain and its subdomains.

We use Google Analytics cookies only if you accept. Privacy policy