# BIMI Record Checker: Logo, Certificate and DMARC

URL: https://email-validation.org/tools/bimi-checker/
Updated: 2026-11-06

> Documentation index: https://email-validation.org/llms.txt

Enter a domain to check everything a mail client needs before it shows your logo: an enforced DMARC policy, the BIMI
record, the logo file in the SVG Tiny PS format and a mark certificate. The checker fetches the logo and the
certificate from the addresses in the record and explains each problem with its fix.

## What BIMI does

BIMI (Brand Indicators for Message Identification) lets a domain publish a logo that supporting mailbox providers show
next to its authenticated messages. It is defined in an Internet-Draft,
[draft-brand-indicators-for-message-identification](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/),
and by the [BIMI Group](https://bimigroup.org/). The record is a TXT record at `default._bimi.<domain>`:

```text
v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem
```

`l=` is the logo, `a=` the mark certificate. A record with both empty declines BIMI.

## The requirements, in order

1. **DMARC at enforcement.** Mail must pass DMARC, and the domain's policy must be `p=quarantine` or `p=reject`
   applied to all mail (no `pct` below 100), with subdomains not set to `sp=none`. For a subdomain, the
   organizational domain's policy must be enforced too. Check it with our [DMARC checker](https://email-validation.org/tools/dmarc-checker/).
2. **A BIMI record** at `default._bimi.<domain>` that starts with `v=BIMI1`. A subdomain without one uses the
   organizational domain's record (`default._bimi.example.com` for `news.example.com`), and so does this checker.
3. **A logo in SVG Tiny PS** (the
   [SVG Tiny Portable/Secure profile](https://datatracker.ietf.org/doc/draft-svg-tiny-ps-abrotman/)), served over
   HTTPS: `version="1.2"` and `baseProfile="tiny-ps"` on the root, a `<title>`, a square `viewBox`, no scripts, images,
   links, animation or external references, and at most 32 KB.
4. **A mark certificate** at `a=`: a Verified Mark Certificate (VMC), which needs a registered trademark, or a Common
   Mark Certificate (CMC). Gmail shows BIMI logos only with one of the two
   ([Google's BIMI help](https://support.google.com/a/answer/10911320)); other providers have their own rules.

## The problems this checker finds

- DMARC missing, at `p=none` or `sp=none`, or applied to less than 100% of mail, on the domain or its organizational
  domain: no logo will show.
- No BIMI record, more than one, or `v=BIMI1` not first.
- `l=` or `a=` not an HTTPS address, or a logo that does not end in `.svg`.
- A logo that fails SVG Tiny PS: wrong root attributes, a missing or long `<title>`, a non-square `viewBox`,
  forbidden elements or external references, or more than 32 KB. We also note logos without a solid square
  background, which mail clients crop to a circle or a rounded square.
- A certificate address that does not answer or does not return a PEM certificate. The checker confirms that a
  certificate is there; its issuer, the logo it covers and its validity are checked by each mailbox provider.

Logos also depend on the receiver's own reputation checks, so a correct setup is required but does not guarantee a
logo everywhere. Build the record with our [BIMI generator](https://email-validation.org/tools/bimi-generator/).

Checking email addresses rather than domains? Try our [free email checker](https://email-validation.org/email-checker/) or see [pricing](https://email-validation.org/pricing/) for lists and the API.

## Frequently asked questions

### Why is my BIMI logo not showing?

Most often DMARC is not enforced (it must be quarantine or reject at 100%), the logo is not valid SVG Tiny PS, or the record has no mark certificate, which Gmail requires. Mailbox providers also apply their own reputation checks.

### Do I need a VMC for BIMI?

Gmail shows BIMI logos only with a Verified Mark Certificate or a Common Mark Certificate. Some other providers show logos without one, under their own rules.

### What does the checker fetch?

The DNS records of the domain, and the logo and certificate files at the HTTPS addresses in its BIMI record, up to 64 KB each. Nothing is stored.