BIMI Checker
Check a domain’s BIMI record and whether it can actually display.
BIMI displays your brand logo beside authenticated mail in supporting clients. It is a marketing feature built on a security foundation: the logo only appears when the message passes DMARC at an enforcing policy, so the visible reward is deliberately gated behind having your email authentication actually working.
That gating is the first thing to check. A domain can publish a perfectly formed BIMI record with a valid SVG and still show nothing, because DMARC sits at p=none. Mailbox providers evaluate authentication first and never look at the BIMI record otherwise — so if the logo is not appearing, the answer is usually in the DMARC policy rather than in the BIMI record.
The second gate is the Verified Mark Certificate. Gmail and Apple Mail require one — a certificate from a small number of authorities attesting that you own the trademark on the logo, which involves a registered trademark and a meaningful annual cost. Without a VMC the record is valid and the large providers still will not display it, so a BIMI record with no a= tag is realistically decorative.
What this tool does
Record and assets
Reads the BIMI TXT record and reports the logo (l=) and Verified Mark Certificate (a=) it points at.
Checks the prerequisite first
BIMI does nothing without DMARC at quarantine or reject. That is checked before anything else, because it is the usual reason a valid record never displays.
Asset requirements
The logo must be SVG over HTTPS. A PNG, or an http: URL, is a record that validates and never renders.
VMC reality check
Gmail and Apple Mail require a Verified Mark Certificate. Without one the record is valid but most recipients see nothing.
Frequently asked questions
What is BIMI?
Brand Indicators for Message Identification. A TXT record at default._bimi.yourdomain points at an SVG logo, and supporting mail clients display it beside messages from your domain that pass DMARC at an enforcing policy.
Why is my BIMI logo not showing?
Most often because DMARC is at p=none. BIMI requires quarantine or reject. After that, the usual causes are a missing Verified Mark Certificate, a logo that is not in the SVG Portable/Secure profile, or the receiving client simply not supporting BIMI.
Do I need a Verified Mark Certificate?
For Gmail and Apple Mail, yes. A VMC attests that you own the trademark for the logo, which means holding a registered trademark and paying an annual fee to one of a few authorities. Some clients display BIMI without one, but the largest providers do not.
What kind of image does BIMI require?
SVG Portable/Secure — a deliberately restricted SVG profile with no scripts, no external references and no animation. An ordinary SVG exported from a design tool will usually need converting, and a PNG or JPEG is not accepted at all.
Is BIMI a security feature?
Indirectly. It adds no protection of its own, but it makes the benefit of correct email authentication visible, which is why it exists — the logo is the reward for getting DMARC to enforcement. Treat it as the last step, not a security control.
Which selector should I use?
default is the convention and what clients look for unless a message header names another. Other selectors let you use different logos for different sending streams, which is rarely worth the extra moving parts.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.