BIMI checker
Find out whether a domain is ready to show its logo in the inbox: DMARC enforcement, the BIMI record, the SVG Tiny PS logo and the mark certificate, each with a fix.
By using these tools you accept the Terms and the Privacy page.
How the BIMI checker tests each stage
The BIMI checker follows a domain through each stage a mailbox provider looks at before it shows a brand logo: the DMARC policy, the BIMI record, the SVG logo and the mark certificate. It is for senders who are setting up BIMI or want to know why their logo doesn’t appear. An inbox preview shows the logo cropped the way Gmail and Apple Mail crop it.
What each stage checks
- DMARC. For a subdomain, the organizational domain found with the RFC 9989 tree walk must also be at
quarantineorreject.t=yis flagged, because receivers that follow RFC 9989 then apply one level less. A subdomain with its own record but none on its registered domain gets a warning, because receivers that use the Public Suffix List look there. - BIMI record. Looked up at your selector on the domain, then on its organizational domain. Two records, a repeated tag, or an
l=ora=that isn’t https fails. An emptyl=anda=together means the domain declines BIMI. - Logo. Fetched over https with up to four redirects and read up to 256 KB. It should be served as
image/svg+xml. A gzip-compressed file, a viewBox that isn’t square or a file that draws nothing fails. - Certificate. It needs the BIMI extended key usage, a name that covers your domain and current validity dates, with a warning 30 days before it expires. The PEM file should hold the mark certificate first and its issuer second, and the issuer’s signature is verified where the key type allows. A logo embedded in the certificate is compared byte for byte with the SVG at
l=.
How the grade is set
The grade stops at the first stage that fails: F for DMARC or the record, D for the logo, C for the certificate. A valid logo without a certificate is a B, since Gmail and Apple Mail require one. Everything passing is an A+, or an A when a warning remains, such as a logo over 32 KB or a certificate close to expiry. A domain without a BIMI record isn’t graded, because BIMI is optional, and neither is one that declines it.
When the check can’t finish
Some servers block automated requests. An HTTP 401, 403 or 429 from the logo or certificate server is a warning, not a failure: receivers fetch from their own servers and may still get the file. A server error (5xx) or a failed DNS lookup is treated as temporary and isn’t cached. If a check that decides the grade can’t complete, the result is left ungraded rather than failed. One check has 20 seconds: the BIMI record is looked up first, and the logo and certificate downloads start as soon as it names them, alongside the DMARC lookups. Anything unanswered by then shows as couldn’t check, and after 3 seconds the page counts the seconds. Every redirect hop is checked before it is fetched, so a record can’t point the checker at a private address. Other results are cached for two minutes; Check again runs a fresh check. The preview only shows a logo that passed the safety checks and is 64 KB or smaller.
Fixing what fails
If the logo fails, the BIMI logo converter rewrites an SVG as SVG Tiny PS and lists every change. If DMARC is the blocker, the DMARC checker plans a dated path to enforcement. Once a certificate is issued, publish exactly the SVG it was issued for.
Updated · Maintained by Liviu Tanase
Questions
What does BIMI need before a logo appears?
Four things. Mail must pass DMARC under an enforced policy (p=quarantine or p=reject, no pct below 100, and a subdomain policy that isn’t none). The domain publishes a TXT record at default._bimi.example.com starting with v=BIMI1. The l= tag points to a square SVG Tiny PS logo over https. For Gmail and Apple Mail, the a= tag points to a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).
Why doesn’t my logo show in Gmail even though the check passes?
Gmail and Apple Mail require a VMC or CMC, so a self-asserted record (empty a=) won’t show there. Even with a certificate, mailbox providers decide per message: the mail has to pass DMARC, and providers also weigh the sender’s reputation and volume. A new setup can take days to appear.
What is SVG Tiny PS?
A restricted SVG profile made for BIMI. The root <svg> needs version="1.2" and baseProfile="tiny-ps", a <title>, and no x or y attributes. Scripts, event handlers, animation, <foreignObject>, embedded raster images and links to other files are forbidden, so the logo is plain vector artwork. Keep it square and, ideally, under 32 KB.
What is the difference between a VMC and a CMC?
A VMC needs a registered trademark (or a government mark) for the logo. A CMC needs proof that you have used the logo for at least a year instead. Gmail shows both, but only a VMC earns its blue verified checkmark. This checker reads the mark type stated in the certificate to tell them apart.
How do I create a BIMI record?
Enforce DMARC first: p=quarantine or p=reject (the DMARC checker plans the steps). Convert the logo to SVG Tiny PS with the BIMI logo converter and host it over https. Then publish a TXT record at default._bimi.example.com: v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem, with a= left empty until you have a VMC or CMC. Check again to confirm each stage.
How do I check a VMC or CMC certificate?
Enter the domain: the checker downloads the PEM file named in a= and confirms the BIMI extended key usage, that its names cover the domain or its organizational domain, the validity dates (with a warning 30 days before expiry), the mark type that tells a VMC from a CMC, and the chain order, verifying the issuer’s RSA signature where it can. A logo embedded in the certificate is compared byte for byte with the SVG at l=.
Does BIMI work on a subdomain?
Yes. Receivers look for the record on the subdomain first, then on the organizational domain with the same selector, and so does this checker. The organizational domain’s DMARC policy must also be quarantine or reject, and its sp= can’t be none.
What does the selector do?
Most domains only publish default._bimi. A sender can ask for a different record with a BIMI-Selector header, for example to show a sub-brand’s logo. Enter that selector to check its record instead.
Is anything sent to the logo’s server or stored?
The check runs on zerobounce.ai’s server, which looks up DNS through Cloudflare and Google, then downloads the logo and certificate once each over https, with every redirect checked. Your browser only shows the validated logo as an image; it never contacts the logo’s server. zerobounce.ai’s own logs don’t keep what you enter; Cloudflare’s request logs do, as the privacy page explains.