BIMI record checker
Read the BIMI record for any domain, and the DMARC policy that decides whether it does anything.
Try
The record behind the logo in the inbox
BIMI is a DNS record that tells mailbox providers which logo to show next to your messages. It only takes effect once DMARC is at enforcement, and Gmail shows nothing until a certificate authority has vouched for the logo, so a valid record on its own is usually not enough. This check reads both parts and tells you which gate you are stopped at.
- BIMI record at the default selector
- DMARC policy, the gate BIMI depends on
- Logo and certificate URLs from the record
- Which stage is blocking your logo
SPF + DKIM
The message authenticates
BIMI never applies to mail that fails the checks underneath it.
DMARC
Enforcement is on
p=quarantine or p=reject. Under p=none nothing below runs at all.
BIMI
The record points to a logo
A TXT record at default._bimi with an l= tag holding an SVG Tiny PS file.
VMC
A certificate vouches for it
The a= tag. A VMC earns the checkmark, a CMC shows the logo alone.
What the record gets you
The a= tag decides the outcome, and the two certificate types are not interchangeable.
| Setup | Logo in Gmail | Blue checkmark | Needs a trademark |
|---|---|---|---|
| Record with a VMC | Yes | Yes | Yes |
| Record with a CMC | Yes | No | No |
| Record with no certificate | No | No | No |
| Any record under DMARC p=none | No | No | No |
Reading a record
Three tags, semicolon separated, same shape as SPF and DMARC.
v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem
- v=
- Version. Always BIMI1 today, and the record is ignored without it.
- l=
- The logo, an HTTPS URL to an SVG Tiny PS file. Empty is a deliberate opt-out that tells receivers to show nothing.
- a=
- The certificate, an HTTPS URL to a PEM. Absent means logo-only, and nothing in Gmail.
Why a logo does not appear
| Symptom | Usual cause |
|---|---|
| Record is valid, nothing renders | DMARC is still p=none. Nothing below that gate runs. |
| Logo shows elsewhere, not in Gmail | No a= tag. Gmail needs a certificate, some providers do not. |
| Logo but no checkmark | The certificate is a CMC. Only a VMC produces the checkmark. |
| Nothing renders, everything looks right | The SVG is not Tiny PS, or the message failed SPF and DKIM alignment. |
| Works on the apex, not on a subdomain | Usually sp=none on the root DMARC record, which leaves subdomains outside enforcement. The BIMI record itself is inherited. |
Common questions
- Why is my logo not showing?
- Almost always DMARC. BIMI is ignored while your policy is p=none, so a perfect record renders nothing.
- Do I need a certificate?
- For Gmail, yes. Without a VMC or CMC it shows nothing. Some other providers render the logo from the record alone.
- VMC or CMC?
- A VMC needs a registered trademark and is the only route to the checkmark. A CMC needs none and gets you the logo alone.
- How much does a VMC cost?
- Roughly 749 to 1,750 USD a year plus trademark fees, and two to four weeks of validation.
- Why must the logo be SVG Tiny PS?
- No scripts, external references or animation, so providers can render it safely. An ordinary SVG export is rejected.
- Which selector is checked?
- default._bimi, which is what a receiver uses unless the message names another in a BIMI-Selector header. Almost nobody sends that header.
- What if my sending subdomain has no record?
- It inherits the one on your root domain, and this check falls back the same way. The DMARC sp= tag decides the policy the subdomain gets.
- Does a record prove a domain is trustworthy?
- Not on its own. This reads DNS, so it can tell you a certificate URL is published, not that a CA issued it. No record means nothing either, since most legitimate domains have none.
Use these checks during signup
The API returns allow, review, or block with the reasons behind it.