Guide
Getting ready for BIMI: DNS record, DMARC and the logo file
BIMI, Brand Indicators for Message Identification, lets a domain show its logo next to messages in supporting mail apps. It is a reward for doing email authentication properly, so getting it to work means getting several things right in order: a strong DMARC policy, a DNS record pointing to a correctly formatted logo, and usually a certificate that proves the right to use the mark. The page checks the first two and screens the third.
The DNS record
The record is a TXT record at default._bimi in front of the domain, or at another selector if you choose one. It carries a version, v=BIMI1, a logo location l= that must be an HTTPS URL to an SVG file, and a=, the address of the certificate in PEM form for providers that require it. The page fetches it, reports whether the logo address uses HTTPS and whether a certificate is referenced, and lists any problems with the tags.
The DMARC prerequisite
Receivers display a BIMI logo only for domains whose DMARC policy is quarantine or reject and applies to all mail (a pct of 100 or absent). The check is on the same record that the DMARC Checker analyses. The BIMI page shows “DMARC prerequisite met” when the policy qualifies, and says what to change when it does not. This is the step that takes time in practice: moving to enforcement requires all legitimate senders to authenticate.
The logo file
The logo must be an SVG in the restricted SVG Tiny Portable/Secure profile. Paste the SVG source or open the file and the page checks the main rules in your browser, without uploading it: the version and base profile declarations, a square viewBox, no scripts, no external references and no embedded raster images. A passing result means the file meets the rules the page knows; each mailbox provider applies its own validation and its own conditions for display.
The certificate
For a mark to be shown with the verified indicator, providers such as Gmail ask for a Verified Mark Certificate (VMC), which is issued after a trademark check, or a Common Mark Certificate (CMC). The certificate binds the logo and the domain together, and the a= tag points to it. The page reports whether the tag is present but does not download or validate the certificate.
A worked example
Press Sample to check cnn.com. When this guide was reviewed, the page found the record v=BIMI1; l=https://…svg; a=https://…pem at default._bimi.cnn.com, and printed “The logo address uses https. A certificate (a=) is referenced. DMARC prerequisite met: the policy is reject and applies to all mail.” Pasting an SVG into the second box and pressing its Sample shows how a file is checked, with a list of passed and failed rules.
Limits
The page screens a file against the main rules; it is not a full validator for SVG Tiny PS. It does not validate the certificate, check that the logo matches it or know which mail apps show logos and under what conditions, which differs by provider and changes over time. Prepare the DMARC side first with the DMARC Checker, and review the whole email setup with the Email Spoofing Test.
Related tools
- DMARC Checker is the prerequisite BIMI relies on.
- SPF Record Checker validates the sender list behind DMARC.
- Email Spoofing Test scores the whole email setup.
- MTA-STS Generator adds transport security for inbound mail.
Checked against the current version of the BIMI Checker on .