BIMI Record Checker

BIMI (Brand Indicators for Message Identification) is a DNS-published email standard that lets verified senders display their brand logo next to emails in supporting inbox clients. This checker queries the BIMI TXT record at selector._bimi.yourdomain.com and parses every tag. The logo URL (l=) and the optional VMC authority evidence (a=). It flags common misconfigurations including missing logo URLs, non-SVG file references, and insecure HTTP URLs for the authority evidence certificate.

BIMI sits at the top of the email authentication stack. Before a single pixel of your logo can appear in any inbox, the underlying authentication must be fully in place: SPF must authorise your sending servers, DKIM must sign outgoing messages, and DMARC must be at p=quarantine or p=reject with pct=100. A p=none DMARC policy does not qualify. BIMI is a trust signal, and inbox providers will only show your logo when the domain is genuinely protected against spoofing.

For Gmail's blue verified checkmark badge, a Verified Mark Certificate (VMC) from Entrust or DigiCert is additionally required. VMCs cryptographically verify your organisation owns the trademark associated with the logo. Apple Mail and Yahoo Mail support BIMI without a VMC, relying on DMARC enforcement alone. This tool checks the DNS side of the configuration. The record existence, tag structure, and URL format. SVG file validity and VMC certificate status must be verified separately using the BIMI Group's official tools.

BIMI is the most visible reward for completing the email authentication journey. Most recipients never think about SPF, DKIM, or DMARC. But they do notice whether an email looks trustworthy. A verified logo next to the sender name in Gmail or Apple Mail is an immediately recognisable signal, particularly for financial services, healthcare, e-commerce, and SaaS brands where recipients are frequently targeted by phishing campaigns impersonating those brands. A logo that consistently appears alongside legitimate email trains recipients to treat its absence as a warning sign.

The indirect deliverability effect is also significant. The prerequisites for BIMI, p=quarantine or p=reject DMARC with pct=100, DKIM signing across all sending sources, and clean SPF, represent the highest level of email authentication maturity. Domains that reach this standard generate fewer phishing-related spam complaints (because spoofed emails are blocked before reaching inboxes), receive better sender reputation scores at Gmail and Outlook, and are less likely to be swept into spam filters during high-volume sending periods. The BIMI logo is the visible outcome; the deliverability improvements are the underlying structural benefit.

For organisations that have already published a DMARC record at p=quarantine or p=reject, implementing BIMI is relatively low-effort. The primary requirements, a correctly formatted SVG and a published DNS TXT record, can be completed in a few hours. The VMC is the significant investment, both in cost ($1,000, $1,500 per year) and in the trademark registration prerequisite. For brands with an existing registered trademark and a meaningful email programme, the VMC cost is typically justified. For smaller organisations or those without a registered trademark, BIMI without a VMC (supported by Apple Mail and Yahoo Mail) is still achievable and worthwhile.

From a security monitoring perspective, checking a domain's BIMI record is also a useful signal during email security audits. A domain that has published a BIMI record has by definition achieved the highest DMARC enforcement level. Which itself implies SPF and DKIM are in place and passing. Conversely, a domain with no BIMI record is not necessarily less secure, but it signals the domain has not yet completed the full authentication stack or has chosen not to invest in brand display. This checker makes that status immediately visible without requiring access to the domain's DNS control panel.

Most BIMI failures trace to one of a small set of root causes. Here is what each means and how to resolve it.

BIMI is the final layer of the email authentication stack, built on top of three standards that must all be correctly configured before BIMI can function. Understanding how each layer contributes is essential for diagnosing why BIMI is or is not working for a given domain.

SPF (Sender Policy Framework) defines which IP addresses are authorised to send email on behalf of the domain. It validates the envelope sender, the Return-Path address, not the visible From: header. SPF is the first authentication check and is required for DMARC evaluation. Use the SPF Record Checker to verify your record is valid and within the RFC 7208 10-lookup limit. If your SPF record has too many include: chains, the SPF Flattening Tool resolves all includes to direct IP ranges.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages tied to your signing domain (d=). This signature survives forwarding, making DKIM the more reliable alignment mechanism for third-party ESPs like Mailchimp, SendGrid, and HubSpot. For BIMI to function, DKIM must be correctly signing outgoing messages so that DMARC can pass via DKIM alignment. Use the DKIM Analyzer to confirm the key is published, check key strength (2048-bit RSA or Ed25519 recommended), and verify there are no revoked or test-mode keys in place.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the gating requirement for BIMI. It must be at p=quarantine or p=reject with pct=100. Any weaker configuration disqualifies the domain from BIMI. DMARC ties SPF and DKIM together with alignment requirements (the authenticated domain must match the From: header) and gives the domain owner control over what happens to unauthenticated messages. Use the DMARC Checker to confirm your current policy level, or the DMARC Analyzer for a full tag-by-tag breakdown including pct=, rua=, and sp= settings.

BIMI itself publishes two pieces of information in DNS: the l= logo URL pointing to your SVG Tiny 1.2 file, and optionally the a= VMC URL pointing to your Verified Mark Certificate. The record is published as a TXT entry at selector._bimi.yourdomain.com. Inbox providers retrieve this record when evaluating whether to display the logo, cross-reference it with the domain's DMARC policy, and if all prerequisites are met, display the logo in the sender area of the message list.

For a comprehensive one-pass check of your domain's complete authentication posture, SPF, DMARC, DKIM, MX, and BIMI, use the Email Privacy Auditor which scores all five dimensions and provides a 0-10 risk rating with specific DNS fix recommendations.