Email authentication tool

BIMI checker

By Adam W., founder of DMARCit · Last updated 2026-10

Look up a domain's BIMI record, test the logo against the SVG Tiny PS profile, read the mark certificate, and confirm DMARC is at enforcement. Each check says pass or fail and what to change. Free, no signup.

Leave the selector at default unless your mail sends a BIMI-Selector header.

The logo is the easy part. Enforcement is the work.

BIMI shows nothing until DMARC is at quarantine or reject on the domain and its subdomains, and getting there without blocking your own mail means knowing every service that sends as you. DMARCit reads the aggregate reports receivers send back, names each sender, and shows which ones still fail alignment, so the move to enforcement is made on evidence. Free trial, no card. See the enforcement ladder →

What the checker tests

DMARC at enforcement

BIMI starts where DMARC enforcement ends. The BIMI draft tells receivers to skip BIMI when the domain or its organizational domain publishes p=none, when either record sets sp=none, or when p=quarantine comes with a pct= below 100. Gmail is stricter and wants pct=100 under p=reject as well, so the checker fails any pct= below 100. For a subdomain with no record of its own, it walks up the DNS tree the way RFC 9989 does. A t=y flag next to p=quarantine counts as not enforced, because receivers on RFC 9989 handle that record as p=none.

The BIMI record

The checker reads the TXT record at default._bimi under your domain, or under the selector you name, and falls back to the organizational domain when a subdomain has none, as receivers do. It checks that v=BIMI1 is the first tag and spelled exactly, that l= is present, that l= and a= each hold one https:// URL, and that no tag repeats. Receivers don't fix record errors; they ignore the record. A record with l= and a= both empty is a declination, a deliberate opt-out, and the checker reports it that way.

The logo

The SVG at l= is fetched and checked against the SVG Tiny Portable/Secure profile: baseProfile="tiny-ps" and version="1.2" on the root, one non-empty <title>, no x= or y= on the root <svg>, no scripts, animation, links, raster images or <foreignObject>, nothing referenced from outside the file, only elements the profile's schema allows, a square shape, and 32 KB or less. The parser never expands XML entities or loads a DTD. A file that declares entities fails outright.

The mark certificate

When a= is set, the checker fetches the PEM file and reads the first certificate in it: whether it carries the BIMI extended key usage (1.3.6.1.5.5.7.3.31), whether its Subject Alternative Name covers your domain or its organizational domain, whether today falls inside its validity window, and whether the issuing certificates follow it in order. Every mark certificate states a mark type. Registered Mark and Government Mark mean a Verified Mark Certificate (VMC); Prior Use Mark, Modified Registered Mark and Provisional Mark mean a Common Mark Certificate (CMC). The checker names the one it finds, or says it can't tell.

What it does not test

  • Chain validation against the BIMI trust store. The checker reads the certificate; it does not confirm that an authority receivers trust issued it.
  • Revocation and Certificate Transparency. Receivers check the CRL and the CT proofs. This tool does neither.
  • The logo inside the certificate. A mark certificate embeds its own copy of the logo. The checker does not compare it with the file at l=.
  • Whether a given inbox will show the logo. The BIMI draft leaves display to each mailbox provider, and providers add reputation signals of their own. A clean result here removes the reasons to refuse; it can't force a yes.
  • Redirects. The checker does not follow them. A logo or certificate URL that redirects is reported, so you can point the record at the final URL.

Where logo checks usually fail

The SVG is where most BIMI setups stall, and it is rarely the artwork. It is what the design tool wrote around the artwork.

  • Design tool exports. Illustrator adds x= and y= to the root element (the SVG Tiny PS draft calls this out by name), and editors usually write version="1.1" with no baseProfile. Delete the two attributes, then set version="1.2" and baseProfile="tiny-ps".
  • Editor metadata. Inkscape's sodipodi:namedview and similar namespaced elements are not in the profile. Save as plain SVG, then remove whatever is left.
  • Stylesheets. The profile has no <style> element and no style= attribute. Move each fill and stroke into its own fill= and stroke= attribute.
  • No title. Add one <title> directly under <svg> with the company name.
  • A transparent background. The checker doesn't fail it, but the BIMI Group recommends a solid background color, because transparent backgrounds may not display as expected.

How the checker fetches your files

The logo and the certificate are fetched over HTTPS on port 443 from public addresses only, with no redirects followed, a 5-second limit, and a size cap: 32 KB for the logo, 64 KB for the certificate file. The checker keeps no copy of the domain, the logo or the certificate. Server logs record a one-way hash of the domain and the pass or fail result of each check.

Try another tool

Sources