BIMI & VMC Checker
End-to-end BIMI readiness: DMARC enforcement, record, logo and VMC.
Enter a domain to run an end-to-end BIMI and VMC readiness check. We look up the live BIMI record, fetch the logo and the certificate, and confirm the DMARC enforcement that BIMI depends on. We read everything straight from DNS and the public web over an encrypted connection. Nothing is stored.
Leave blank for default. The selector picks which <selector>._bimi.<domain> record to read.
BIMI is the last step of email authentication, not the first. It needs enforced DMARC. Check that with the DMARC Checker.
The BIMI & VMC Checker runs an end-to-end readiness test on a domain, because BIMI is a chain and a single weak link stops your logo appearing. It looks at every prerequisite in turn and tells you exactly where the chain breaks, so you are not left guessing why the inbox shows nothing.
What the checker verifies
BIMI sits on top of email authentication, so the tool works through the dependencies in order:
- DMARC at enforcement: your domain must publish a DMARC record with
p=quarantineorp=reject. A policy ofp=noneis not sufficient and the logo will not show. - BIMI DNS record: a TXT record at
default._bimi.<domain>beginningv=BIMI1, with al=tag pointing to the SVG and, usually, ana=tag pointing to the certificate. - The logo: a reachable SVG Tiny-PS file over HTTPS; validate it separately with the BIMI Logo Validator.
- The certificate: a VMC (for trademarked logos) or CMC (for unregistered marks) referenced by
a=, which Gmail and Apple Mail require before they render any mark.
How to fix what it finds
Start at the top: there is no point hosting a certificate if DMARC is still at p=none, so move to enforcement first and see how to enforce. Then publish or correct the BIMI record, confirm the SVG returns HTTP 200 over HTTPS, and ensure the a= certificate is current and matches the logo and domain. Because the SVG and certificate must agree exactly and providers cache aggressively, getting all four green at once can take several attempts; our done-for-you BIMI rollout can manage the full chain if you would rather not.
Frequently asked questions
Do I definitely need a VMC for BIMI?
For Gmail and Apple Mail, yes. They require a verified certificate before displaying a logo. That certificate can be a VMC (which needs a registered trademark) or a CMC (for unregistered marks). Some other providers will show a self-hosted SVG without any certificate.
Why does the checker say my BIMI is blocked despite a valid logo?
Almost always because DMARC is not at enforcement. BIMI requires p=quarantine or p=reject with adequate coverage; a published logo and record have no effect while the policy remains p=none.
What does the a= tag in the BIMI record do?
The a= tag is an HTTPS URL pointing to your VMC or CMC certificate (a PEM file). Mailbox providers fetch it to verify you are authorised to display the logo. Without it, certificate-requiring clients such as Gmail show nothing.
Where exactly should the BIMI record live?
At default._bimi.<yourdomain> as a TXT record, using the selector default unless your messages specify another via a BIMI-Selector header. The value starts with v=BIMI1 followed by the l= logo URL and usually an a= certificate URL.
I fixed everything but still see no logo. What now?
Allow time for provider caches and certificate validation, which can take hours to days. Confirm the SVG and certificate URLs return HTTP 200 over HTTPS, that the certificate is unexpired and matches the domain, and that DMARC enforcement has been stable. Re-run the checker once changes have propagated.