BIMI & VMC Checker
Inspect BIMI inputs without overstating certificate trust or provider display.
Enter a domain to inspect its published BIMI and VMC inputs. We look up the live BIMI record, fetch the logo and certificate file, and confirm the DMARC enforcement that BIMI depends on. This does not validate certificate trust or predict provider display. Nothing is stored.
Leave blank for default. The selector picks which <selector>._bimi.<domain> record to read.
BIMI is the last step of email authentication, not the first. It needs enforced DMARC. Check that with the DMARC Checker.
The BIMI & VMC Checker inspects observable DNS, DMARC, logo and certificate-file inputs. It does not validate the VMC trust chain, mark rights, message-level eligibility, reputation, revocation, or a mailbox provider's display decision.
What the checker inspects
BIMI sits on top of email authentication, so the tool works through the dependencies in order:
- DMARC at enforcement: your domain must publish a DMARC record with
p=quarantineorp=reject. A policy ofp=noneis not sufficient and the logo will not show. - BIMI DNS record: a TXT record at
default._bimi.<domain>beginningv=BIMI1, with al=tag pointing to the SVG and, usually, ana=tag pointing to the certificate. - The logo: a reachable SVG Tiny-PS file over HTTPS; validate it separately with the BIMI Logo Validator.
- The certificate: a VMC (for trademarked logos) or CMC (for unregistered marks) referenced by
a=, which Gmail and Apple Mail require before they render any mark.
How to fix what it finds
Start at the top: there is no point hosting a certificate if DMARC is still at p=none, so move to enforcement first and see how to enforce. Then publish or correct the BIMI record, confirm the SVG returns HTTP 200 over HTTPS, and ensure the a= certificate is current and matches the logo and domain. Even when all observable inputs are present, provider display remains conditional; our done-for-you BIMI rollout can manage the full chain if you would rather not.
Frequently asked questions
Do I definitely need a VMC for BIMI?
For Gmail and Apple Mail, yes. They require a verified certificate before displaying a logo. That certificate can be a VMC (which needs a registered trademark) or a CMC (for unregistered marks). Some other providers will show a self-hosted SVG without any certificate.
Why does the checker say my BIMI is blocked despite a valid logo?
Almost always because DMARC is not at enforcement. BIMI requires p=quarantine or p=reject with adequate coverage; a published logo and record have no effect while the policy remains p=none.
What does the a= tag in the BIMI record do?
The a= tag is an HTTPS URL pointing to your VMC or CMC certificate (a PEM file). Mailbox providers fetch it to verify you are authorised to display the logo. Without it, certificate-requiring clients such as Gmail show nothing.
Where exactly should the BIMI record live?
At default._bimi.<yourdomain> as a TXT record, using the selector default unless your messages specify another via a BIMI-Selector header. The value starts with v=BIMI1 followed by the l= logo URL and usually an a= certificate URL.
I fixed everything but still see no logo. What now?
Allow time for provider caches and certificate validation, which can take hours to days. Confirm the SVG and certificate URLs return HTTP 200 over HTTPS, that the certificate is unexpired and matches the domain, and that DMARC enforcement has been stable. Re-run the checker once changes have propagated.