BIMI checker

Type a domain: you see whether mailboxes can show its logo next to its messages. The checker reads the BIMI record, fetches the logo and checks it against the SVG profile BIMI asks for, reads the mark certificate, and checks that DMARC is enforced, without which nothing is shown.

The DMARC lookup goes from your browser to public resolvers. Our server reads the BIMI record of the domain you type and fetches the two files it names; the answer is kept ten minutes.

What the checker looks at

The BIMI record: A TXT record at default._bimi.yourdomain: “l=” gives the address of the logo, “a=” that of the mark certificate. Both must be https addresses.
The logo: It must be an SVG in the “Tiny Portable/Secure” profile: baseProfile="tiny-ps", version 1.2, a title, no script, no embedded or external image, no animation, 32 KB at most.
The mark certificate: A VMC (for a registered trademark) or a CMC (for a logo in use for a year), issued by an authorised authority: its dates, its purpose, the domain it names and its chain.
The DMARC policy: p=quarantine or p=reject, applied to every message (pct=100). With p=none, no mailbox shows the logo, however perfect the rest.

How to read the result

Ready, with a mark certificate: Record, logo, certificate and DMARC are in order. Gmail and Apple Mail show the logo of such domains; each mailbox still decides message by message, on the sender’s reputation.
Valid logo, no certificate: Some mailboxes, Yahoo among them, can show a logo without a certificate. Gmail and Apple Mail require one.
Published but unusable: An error in the record, the logo, the certificate or DMARC: mailboxes ignore BIMI and show their usual initial or avatar. The findings say what to fix.

Errors people run into

What most often keeps a logo from showing, and how to fix it.

The logo is an ordinary SVG

Why. A file exported from a design tool is SVG 1.1, with no baseProfile, often with embedded images or style sheets. BIMI only accepts the restricted Tiny PS profile.

Fix. Convert the logo to SVG Tiny PS: set baseProfile="tiny-ps" and version="1.2" on the svg element, add a title, remove scripts, raster images, external links and animations, and keep the artwork square.

DMARC is not enforced

Why. The policy is p=none, or pct is below 100, or the subdomain policy is none. Mailboxes show a logo only for mail they can trust to come from the domain.

Fix. Move DMARC to p=quarantine or p=reject for every message first. It is the long part of the work: BIMI is the reward at the end, not a shortcut.

The certificate does not match

Why. The mark certificate has expired, names another domain, or the file holds the certificate without the authority’s intermediate certificates.

Fix. Renew it, check that it names the domain you send from, and publish the full PEM chain your authority gave you at the address of the “a=” tag.

Questions

Do I need a registered trademark?

For a VMC, yes. A CMC is for a logo that is not a registered trademark but has been in public use for at least a year; Gmail accepts it, with a few display differences.

Will the logo show at once?

No. Mailboxes cache the record and the logo, and apply their own reputation rules: allow a few days, and send real, wanted mail from the domain.

Can I publish BIMI without a certificate?

Yes: a record with only “l=” is valid. It is shown by the mailboxes that do not ask for a certificate, and ignored by the others.

What do you send to your servers?

The DMARC lookup goes from your browser to public resolvers. Our server reads the BIMI record and fetches the two files it names, because a browser may not read them across origins; the answer is kept ten minutes. The certificate’s chain up to a root is not verified here.