Skip to content
Emergency helpGet started
Back to Tools

BIMI Checker

Check a domain's BIMI record: whether it points to a logo and a mark certificate, and whether the domain's DMARC policy is at enforcement. The same scan grades the rest of the domain's email security.
Start a check
  • DNS-Based Scan
  • Non-Intrusive Analysis

What is a BIMI record?

BIMI (Brand Indicators for Message Identification) lets a domain point supporting mailbox providers to its logo. The record is a DNS TXT record at default._bimi followed by the domain, starting with v=BIMI1, with an l= tag for the logo and an a= tag for a mark certificate.

The BIMI Group's implementation guide requires DMARC at enforcement on the domain and its subdomains: p=quarantine or p=reject, without a pct below 100. Each mailbox provider decides when to show a logo, and self-asserted records without a certificate have limited support.

This BIMI checker reads the record at the default selector, checks for l= and a= and shows the DMARC policy from the same scan. It does not download or validate the logo file or the certificate.

How the BIMI check scores the record

80 or more is good, 50 to 79 is a warning and below 50 is bad. BIMI is optional and carries 5 of the 100 points in the overall email security grade.
l= and a=
Full credit.
No a=
Costs 20 points: no mark certificate is named.
No l=
Costs 50 points: there is no logo to show.
No record
Scores 0.

Common BIMI problems and how to fix them

These are the problems this checker detects, with the change that fixes each one.

DMARC not at enforcement

A DMARC policy of p=none, or a pct below 100, does not meet BIMI's DMARC requirement.

Fix: Once your DMARC reports show legitimate mail passing, move to p=quarantine or p=reject for the domain and its subdomains and remove any pct below 100.

No logo URL

Without l=, there is no logo for mailbox providers to show.

Fix: Host the logo as an SVG Tiny PS file over HTTPS and add its URL in l=.

No mark certificate

The a= tag points to a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) in PEM format. Records without one have limited support.

Fix: Get a VMC, based on a registered trademark, or a CMC from a Mark Verifying Authority, host the PEM file over HTTPS and add its URL in a=.

No BIMI record

BIMI is optional. Publish a record only once DMARC is at enforcement.

Fix: Publish a TXT record at default._bimi for the domain with the logo and certificate URLs.

default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

BIMI record tags

v=BIMI1
The version, first in the record.
l=
The HTTPS URL of the logo, in SVG Tiny PS format.
a=
The HTTPS URL of the mark certificate (VMC or CMC), in PEM format.
default._bimi
The default selector, which is where this checker looks.

Sources

More email authentication tools

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

BIMI checker FAQ

What does a BIMI checker do?

It looks up the TXT record at default._bimi for a domain and checks for the logo URL (l=) and the mark certificate (a=). This one also shows the domain's DMARC policy from the same scan, because BIMI requires DMARC at enforcement.Email Security AnalyzerCompare the public security checks

What are the BIMI requirements?

The BIMI Group's implementation guide requires SPF, DKIM and DMARC to be aligned, and DMARC at enforcement on the domain and its subdomains: p=quarantine or p=reject, without a pct below 100. The logo must be an SVG Tiny PS file.A mark certificate is listed as highly recommended but optional. Each mailbox provider has its own criteria for showing a logo.About email authentication

Do I need a VMC for BIMI?

The BIMI Group lists a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) as optional but highly recommended, and says self-asserted records without one have limited support across mailbox providers.About email authentication

Why doesn't my logo show when the BIMI record is valid?

Each mailbox provider decides when to show a BIMI logo. It also needs DMARC at enforcement and a logo in SVG Tiny PS format, and some providers support only records with a certificate. This checker checks the record and the DMARC policy, not the logo file or the certificate.About email authentication

Can I check BIMI through an API?

Yes. POST {"target":"example.com"} to https://vigilbase.com/api/v1/agent/tools/email-security/execute. The response holds the full email security result, with the BIMI analysis under result.details.records.bimi.Run a check through the public APIAPI authentication and rate limits