BIMI is a reward, not a control
Brand Indicators for Message Identification does nothing for security by itself. It is a small TXT record naming an image, and mailbox providers only look at it once a message has already passed authentication. The value of BIMI is that it gives an organisation a visible, commercial reason to finish a DMARC rollout that would otherwise stall at p=none — the logo appears only when the domain reaches enforcement.
That ordering matters when you are debugging. If the logo is not showing, the record is rarely the cause. Check the prerequisites first: an enforcing DMARC policy applying to 100% of mail, consistent SPF and DKIM passes with alignment on real traffic, and a sending reputation good enough that the provider chooses to display an indicator at all.
The record and its two tags
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/vmc.pem"| Tag | Required | Meaning |
|---|---|---|
| v=BIMI1 | Yes | Version. Must be the first tag or the record is ignored. |
| l= | Yes | HTTPS URL of the logo, in SVG Tiny Portable/Secure format. |
| a= | In practice | HTTPS URL of a PEM-encoded Verified Mark Certificate or Common Mark Certificate. |
Read the full explanation of bimi checker results ↓Show less ↑
An empty l= is meaningful rather than broken: v=BIMI1; l=; is an explicit declination that tells participating providers this domain deliberately has no indicator. Use it on a subdomain that should never display a logo, such as a transactional-only sending domain, to stop providers inheriting one from the organisational domain.
The a= tag is technically optional in the specification but effectively mandatory in practice, because the two providers most people care about — Gmail and Apple Mail — both require a certificate. Fastmail and Zone historically displayed self-asserted logos without one. This checker reports a missing a= as a finding rather than an error, because the record is still valid; it just will not do much.
The logo file is the hard part
BIMI requires SVG Tiny Portable/Secure (SVG P/S), a deliberately restricted profile of SVG Tiny 1.2. It is not the SVG your design tool exports. The constraints exist because the file is rendered inside a mail client, where scripting or external references would be a security problem:
- No
<script>, no event handlers, no animation elements. - No external references — no linked images, fonts, or stylesheets. Everything must be inline.
- The root element needs
baseProfile="tiny-ps"and aversion="1.2"attribute. - A
<title>element is required and should contain the brand name. - Square aspect ratio, centred artwork, and a solid (non-transparent) background — providers crop to a circle or rounded square.
- Kept small: under 32 KB is the usual working guidance, and smaller renders faster.
.svg and opens fine in a browser can still be rejected. Providers validate against the SVG P/S profile, not against "is this valid SVG". Convert with a purpose-built converter and check the output has baseProfile="tiny-ps" before publishing.Both the logo and the certificate must be served over HTTPS with a valid certificate, from a host that does not require authentication and does not redirect through anything odd. Serve the SVG as image/svg+xml. Because providers fetch these URLs, keep them on infrastructure you control and expect to keep — a broken logo URL on an otherwise valid record just means no logo displays.
Verified Mark Certificates
A VMC is an X.509 certificate that binds your logo to a registered trademark, issued by a small number of certificate authorities after a verification process. A CMC (Common Mark Certificate) is the cheaper variant for marks that are not registered trademarks — it covers logos in prior use, and Gmail began accepting it later than VMCs. Either way the file at a= is a PEM bundle containing the certificate chain, and it embeds the exact logo it certifies.
The practical consequences: you cannot change your logo without reissuing the certificate, because the embedded copy would no longer match the file at l=. Certificates expire, typically annually, and an expired VMC stops the logo displaying with no other symptom. Put the expiry in the same calendar you use for your TLS certificates, and verify it the same way you verify those with the SSL certificate checker.
Why the logo is not showing
| Symptom | Likely cause |
|---|---|
| No BIMI record found | Record published at the wrong name — it is default._bimi.example.com, not _bimi.example.com. |
| Record found, DMARC not enforcing | p=none. BIMI requires p=quarantine or p=reject, applied to 100% of mail. |
| DMARC enforcing but pct is below 100 | A pct tag below 100 disqualifies the domain. Remove it or set pct=100. |
| Everything valid, still no logo in Gmail | Missing or expired VMC, an SVG that fails the P/S profile, or insufficient sending reputation. |
| Logo shows in some clients only | Normal. Provider support varies, and each applies its own reputation threshold on top of the record. |
| Worked, then stopped | VMC expired, logo URL moved, or the DMARC policy was relaxed during an unrelated change. |
Sending from a subdomain adds a wrinkle. Providers look for a BIMI record on the exact From: domain first, then fall back to the organisational domain. But the DMARC policy that applies to a subdomain may come from the parent's sp= tag — so a parent with p=reject; sp=none publishes an enforcing policy that does *not* enforce for the subdomain you are actually sending from. This checker reports both the policy source and any weakening sp= value.
Checking BIMI from the command line
# The BIMI assertion record (default selector)
dig +short default._bimi.example.com TXT
# The prerequisite: DMARC must be quarantine or reject at 100%
dig +short _dmarc.example.com TXT
# Fetch the logo and confirm it is really SVG Tiny P/S
curl -sS https://example.com/brand/logo.svg | head -3
# look for: baseProfile="tiny-ps" version="1.2"
# Fetch the VMC and read the trademark and expiry out of it
curl -sS https://example.com/brand/vmc.pem \
| openssl x509 -noout -subject -enddate -ext subjectAltNameThe last command is the one to run before every renewal cycle. -enddate gives you the expiry, and the subject line carries the organisation name that was verified. If openssl cannot parse the file, providers cannot either — a common cause is a PEM bundle saved with Windows line endings or with the chain in the wrong order.
Non-default selectors are supported through a BIMI-Selector: header added to outgoing mail, letting you show a seasonal or campaign-specific logo. It is rarely worth the operational cost: each selector needs its own record, and any logo change needs a matching certificate. Start with default and stay there unless you have a concrete reason not to.