Do I need a VMC for BIMI?

For display at Gmail, Apple Mail and Yahoo, yes. Some other providers show the logo with a BIMI record without an a= tag too. A VMC is issued by a few authorities and costs money.

Why is my logo not shown even though the BIMI record is correct?

Usually the DMARC policy: BIMI requires at least quarantine, in practice with pct=100, and the message must pass DMARC. As long as DMARC is on none, no receiver evaluates BIMI.

What are the requirements for the SVG?

The SVG Tiny 1.2 Portable/Secure profile: root element svg with version 1.2 and baseProfile tiny-ps, a title element, a viewBox, no scripts, no embedded raster images, no external references, no animation, ideally under 32 KB.

Why can't I enter a selector?

This tool always checks the default selector, that is default._bimi. . A different selector only appears in the BIMI-Selector header of individual messages and cannot be checked domain-wide. Almost all domains use only default.

What does an empty l= tag mean?

A record of the form v=BIMI1; l=; is a deliberate opt-out: the domain explicitly signals receivers not to show a logo. Not an error, only a note.

Does this tool check the VMC trust chain?

No. It reads the issuer, validity and BIMI extensions of the leaf certificate, but does not build a chain to the VMC roots and does not compare the embedded logo with the l= SVG.

BIMI Check

Check a domain's BIMI record: logo URL, SVG profile, VMC and the DMARC precondition.

BIMI (Brand Indicators for Message Identification) publishes a URL to a domain's brand logo in DNS. Receiving mail clients may show that logo next to authenticated messages. BIMI is not a security mechanism in itself but the visible reward for correctly implemented email authentication: without an enforced DMARC policy no provider shows the logo.

What this tool checks

It queries the TXT record at default._bimi.<domain>, the default selector. The record is split into its tags: v=BIMI1, l= (URL to the SVG logo) and optionally a= (URL to the Verified Mark Certificate). The logo is fetched and checked against the SVG Tiny 1.2 Portable/Secure profile: root element, version and baseProfile, a <title>, a viewBox, the file size, and forbidden elements such as script, image or animations and external references. If an a= is set, the VMC is fetched, the leaf certificate is read and checked for issuer, validity and the two BIMI extensions (the Extended Key Usage 1.3.6.1.5.5.7.3.31 and the logotype extension 1.3.6.1.5.5.7.1.12). The domain's DMARC policy is also queried, with a fallback to the organizational domain.

Reading the result

No BIMI record is not an error, only a note: most domains have none. An empty l= is a deliberate opt-out. If a logo is published but the DMARC policy is none or missing, a warning appears, because no receiver shows the logo then. A record without a= still works at some mailboxes, but not at the large providers (Gmail, Apple Mail, Yahoo). Violations of the SVG profile and an expired or incomplete VMC are reported as a warning up to an error. An expired VMC is an error because the display stops immediately.

Background

BIMI is maintained by the AuthIndicators Working Group as an IETF draft (draft-brand-indicators-for-message-identification) and builds strictly on DMARC per RFC 7489: only if a message passes DMARC and the published policy is at least quarantine (in practice with pct=100) do receivers consult the BIMI record at all. The SVG profile is a stripped-down, script- and reference-free variant of SVG Tiny 1.2. The Verified Mark Certificate is a special X.509 certificate that attests a verified trademark and embeds the logo as a logotype extension; it is currently issued by a few authorities (among them DigiCert and Entrust).

Common problems and how to fix them

Logo is not shown anywhere. Almost always DMARC: policy on none, pct below 100, or alignment not yet clean. Get DMARC to quarantine or reject first, then BIMI applies.
Logo visible at Fastmail but not at Gmail. The a= with a valid VMC is missing. Providers without a VMC requirement show the logo anyway, the large mailboxes do not.
SVG is rejected. Common causes: wrong baseProfile (must be tiny-ps), missing <title>, embedded raster images via <image>, <script>, or a file over 32 KB. Re-export the logo with a BIMI-capable tool.
VMC expired. VMCs have a short lifetime (about one year). Renew in time and place the new file at the same a= URL.
Record syntax. The record must start with v=BIMI1, tags separated by ;. Multiple BIMI TXT records at the same name make receivers ignore BIMI entirely.

Common questions

Do I need a VMC for BIMI?: For display at Gmail, Apple Mail and Yahoo, yes. Some other providers show the logo with a BIMI record without an a= tag too. A VMC is issued by a few authorities and costs money.
Why is my logo not shown even though the BIMI record is correct?: Usually the DMARC policy: BIMI requires at least quarantine, in practice with pct=100, and the message must pass DMARC. As long as DMARC is on none, no receiver evaluates BIMI.
What are the requirements for the SVG?: The SVG Tiny 1.2 Portable/Secure profile: root element svg with version 1.2 and baseProfile tiny-ps, a title element, a viewBox, no scripts, no embedded raster images, no external references, no animation, ideally under 32 KB.
Why can't I enter a selector?: This tool always checks the default selector, that is default._bimi.<domain>. A different selector only appears in the BIMI-Selector header of individual messages and cannot be checked domain-wide. Almost all domains use only default.
What does an empty l= tag mean?: A record of the form v=BIMI1; l=; is a deliberate opt-out: the domain explicitly signals receivers not to show a logo. Not an error, only a note.
Does this tool check the VMC trust chain?: No. It reads the issuer, validity and BIMI extensions of the leaf certificate, but does not build a chain to the VMC roots and does not compare the embedded logo with the l= SVG.