Check a domain
Validate an SVG
How it works
DMARC first
BIMI is only evaluated once DMARC is at quarantine or reject with no partial pct. The tool checks that before anything else.
Record is parsed
v, l and a tags are validated — https only, .svg logo, .pem certificate — and unknown tags are flagged.
Logo is fetched where possible
Browsers can only read the file if the server sends a CORS header. If not, download it and paste the source below.
SVG is validated locally
Tiny PS profile checks run in your browser: baseProfile, version, title, size, banned elements, external references.
How BIMI actually works
Brand Indicators for Message Identification lets a receiver show your logo beside your messages. It is not an authentication protocol; it is a reward for having finished one. The receiver checks that the message passed DMARC, that the domain's DMARC policy is enforcing, then looks up default._bimi.yourdomain, fetches the SVG named there, and — in Gmail, Apple Mail and Yahoo — checks the Verified Mark Certificate that proves you own the logo.
Each of those steps has a way to fail quietly. The record can be perfect and the logo never appears because pct=50 is still in the DMARC record from a rollout two years ago. The SVG can render fine in every browser and be rejected because it lacks a <title> or carries baseProfile="tiny" instead of "tiny-ps". This tool walks the same path a receiver does and stops at the first thing that would stop them.
The DMARC requirement, precisely
Policy must be quarantine or reject. If pct is present it must be 100 — and since RFC 9989 replaced RFC 7489 in 2026, pct is deprecated and should simply be removed. The subdomain policy matters too: Gmail requires sp= to be enforcing as well, or absent so it inherits. A record that says p=reject; sp=none will not qualify.
SVG Tiny Portable/Secure
The logo format is a deliberately restricted subset of SVG. The root element needs version="1.2" and baseProfile="tiny-ps", a <title> directly inside it, no x or y attributes, and a square aspect ratio because Gmail crops to a circle. Scripts, external references, embedded raster images, animation and filters are all forbidden. Inline CSS is technically disallowed even though most receivers tolerate it. The file must be under 32 KB and should be served over HTTPS from a URL that does not redirect.
Most logos exported from design tools fail on three points: the export sets baseProfile="tiny", omits the title, and uses a <style> block. All three are one-minute edits in a text editor once you know they are the problem.
Do you need the certificate?
Without a VMC or CMC, the record is still valid and a few smaller receivers display the logo. Gmail, Apple and Yahoo do not. A VMC requires a registered trademark and costs a four-figure sum per year; the newer Common Mark Certificate drops the trademark requirement in exchange for a year of prior use. For a cold-email fleet the honest answer is that BIMI is rarely worth the certificate cost — the value is in the DMARC enforcement it forces you to finish.
Frequently asked questions
Why is my BIMI logo not showing in Gmail?
In order of likelihood: DMARC is not at quarantine/reject or has pct below 100; there is no VMC or CMC certificate; the SVG is not valid Tiny PS; the domain's reputation is too new or too low for Gmail to enable it. Gmail also requires the message itself to pass DMARC.
Does BIMI improve deliverability?
Not directly. Receivers do not score on it. The DMARC enforcement it requires does help, and a logo increases open rates in mailboxes that show it. Treat it as a branding outcome of good authentication, not an authentication tool.
Which selector should I check?
default, unless your sending tool told you otherwise. Selectors let you publish different logos for different mail streams via a BIMI-Selector header, but almost nobody does.
Why can the tool not read my logo URL?
Browsers refuse to read a cross-origin file unless the server sends Access-Control-Allow-Origin. Receivers are not browsers and do not care. Paste the file's source into the validator instead.
Can I use a PNG or JPEG?
No. SVG Tiny PS only. Convert vector artwork properly rather than tracing a raster — traced files are usually far over 32 KB.
Is a VMC the same as an SSL certificate?
No. A VMC is an X.509 certificate that binds a logo to a domain and a registered trademark, issued by DigiCert or Entrust. It has nothing to do with the HTTPS certificate on the site that hosts the logo, although that site does need valid HTTPS.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace and Microsoft 365 inboxes
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.