Skip to content
AdminKit
Live Updated

BIMI check: is your logo published, and will inboxes actually show it?

Enter a domain and AdminKit's free tool checks whether it publishes a live BIMI record at default._bimi, reads back the logo URL and VMC authority evidence it declares, and flags the one prerequisite most BIMI records are missing — an enforcing DMARC policy — because without that, the record is published but no supporting inbox will ever display the logo.

Part of the Email authentication cluster — more tools, guides and terms on email authentication.

AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.

What the result means

"Not published" just means no BIMI record exists yet — nothing is broken, and BIMI is optional branding. A published record with no DMARC enforcement is the common trap: supporting mailbox providers won't display the logo at all until the domain's DMARC policy is p=quarantine or p=reject, regardless of what the BIMI record itself says.

Next step

Get DMARC enforcing first if it isn't already, then see SPF, DKIM and DMARC explained for how the three records fit together before adding BIMI on top.

Keep this result

Copy a link to this check so you can share it or run it again later. Want a heads-up if something changes? That's early access, not a live feature yet — tell us and we'll set it up by hand.

Get alerted — early access

How it works and limits

This tool calls AdminKit’s live Check API (POST /v1/check/mail) and reads back the BIMI sub-check: a real DNS lookup for the default._bimi.<domain> TXT record, done by AdminKit’s backend, not by code running in your browser. BIMI (Brand Indicators for Message Identification) is not yet a full internet standard — it is an Internet-Draft maintained by the AuthIndicators Working Group, unlike DMARC, which is defined in RFC 7489.

How it works

A BIMI record needs two things to actually matter, and this tool checks both:

  • The DNS record — a TXT record at default._bimi.<domain> with a v=BIMI1 tag, an l= tag pointing to an SVG logo over HTTPS, and optionally an a= tag referencing a Verified Mark Certificate (VMC).
  • The DMARC prerequisite — BIMI’s trust model only works once the domain’s DMARC policy is already enforced at p=quarantine or p=reject (RFC 7489 §6.3), because BIMI depends on DMARC already having proven unauthenticated mail gets blocked or flagged. A BIMI record published under p=none is syntactically valid but will not make a logo appear anywhere.

If no record exists, the tool reports it as not published — BIMI is optional branding, so this is not a security issue by itself. If the record exists but the logo URL isn’t HTTPS, or more than one BIMI record is published (a permanent lookup error under BIMI’s own rules, mirroring how multiple DMARC records are treated), the tool flags that honestly rather than treating it as a clean pass.

Limits

  • The Verified Mark Certificate (VMC) referenced by the a= tag is paid and optional — this tool reads whether the tag is present, not whether the certificate itself is valid or current, and a domain without one can still publish a working BIMI record on providers that don’t require it.
  • This does not fetch or render the logo SVG itself, only the URL the record declares.
  • No query is logged; see /legal/privacy/.

See SPF, DKIM and DMARC explained for the prerequisite chain BIMI sits on top of — get DMARC enforcing at p=quarantine or p=reject first, since no amount of BIMI record tuning will show a logo while DMARC is still at p=none. Check your SPF record next, since it’s one of the two authentication mechanisms DMARC alignment relies on.

Frequently asked questions

Is BIMI an official internet standard like SPF or DMARC?

Not yet — BIMI is an Internet-Draft maintained by the AuthIndicators Working Group ("Brand Indicators for Message Identification"), not a published RFC, unlike DMARC (RFC 7489) or SPF (RFC 7208). Several major mailbox providers implement it anyway, but its tags and requirements can still change before any eventual standardization.

Why won't my logo show up even though I published a BIMI record?

The record being published doesn't mean a mailbox provider will display anything — BIMI's actual trust model depends on the domain's DMARC policy already being enforced at p=quarantine or p=reject (RFC 7489 defines these as the two policies that act on failing mail, unlike p=none). A BIMI record sitting on top of a p=none DMARC policy is published but inert for that reason, which is exactly what this tool's DMARC-enforcement flag surfaces.

Do I need to pay for a Verified Mark Certificate (VMC) to use BIMI?

Not always, but often in practice: BIMI's 'a=' tag can reference a VMC from a commercial certificate authority, and several major mailbox providers only display the logo when a valid VMC is present, while others will show it from the DNS record and a plain SVG logo alone. A VMC also requires the logo be a legally registered trademark, so it isn't available to every domain regardless of cost.

What does AdminKit's BIMI check actually fetch?

A real DNS TXT lookup at default._bimi.<domain>, done server-side — it parses the record's 'l=' (logo URL) and 'a=' (authority evidence / VMC) tags and reads the sibling DMARC sub-check from the same mail-posture result to determine enforcement. It does not fetch the logo SVG itself or validate a VMC certificate chain; both are out of scope for this check.