Free BIMI record checker

How to read a BIMI check

A BIMI assertion record is a TXT record. For the names in draft-brand-indicators-for-message-identification-14, the domain example.com and the selector default are queried as default._bimi.example.com. The selector default is used when a message does not include a BIMI-Selector header. The BIMI Group selectors article shows that header as BIMI-Selector: v=BIMI1; s=selectorName.

The record is a list of tags. v= must be first and must be exactly BIMI1. l= is the logo location: empty, or one HTTPS URL. The draft says only SVG and SVGZ are acceptable in l=. a= is the evidence-document location. The BIMI Group implementation guide shows v=BIMI1; l=[SVG URL]; a=[PEM URL] and says a= is currently optional, reserved for a VMC or CMC. The same guide says self-asserted records have limited support.

Google's BIMI help page says BIMI requires a VMC or a CMC, and that Gmail supports BIMI only with a PEM file. Its PEM example is v=BIMI1;l=;a=https://…/certificate.pem. Its SVG example puts the logo URL in l=. Google also says the SVG should be SVG Tiny PS, with baseProfile tiny-ps and version 1.2, and recommends a file of 32 KB or smaller. This checker reports the URL suffix, the HTTP status, and the Content-Type. It does not parse the SVG file.

BIMI also depends on DMARC. The draft says the policy must be quarantine or reject on the organizational domain and on the From domain, and that a quarantine policy must not use a pct below 100. Section 7.1 says processing must not be performed for p=none, for sp=none, or for p=quarantine when a published pct tag is not 100. The implementation guide says none policies and pct less than 100 percent are not accepted. Google says p must be quarantine or reject and pct must be 100. When pct is absent, RFC 7489 defaults it to 100. This page reads _dmarc for the domain you enter, and the organizational domain when that name is different. It does not send a message, so it cannot say that a given message passed DMARC.

The DMARC record generator builds the _dmarc TXT record. The DKIM record checker reads a selector._domainkey TXT record. The draft says BIMI relies on DMARC and on the DKIM and SPF methods DMARC uses. It is not itself an authentication protocol. Sources for this page, checked October 2026: the BIMI draft (draft-brand-indicators-for-message-identification-14, 1 May 2026), linked from the BIMI Group supporting documents, the implementation guide and selectors article above, Google's BIMI help page, and RFC 7489.