BIMI record check

Looks up <selector>._bimi for the domain and its organisational domain, parses v=BIMI1, l= and a=, checks HTTPS and the .svg logo path, and whether DMARC is enforced as BIMI requires. The logo and the mark certificate are not downloaded.

Updated 2026-10-25

What this tool checks

BIMI (Brand Indicators for Message Identification) lets a domain publish a logo that mail clients can show next to authenticated messages. The check reads the record and the DMARC policy that BIMI depends on.

It looks up the TXT record at SELECTOR._bimi.DOMAIN, with default as the selector unless you give another one. The selector must be a single DNS label. If the domain has no record, the check tries the organisational domain, as BIMI specifies.
It parses the record: v=BIMI1 first, then l= with the logo URL and a= with the URL of the mark certificate.
It checks that both URLs use HTTPS and that the logo URL ends in .svg.
It evaluates the domain's DMARC record with the same logic as the DMARC check and tells you whether it is enforced.

How to read the result

BIMI_NOT_FOUND is information. BIMI is optional.
BIMI_INVALID_RECORD is an error: clients ignore a record they cannot parse, and several records under one name count as invalid.
BIMI_INSECURE_URL and BIMI_LOGO_NOT_SVG are warnings, because clients do not fetch such logos.
BIMI_DMARC_NOT_ENFORCED is a warning: without enforced DMARC no client shows the logo.
BIMI_NO_VMC is information. Some clients show logos without a certificate, but the largest ones require it.

A record with empty l= and a= declares that the domain does not want a logo shown. That is valid and is not reported as a problem.

The BIMI guide covers the logo format, mark certificates and the DMARC requirements.

Limitations

The logo and the certificate are not downloaded or validated.
Whether a logo is shown is decided by each mailbox provider. A clean result is a requirement, not a promise.
Only the selector you enter, or default, is checked.

Use it from code

API reference for BIMI record check

curl -i "https://api.probekit.dev/v1/mail/bimi?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain, BIMI selector (optional)
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

BIMI (6)

Warning BIMI_DMARC_NOT_ENFORCED DMARC is not enforced strongly enough for BIMI.
Warning BIMI_INSECURE_URL A BIMI URL does not use HTTPS.
Error BIMI_INVALID_RECORD The BIMI record is not valid.
Warning BIMI_LOGO_NOT_SVG The BIMI logo URL does not point to an SVG file.
Info BIMI_NOT_FOUND The domain publishes no BIMI record.
Info BIMI_NO_VMC The BIMI record has no mark certificate (a= tag).

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DNS (2)

Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

Frequently asked questions

Why is my logo not shown even though the record is valid?

A valid record is only the first step. Mailbox providers also require DMARC at enforcement, and many, Gmail and Apple Mail among them, show the logo only when the record points to a Verified Mark Certificate (VMC) or a similar mark certificate. Each provider also applies its own reputation rules.

What does DMARC need to look like for BIMI?

The policy must be quarantine or reject, it must apply to all mail (pct=100), and the subdomain policy must not be none either. A domain that still monitors with p=none does not qualify. The check reports this as BIMI_DMARC_NOT_ENFORCED and the DMARC guide explains how to get there safely.

What is the selector?

BIMI records live at SELECTOR._bimi.DOMAIN. Almost every domain uses the selector default, which the check uses unless you enter another one. A sender can pick another selector per message with the BIMI-Selector header.

Does the check validate my SVG logo or my VMC?

No. It checks that the URLs use HTTPS and that the logo URL ends in .svg, but it does not download either file. The SVG Tiny PS profile and the certificate chain must be checked separately.