This free BIMI check reads the default._bimi record on your domain and tells you whether it is set up to put your brand logo in the inbox: the l= logo URL, the optional a= Verified Mark Certificate, the new avp= avatar-preference tag, and – most importantly – whether your DMARC policy is enforced, because without that no mailbox provider will ever show the logo. Check your domain → Need a record? The free BIMI generator builds it, including the new avp tag.
BIMI (Brand Indicators for Message Identification, specified by the AuthIndicators Working Group) lets you publish your logo in DNS so participating mailboxes – Gmail, Apple Mail, Yahoo and others – can display it next to your messages. The scanner looks up the TXT record at default._bimi.<domain>, confirms it starts with v=BIMI1, and parses each tag:
A minimal record looks like this:
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"The scanner surfaces the logo URL and any VMC or avp preference it finds. BIMI is treated as informational when it is set up correctly: a well-configured record earns a positive note without inflating the score, and a missing one is never penalised. The one exception is a BIMI record published while DMARC is not yet enforced, which the scanner flags as a warning (see below).
The l= tag must point at an https:// URL that serves an SVG Tiny Portable/Secure (SVG P/S) image. This is a deliberately locked-down profile of SVG Tiny 1.2: no scripts, no external references, no animation and a single fixed viewBox, so the file cannot become an attack vector or pull in tracking. Mailbox providers additionally expect a square logo that renders cleanly at small sizes, typically with a solid background rather than transparency.
The check confirms that a logo URL is present and reports it back to you, so you can verify it resolves over HTTPS and points at the right asset. It does not re-encode or repaint your artwork – converting a normal SVG or a raster logo into a compliant SVG P/S file is a one-time design task. If you do not have a compliant file yet, the BIMI generator helps you assemble the record around it once the SVG is ready.
The optional a= tag references a Verified Mark Certificate (VMC) – an X.509 certificate, delivered as a PEM file over HTTPS, that binds your logo to a trademark you have registered. Providers such as Gmail require a VMC (or the equivalent Common Mark Certificate) before they show the blue verified badge next to the logo. The scanner reports whether an a= tag is present, but it does not download or validate the VMC certificate chain itself – confirming issuance and trademark status is the certificate authority's job, and you can inspect the PEM directly.
The avp= tag is a more recent addition to the BIMI specification. Its value is case-sensitive: avp=brand is the default and asks providers to prefer your brand logo, while avp=personal asks them to prefer the individual sender's personal avatar (for example a profile photo) over the logo. The scanner reads the preference and shows it; any value other than personal or brand is flagged as invalid and treated as brand.
BIMI only works on top of a strong authentication posture. A logo is displayed only when your DMARC policy is at enforcement – that means p=quarantine or p=reject, applied to all mail (no pct below 100), without a testing flag t=y, and with a subdomain policy sp that is not none. With p=none the record is valid but purely observational, and no provider will render the logo.
Because of that, the scanner cross-checks your BIMI record against your live DMARC policy. If BIMI is published but DMARC is not enforced, it raises a warning that the record is currently ineffective, with the exact reason. When DMARC is enforced and a logo is present, the BIMI finding is positive. The practical order of work is always the same: get DMARC to p=quarantine or p=reject with full coverage first, then publish the BIMI record and, if you want the verified badge, add the VMC.
The most common reason is DMARC. BIMI only displays the logo when your DMARC policy is at enforcement – p=quarantine or p=reject, applied to all mail, without t=y and with sp not set to none. With p=none the record parses fine but no mailbox provider will render the logo. Bring DMARC to enforcement first, then re-test.
Not for every provider. A BIMI record with just an l= logo URL and enforced DMARC is enough for some inboxes to show your logo. A Verified Mark Certificate, referenced with the a= tag, is what unlocks the blue verified badge in providers like Gmail. The free check tells you whether an a= tag is present, but it does not validate the certificate chain itself.
avp is the avatar-preference tag. avp=brand is the default and asks providers to prefer your brand logo, while avp=personal asks them to prefer the individual sender's personal avatar over the logo. The value is case-sensitive, and anything other than personal or brand is treated as brand. The check reads this preference and shows it in the result.
BIMI Group ↗ · draft-blank-ietf-bimi (BIMI specification) ↗ · RFC 9989 (DMARC) ↗