BIMI logo checker: check and interpret your BIMI record
In brief
BIMI logo checker guide: check a domain's BIMI record, interpret Palisade results, repair DMARC enforcement or record issues, and retest now.

A BIMI logo checker checks the BIMI configuration published for a domain. Enter the sending domain in the Palisade BIMI Checker, then use the result to separate a missing BIMI DNS record from a certificate, logo, or DMARC-enforcement issue. The result is useful public evidence, but it cannot prove that a mailbox provider will display a logo for every future message.
At a glance
Quick takeaways
- Palisade's BIMI Checker accepts a domain, not an uploaded logo file or SVG URL.
- BIMI policy is normally published as a DNS TXT record at
default._bimi.yourdomain.com. - A BIMI
l=tag points to the brand indicator file over HTTPS. - BIMI participation requires DMARC enforcement with
p=quarantineatpct=100orp=reject. - A BIMI record can exist while its logo or VMC certificate still needs attention. If the logo itself fails validation, see Getting your logo BIMI-ready.
- A public check does not prove the production sending path, delivered-message authentication result, continuous state, or a provider's private display decision.
What this tool checks
The Palisade BIMI Checker is a domain-level check for "Brand Display and Verified Checkmark (BIMI)." It normalizes a submitted domain, queries the public BIMI configuration, and can fetch and validate the referenced logo and certificate chain. It does not accept a logo file, SVG markup, or a standalone logo URL.
BIMI belongs in the broader set of sender-domain infrastructure controls that depend on DNS and message authentication. The checker can return a public configuration result with a pass, warn, or fail status. Its defined result headlines are:
- "Brand display and verified checkmark (BIMI) are certified"
- "Brand display and verified checkmark (BIMI) are missing"
- "Brand display and verified checkmark (BIMI) failed"
- "Brand display and verified checkmark (BIMI) requirements are not met"
- "Brand display and verified checkmark (BIMI) are not certified"
- "VMC certificate expired"
l= logo location, the a= VMC location, and, when a logo URL is available, the certificate-validity date. A successful public result can also confirm that the logo was fetched and valid, the VMC chain was trusted, the logo matched the certificate, and the certificate covered the domain.
That is still bounded evidence. The logo-validation response does not identify the exact SVG profile rule that failed. It also cannot prove that the application which sends production mail is using the intended From domain, that a receiver authenticated a delivered message, or that a particular provider will render the logo or verified checkmark.

How to run the check
1. Start with the visible From domain
Use the domain after @ in the address recipients see in the From header. If different teams or systems send from different visible domains, check each domain separately. BIMI and DMARC decisions are tied to domains, so a parent company name or a sending platform hostname is not a substitute for the actual From domain.
2. Run the BIMI check
Open the Palisade BIMI Checker and submit the domain. The checker accepts a domain even if you paste a URL or email address because it normalizes the value before scanning. Use the final domain value as your test record.
You can independently query the public BIMI policy owner with this illustrative lookup:
dig +short TXT default._bimi.yourdomain.comThe BIMI Internet-Draft specifies that domain-owner preferences are DNS TXT records beneath _bimi, with the default selector published at default._bimi.example.com. This is a public lookup only. It does not test a sent email.

3. Preserve the result before changing DNS
Copy the displayed headline, status, returned BIMI record, and technical-detail errors into the change ticket. If the card says "No BIMI record found," capture that fact with the domain and time of the lookup. If it displays l= and a=, retain those URLs as evidence without copying another organization's values into your own DNS.
Do not replace a BIMI record with an example from another domain. The logo URL, certificate URL, and certificate-domain relationship are account-specific.
How to interpret the results
Brand display and verified checkmark (BIMI) are certified
This is the checker’s passing headline. A live check of palisade.email returned a BIMI record with both l= and a= values, a fetched valid logo, and a complete trusted VMC chain where the logo matched the certificate and the certificate covered the domain.
Treat this as a strong public configuration result. Send a real message through the same production source and inspect its authentication evidence before claiming the full path is ready. Email authentication controls still determine whether the message can meet DMARC requirements.
Brand display and verified checkmark (BIMI) are missing
This is the headline for a missing BIMI record. Live checks of google.com and example.com returned this state, with no BIMI value, location, or assertion and the bimi-no-record error.
Confirm the exact From domain first. Then query default._bimi.yourdomain.com directly and compare the result with the authoritative DNS zone. The checker’s technical guidance for this error says: "Create a BIMI record with a valid, trademarked SVG (version 1.2) logo and a VMC to display your logo in your client’s inbox and increase your brand’s visibility."
The public result establishes that no BIMI record was found in that run. It does not establish why the record is absent or whether a DNS change has been approved.
Brand display and verified checkmark (BIMI) failed
This headline maps to the bimi-invalid state. It means the checker identified a BIMI configuration but did not validate it as required for a passing result. Review the raw record, l= value, a= value, and the technical details before changing anything.
The BIMI Internet-Draft requires an l= tag containing one HTTPS URI for the Brand Indicator file. It marks the a= certificate URI optional. Keep that protocol rule separate from display expectations. An a= value can be absent under the draft, while the checker may present a self-assertion warning about the absence of a VMC.
Brand display and verified checkmark (BIMI) requirements are not met
This headline maps to bimi-requirements-not-met. One defined assessment is bimi-requires-dmarc-enforcement: "BIMI record requires DMARC enforcement. This means DMARC must have a reject (any pct value) or quarantine (pct=100%) policy."
Repair DMARC enforcement before treating logo or certificate work as the next protocol threshold. The current BIMI Internet-Draft requires a strong DMARC policy on the organizational domain and the message's RFC5322.From domain. It says BIMI processing MUST NOT occur when either relevant DMARC policy is p=none. RFC 9989's DMARC policy definition defines the available p= values as none, quarantine, and reject.
Brand display and verified checkmark (BIMI) are not certified
This headline maps to bimi-uncertified. The BIMI record may be present, but the result does not establish certification. Inspect whether the output provides a logo value without an a= value or identifies a certificate-related condition. Do not infer which mailbox providers will display a logo from this state alone because provider display behavior is outside the evidence returned by a public configuration check.
VMC certificate expired
This headline maps to bimi-vmc-expired. Check the VMC URL shown as a= and the date presented by the checker. A certificate replacement must be generated and approved through the responsible certificate and DNS workflow. Recheck the public record after the replacement is published, then validate an actual message path separately.
How to act on the result
Start with the earliest failed prerequisite shown by the evidence.
- For a missing record, confirm the visible From domain, inspect
default._bimi.yourdomain.com, and obtain the domain-specific record values from the organization responsible for the logo and certificate. - For an enforcement requirement, repair DMARC policy only after reviewing aggregate-report evidence and the sending sources that would be affected. DMARC enforcement can change delivery outcomes for unauthenticated mail.
- For a logo validation issue, review the actual file at
l=. RFC 6170's certificate-image profile requires SVG Tiny 1.2 behavior, prohibitsscriptelements, and prohibits external IRI references to information outside the image for specified content types. The checker may report that a logo is invalid without identifying the particular failed rule. - For a certificate condition, use the VMC owner’s current process to examine the
a=resource and the domain relationship. Do not copy a certificate-chain URL from another tenant. - For a passing result, proceed to a delivered-message check and later aggregate-report review. A valid DNS and HTTPS configuration does not prove that every sender using the domain authenticates correctly.
Getting your logo BIMI-ready
A failed logo validation usually traces back to the file itself. BIMI accepts only a constrained SVG profile, and most exported logos need conversion, a trademark decision, and a stable hosting location before the record can pass.
Convert the logo to SVG Tiny P/S
BIMI requires SVG Tiny 1.2 restricted to the Portable/Secure profile. The root element must declare baseProfile="tiny-ps" and version="1.2". The file must be square with a solid, opaque background, contain no scripts, hyperlinks, external references, or animation, include a element describing the logo, and stay small, well under 32 KB.
Three conversion routes work:
- Palisade's BIMI SVG converter converts an uploaded logo to the Tiny P/S profile directly.
- In Adobe Illustrator, or the free Inkscape, convert text to outlines, center the mark on a square artboard with padding, add a solid background rectangle, and save as SVG using the SVG Tiny 1.2 profile. Then open the file in a text editor, remove metadata and any scripts or external references, add the
element, and setbaseProfiletotiny-ps. - Other web-based converters can transform simple logos directly in the browser, but they can mishandle gradients, fine detail, or text. Inspect the result and clean it up in a vector editor if needed. The BIMI Group also publishes conversion tools for turning an SVG 1.2 file into the P/S profile.

Meet the trademark requirement
A VMC is issued only against a registered trademark. Check the WIPO Global Brand Database to confirm whether the logo is already registered, and search for conflicting marks before filing. Submit the application through the trademark office of your country, and confirm that country is recognized by the major VMC issuers before applying.
Expect real cost and lead time. US filing runs $350 per class of goods or services since January 2025, roughly £200 in the UK, and about $250 AUD in Australia, with separate fees for each class. Registration typically takes roughly 12 months or more in the US, around 4 months in the UK, 5 to 6 months in the EU, and up to 18 to 24 months in India. Respond promptly if the trademark office contacts you, or the application can be abandoned.
VMC or CMC?
A Verified Mark Certificate requires the registered trademark and adds Gmail's blue verified checkmark beside the logo. Since September 2024, Gmail also accepts a Common Mark Certificate, which displays the logo without the checkmark and requires proof that the logo has been in public use for at least 12 months instead of a trademark. Choose based on whether you own a registered trademark and whether the checkmark matters to you.
Host the file
Host the finished SVG at a public HTTPS URL you control. A path on your own domain or CDN is ideal, so the file cannot be changed out from under you. The record's l= tag points to that URL, and a= points to the certificate.
Common logo failures
- The SVG validates in a browser but fails BIMI: a browser renders full SVG, while BIMI accepts only the Tiny P/S profile. The usual culprits are a missing
baseProfile="tiny-ps", a transparent background, an embedded raster image, or a stray script or hyperlink. - The converted file looks blurry or jagged: the converter embedded the raster image inside an SVG wrapper instead of tracing it into vector paths. Re-trace the logo with Illustrator's Image Trace or Inkscape's Trace Bitmap.
- The file is far larger than expected: automated tracers can generate thousands of unnecessary anchor points. Simplify paths and remove hidden or off-canvas elements before exporting.
- Text renders wrong on other systems: a missing font gets substituted. Convert text to outlines so the letterforms travel with the file as shapes.
- The logo appears cropped or off-center: providers crop BIMI logos to a circle. Center the mark on a square canvas with even padding on all sides.
- The logo stopped showing after it worked: certificates are typically valid for one year. When the certificate at
a=lapses, the logo stops displaying, so set a renewal reminder well before expiry.

How to retest
Run the same domain through the BIMI Checker after the authoritative DNS answer and referenced HTTPS resources have changed. The expected result depends on the repair:
- A missing record should change from "Brand display and verified checkmark (BIMI) are missing" to a result that shows the published record.
- A corrected logo should produce a successful logo fetch and validation if the file meets the required profile.
- A corrected certificate should update the displayed VMC validity information when the checker can validate the chain.
- A DMARC repair should remove the enforcement prerequisite only after the relevant domains publish a qualifying policy.
Check the BIMI record before changing the logo
If the evidence points to a missing record, expired VMC, or failed public validation, run the domain through the BIMI Checker and compare the returned l= and a= values with the approved domain configuration.
Check the BIMI domain configuration
The check can inspect public BIMI DNS, the referenced logo, and certificate-chain evidence. It does not repair DNS, identify every SVG-profile violation, monitor future changes, prove the production sending path, or guarantee inbox logo display.
Evidence
Sources and further reading
Questions readers ask
Frequently asked questions

Written by
Samuel ChenardCEO & Co-Founder, Palisade
Samuel Chenard is the CEO and co-founder of Palisade, AI-first DMARC software for IT teams and MSPs, from one domain to thousands.
More from Samuel →


